urlscan.io logo urlscan.io
SecurityTrails logo

www.webtretho.com Open in urlscan Pro
123.30.128.200  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-han...
Submission: On April 26 via manual from VN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 56 IPs in 7 countries across 50 domains to perform 435 HTTP transactions. The main IP is 123.30.128.200, located in Viet Nam and belongs to VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN. The main domain is www.webtretho.com. The Cisco Umbrella rank of the primary domain is 255801.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 7th 2021. Valid for: a year.
This is the only time www.webtretho.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
19 123.30.128.200 7643 (VNPT-AS-V...)
3 2a00:1450:400... 15169 (GOOGLE)
75 103.90.220.252 135905 (VNPT-AS-V...)
27 2a00:1450:400... 15169 (GOOGLE)
14 2a00:1450:400... 15169 (GOOGLE)
2 142.250.185.194 15169 (GOOGLE)
1 143.204.98.76 16509 (AMAZON-02)
1 2620:1ec:27::... 8075 (MICROSOFT...)
1 171.244.201.57 7552 (VIETEL-AS...)
2 2a00:1450:400... 15169 (GOOGLE)
1 12 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 143.204.98.39 16509 (AMAZON-02)
1 143.204.98.123 16509 (AMAZON-02)
2 8 2a00:1450:400... 15169 (GOOGLE)
1 143.204.98.62 16509 (AMAZON-02)
5 40.76.174.66 8075 (MICROSOFT...)
3 171.244.201.56 7552 (VIETEL-AS...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 27.71.231.241 38731 (VTDC-AS-V...)
8 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
15 142.250.185.98 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
9 2a00:1450:400... 15169 (GOOGLE)
32 2a00:1450:400... 15169 (GOOGLE)
1 30 2a00:1450:400... 15169 (GOOGLE)
11 44 172.217.23.98 15169 (GOOGLE)
3 8 23.35.236.247 16625 (AKAMAI-AS)
3 5 37.252.173.38 29990 (ASN-APPNEX)
1 2 52.211.64.143 16509 (AMAZON-02)
36 2a00:1450:400... 15169 (GOOGLE)
5 142.250.186.162 15169 (GOOGLE)
2 2 18.195.2.126 16509 (AMAZON-02)
8 8 18.197.164.96 16509 (AMAZON-02)
2 2 54.229.65.185 16509 (AMAZON-02)
1 1 2a05:d018:d29... 16509 (AMAZON-02)
3 3 185.64.190.78 62713 (AS-PUBMATIC)
2 2 2600:9000:215... 16509 (AMAZON-02)
2 2 213.19.147.45 3356 (LEVEL3)
3 2600:9000:215... 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
8 34.203.92.83 14618 (AMAZON-AES)
4 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 2 2620:116:800d... ()
1 1 18.198.193.48 ()
3 35.186.253.211 ()
1 1 69.173.144.138 ()
3 2405:f980::1:13 ()
2 2a00:1450:400... ()
3 5 193.0.160.129 ()
4 4 13.248.245.213 ()
1 2 51.89.9.253 ()
1 2a00:1450:400... ()
4 2404:6800:400... ()
1 74.125.133.155 ()
1 2 2001:678:cb4:... ()
1 1 216.200.232.249 ()
1 3 2606:4700:440... ()
2 2 52.208.22.113 ()
2 2 72.251.249.9 ()
1 1 2a00:1450:400... ()
1 1 2a00:1450:400... ()
2 2a00:1450:400... ()
1 1 35.186.193.173 ()
3 3 37.157.4.29 ()
2 2 3.126.56.137 ()
1 2a00:1450:400... ()
2 142.250.185.66 ()
1 1 85.114.159.93 ()
1 2 52.142.114.2 ()
1 1 2620:1ec:c11:... ()
435 56
19    123.30.128.200 (Viet Nam)

ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN)
PTR: static.vnpt.vn
www.webtretho.com
3    2a00:1450:4001:801::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
75    103.90.220.252 (Viet Nam)

ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN)
st.webtretho.com
27    2a00:1450:4001:80e::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
lh3.googleusercontent.com
14    2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
encrypted-tbn0.gstatic.com
2    142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net
www.googleadservices.com
1    143.204.98.76 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-76.fra50.r.cloudfront.net
static.hotjar.com
1    2620:1ec:27::cafe:1799 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.clarity.ms
1    171.244.201.57 (Viet Nam)

ASN7552 (VIETEL-AS-AP Viettel Group, VN)
sdk-cdn.aiactiv.io
2    2a00:1450:400c:c06::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
12    2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
3    2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    143.204.98.39 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-39.fra50.r.cloudfront.net
script.hotjar.com
1    143.204.98.123 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-123.fra50.r.cloudfront.net
vars.hotjar.com
8    2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    143.204.98.62 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-62.fra50.r.cloudfront.net
vc.hotjar.io
5    40.76.174.66 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
d.clarity.ms
3    171.244.201.56 (Viet Nam)

ASN7552 (VIETEL-AS-AP Viettel Group, VN)
tag-cdn.aiactiv.io
tags.aiactiv.io
1    2606:4700::6810:7c60 (United States)

ASN13335 (CLOUDFLARENET, US)
www.cloudflare.com
1    27.71.231.241 (Viet Nam)

ASN38731 (VTDC-AS-VN Vietel - CHT Compamy Ltd, VN)
identify.aicactus.io
8    2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
adservice.google.de
7    2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
15    142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net
securepubads.g.doubleclick.net
1    2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
7    2a00:1450:4001:803::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
9    2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
32    2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
30    2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
44    172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f2.1e100.net
cm.g.doubleclick.net
8    23.35.236.247 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-236-247.deploy.static.akamaitechnologies.com
dsum-sec.casalemedia.com
5    37.252.173.38 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
ib.adnxs.com
2    52.211.64.143 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-211-64-143.eu-west-1.compute.amazonaws.com
fw.adsafeprotected.com
36    2a00:1450:4001:810::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
s0.2mdn.net
5    142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net
googleads4.g.doubleclick.net
2    18.195.2.126 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-2-126.eu-central-1.compute.amazonaws.com
pm.w55c.net
8    18.197.164.96 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-164-96.eu-central-1.compute.amazonaws.com
x.bidswitch.net
2    54.229.65.185 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-65-185.eu-west-1.compute.amazonaws.com
ads.avct.cloud
1    2a05:d018:d29:3601:4961:8131:bfe8:dd3a (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
pr-bh.ybp.yahoo.com
3    185.64.190.78 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
2    2600:9000:2156:3600:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)
s.ad.smaato.net
2    213.19.147.45 (Utrecht, Netherlands)

ASN3356 (LEVEL3, US)
sync.1rx.io
3    2600:9000:2156:5a00:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
static.adsafeprotected.com
1    2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
8    34.203.92.83 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-203-92-83.compute-1.amazonaws.com
dt.adsafeprotected.com
4    2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
7    2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
encrypted-tbn1.gstatic.com
4    2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
encrypted-tbn3.gstatic.com
2    2620:116:800d:21:36a9:ecb:e518:b308 (None, )

ASN- ()
cms.quantserve.com
1    18.198.193.48 (None, )

ASN- ()
d.agkn.com
3    35.186.253.211 (None, )

ASN- ()
rtb.openx.net
1    69.173.144.138 (None, )

ASN- ()
pixel.rubiconproject.com
3    2405:f980::1:13 (None, )

ASN- ()
media1.admicro.vn
2    2a00:1450:4001:813::200a (None, )

ASN- ()
imasdk.googleapis.com
5    193.0.160.129 (None, )

ASN- ()
p.rfihub.com
a.rfihub.com
4    13.248.245.213 (None, )

ASN- ()
eb2.3lift.com
2    51.89.9.253 (None, )

ASN- ()
onetag-sys.com
1    2a00:1450:4001:828::200a (None, )

ASN- ()
ajax.googleapis.com
4    2404:6800:4009:824::2003 (None, )

ASN- ()
csi.gstatic.com
1    74.125.133.155 (None, )

ASN- ()
bid.g.doubleclick.net
2    2001:678:cb4:bbbb::11 (None, )

ASN- ()
ad.turn.com
r.turn.com
1    216.200.232.249 (None, )

ASN- ()
sync.mathtag.com
3    2606:4700:4400::ac40:98f5 (None, )

ASN- ()
a.tribalfusion.com
s.tribalfusion.com
2    52.208.22.113 (None, )

ASN- ()
r.scoota.co
2    72.251.249.9 (None, )

ASN- ()
ap.lijit.com
1    2a00:1450:4001:828::200e (None, )

ASN- ()
gcdn.2mdn.net
1    2a00:1450:400e::a (None, )

ASN- ()
r5---sn-5hnekn76.c.2mdn.net
2    2a00:1450:400e::7 (None, )

ASN- ()
r2---sn-5hnekn76.c.2mdn.net
1    35.186.193.173 (None, )

ASN- ()
gcm.ctnsnet.com
3    37.157.4.29 (None, )

ASN- ()
c1.adform.net
2    3.126.56.137 (None, )

ASN- ()
ups.analytics.yahoo.com
1    2a00:1450:4001:80f::200e (None, )

ASN- ()
encrypted-tbn2.gstatic.com
2    142.250.185.66 (None, )

ASN- ()
ade.googlesyndication.com
1    85.114.159.93 (None, )

ASN- ()
dsp.adfarm1.adition.com
2    52.142.114.2 (None, )

ASN- ()
c.clarity.ms
1    2620:1ec:c11::200 (None, )

ASN- ()
c.bing.com
Apex Domain
Subdomains		 Transfer
94 webtretho.com
www.webtretho.com — Cisco Umbrella Rank: 255801
st.webtretho.com — Cisco Umbrella Rank: 710091
2 MB
75 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 80
googleads.g.doubleclick.net — Cisco Umbrella Rank: 38
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 174
cm.g.doubleclick.net — Cisco Umbrella Rank: 195
googleads4.g.doubleclick.net — Cisco Umbrella Rank: 272
bid.g.doubleclick.net
382 KB
71 googlesyndication.com
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 96
tpc.googlesyndication.com — Cisco Umbrella Rank: 127
ade.googlesyndication.com
346 KB
41 gstatic.com
www.gstatic.com
fonts.gstatic.com
encrypted-tbn0.gstatic.com
encrypted-tbn1.gstatic.com
encrypted-tbn3.gstatic.com
csi.gstatic.com
encrypted-tbn2.gstatic.com
1 MB
40 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 252
gcdn.2mdn.net
r5---sn-5hnekn76.c.2mdn.net
r2---sn-5hnekn76.c.2mdn.net
3 MB
27 googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 59
382 KB
13 adsafeprotected.com
fw.adsafeprotected.com — Cisco Umbrella Rank: 694
static.adsafeprotected.com — Cisco Umbrella Rank: 527
dt.adsafeprotected.com — Cisco Umbrella Rank: 471
96 KB
13 google.com
www.google.com — Cisco Umbrella Rank: 2
adservice.google.com — Cisco Umbrella Rank: 64
24 KB
8 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 274
5 KB
8 casalemedia.com
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 530
7 KB
8 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 1220
d.clarity.ms — Cisco Umbrella Rank: 1920
c.clarity.ms
25 KB
7 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 39
imasdk.googleapis.com
ajax.googleapis.com
132 KB
7 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 163
245 KB
5 rfihub.com
p.rfihub.com
a.rfihub.com
5 KB
5 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 226
5 KB
5 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
20 KB
4 3lift.com
eb2.3lift.com
2 KB
4 google.de
www.google.de — Cisco Umbrella Rank: 6544
adservice.google.de — Cisco Umbrella Rank: 9242
1 KB
4 aiactiv.io
sdk-cdn.aiactiv.io — Cisco Umbrella Rank: 487605
tag-cdn.aiactiv.io — Cisco Umbrella Rank: 549148
tags.aiactiv.io — Cisco Umbrella Rank: 365061
244 KB
3 adform.net
c1.adform.net
2 KB
3 tribalfusion.com
a.tribalfusion.com
s.tribalfusion.com
2 KB
3 admicro.vn
media1.admicro.vn
lg1.logging.admicro.vn Failed
adi.admicro.vn Failed
153 KB
3 openx.net
rtb.openx.net
479 B
3 pubmatic.com
image6.pubmatic.com — Cisco Umbrella Rank: 565
1 KB
3 yahoo.com
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 406
ups.analytics.yahoo.com
2 KB
3 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 591
script.hotjar.com — Cisco Umbrella Rank: 840
vars.hotjar.com — Cisco Umbrella Rank: 885
67 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 58
181 KB
2 lijit.com
ap.lijit.com
1 KB
2 scoota.co
r.scoota.co
1 KB
2 turn.com
ad.turn.com
r.turn.com
869 B
2 onetag-sys.com
onetag-sys.com
483 B
2 quantserve.com
cms.quantserve.com
793 B
2 1rx.io
sync.1rx.io — Cisco Umbrella Rank: 500
1 KB
2 smaato.net
s.ad.smaato.net — Cisco Umbrella Rank: 720
1 KB
2 avct.cloud
ads.avct.cloud — Cisco Umbrella Rank: 2733
890 B
2 w55c.net
pm.w55c.net — Cisco Umbrella Rank: 834
2 KB
2 cloudflare.com
www.cloudflare.com — Cisco Umbrella Rank: 6757
cdnjs.cloudflare.com — Cisco Umbrella Rank: 212
34 KB
2 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 103
17 KB
1 bing.com
c.bing.com
554 B
1 adition.com
dsp.adfarm1.adition.com
584 B
1 ctnsnet.com
gcm.ctnsnet.com
512 B
1 mathtag.com
sync.mathtag.com
862 B
1 rubiconproject.com
pixel.rubiconproject.com
460 B
1 agkn.com
d.agkn.com
760 B
1 aicactus.io
identify.aicactus.io — Cisco Umbrella Rank: 731746
691 B
1 hotjar.io
vc.hotjar.io — Cisco Umbrella Rank: 2149
257 B
0 sohatv.vn Failed
adminplayer.sohatv.vn Failed
0 advertising.com Failed
sync.adaptv.advertising.com Failed
0 gemius.pl Failed
googlecm.hit.gemius.pl Failed
0 netmng.com Failed
google2waycm.netmng.com Failed
435 50
Domain Requested by
75 st.webtretho.com www.webtretho.com
st.webtretho.com
44 cm.g.doubleclick.net 11 redirects googleads.g.doubleclick.net
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
www.webtretho.com
36 s0.2mdn.net www.webtretho.com
s0.2mdn.net
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
32 pagead2.googlesyndication.com 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
googleads.g.doubleclick.net
tpc.googlesyndication.com
www.webtretho.com
www.googletagservices.com
s0.2mdn.net
securepubads.g.doubleclick.net
30 tpc.googlesyndication.com 1 redirects 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
tpc.googlesyndication.com
s0.2mdn.net
imasdk.googleapis.com
securepubads.g.doubleclick.net
27 lh3.googleusercontent.com www.webtretho.com
19 www.webtretho.com www.webtretho.com
st.webtretho.com
15 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.webtretho.com
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
12 www.google.com 1 redirects www.webtretho.com
st.webtretho.com
www.gstatic.com
www.google.com
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
tpc.googlesyndication.com
9 encrypted-tbn0.gstatic.com 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
9 fonts.gstatic.com www.google.com
fonts.googleapis.com
8 dt.adsafeprotected.com 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
www.webtretho.com
8 x.bidswitch.net 8 redirects
8 dsum-sec.casalemedia.com 3 redirects googleads.g.doubleclick.net
www.webtretho.com
8 googleads.g.doubleclick.net 2 redirects 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
www.webtretho.com
7 encrypted-tbn1.gstatic.com 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
7 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com securepubads.g.doubleclick.net
7 www.gstatic.com www.google.com
www.gstatic.com
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
7 www.googletagservices.com st.webtretho.com
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
securepubads.g.doubleclick.net
5 googleads4.g.doubleclick.net www.webtretho.com
5 ib.adnxs.com 3 redirects googleads.g.doubleclick.net
5 d.clarity.ms www.clarity.ms
d.clarity.ms
5 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
www.webtretho.com
4 csi.gstatic.com imasdk.googleapis.com
4 eb2.3lift.com 4 redirects
4 encrypted-tbn3.gstatic.com 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
4 fonts.googleapis.com 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
3 c1.adform.net 3 redirects
3 p.rfihub.com 3 redirects
3 media1.admicro.vn securepubads.g.doubleclick.net
media1.admicro.vn
3 rtb.openx.net 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
3 static.adsafeprotected.com fw.adsafeprotected.com
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
3 image6.pubmatic.com 3 redirects
3 www.google.de www.webtretho.com
3 www.googletagmanager.com www.webtretho.com
www.googletagmanager.com
2 c.clarity.ms 1 redirects
2 ade.googlesyndication.com www.webtretho.com
2 ups.analytics.yahoo.com 2 redirects
2 r2---sn-5hnekn76.c.2mdn.net www.webtretho.com
2 ap.lijit.com 2 redirects
2 r.scoota.co 2 redirects
2 a.tribalfusion.com 1 redirects 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
2 onetag-sys.com 1 redirects www.webtretho.com
2 a.rfihub.com www.webtretho.com
2 imasdk.googleapis.com 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
2 cms.quantserve.com 1 redirects 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
2 sync.1rx.io 2 redirects
2 s.ad.smaato.net 2 redirects
2 ads.avct.cloud 2 redirects
2 pm.w55c.net 2 redirects
2 fw.adsafeprotected.com 1 redirects www.webtretho.com
2 tag-cdn.aiactiv.io sdk-cdn.aiactiv.io
2 stats.g.doubleclick.net www.google-analytics.com
2 www.googleadservices.com www.googletagmanager.com
www.googleadservices.com
1 c.bing.com 1 redirects
1 dsp.adfarm1.adition.com 1 redirects
1 encrypted-tbn2.gstatic.com 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
1 gcm.ctnsnet.com 1 redirects
1 r5---sn-5hnekn76.c.2mdn.net 1 redirects
1 gcdn.2mdn.net 1 redirects
1 s.tribalfusion.com www.webtretho.com
1 sync.mathtag.com 1 redirects
1 r.turn.com www.webtretho.com
1 ad.turn.com 1 redirects
1 bid.g.doubleclick.net imasdk.googleapis.com
1 ajax.googleapis.com s0.2mdn.net
1 pixel.rubiconproject.com 1 redirects
1 d.agkn.com 1 redirects
1 cdnjs.cloudflare.com s0.2mdn.net
1 pr-bh.ybp.yahoo.com 1 redirects
1 adservice.google.com securepubads.g.doubleclick.net
1 adservice.google.de securepubads.g.doubleclick.net
1 tags.aiactiv.io sdk-cdn.aiactiv.io
1 identify.aicactus.io sdk-cdn.aiactiv.io
1 www.cloudflare.com sdk-cdn.aiactiv.io
1 vc.hotjar.io script.hotjar.com
1 vars.hotjar.com static.hotjar.com
1 script.hotjar.com static.hotjar.com
1 sdk-cdn.aiactiv.io www.webtretho.com
1 www.clarity.ms www.webtretho.com
1 static.hotjar.com www.webtretho.com
0 adminplayer.sohatv.vn Failed media1.admicro.vn
0 adi.admicro.vn Failed media1.admicro.vn
0 lg1.logging.admicro.vn Failed
0 sync.adaptv.advertising.com Failed 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
0 googlecm.hit.gemius.pl Failed 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
0 google2waycm.netmng.com Failed 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
435 87
Subject Issuer Validity Valid
*.webtretho.com
Sectigo RSA Domain Validation Secure Server CA		 2021-10-07 -
2022-11-04		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-04-11 -
2022-07-04		 3 months crt.sh
*.googleusercontent.com
GTS CA 1C3		 2022-04-11 -
2022-07-04		 3 months crt.sh
www.googleadservices.com
GTS CA 1C3		 2022-04-11 -
2022-07-04		 3 months crt.sh
*.hotjar.com
Amazon		 2021-11-25 -
2022-12-23		 a year crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-27 -
2023-02-27		 a year crt.sh
*.aiactiv.io
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2021-11-22 -
2022-12-23		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-04-11 -
2022-07-04		 3 months crt.sh
www.google.com
GTS CA 1C3		 2022-04-11 -
2022-07-04		 3 months crt.sh
www.google.de
GTS CA 1C3		 2022-04-11 -
2022-07-04		 3 months crt.sh
*.googleadservices.com
GTS CA 1C3		 2022-04-11 -
2022-07-04		 3 months crt.sh
*.hotjar.io
Amazon		 2021-08-17 -
2022-09-15		 a year crt.sh
a.clarity.ms
Microsoft RSA TLS CA 01		 2021-07-27 -
2022-07-27		 a year crt.sh
www.cloudflare.com
Cloudflare Inc ECC CA-3		 2021-09-18 -
2022-09-17		 a year crt.sh
*.aicactus.io
Sectigo RSA Domain Validation Secure Server CA		 2021-06-17 -
2022-06-19		 a year crt.sh
*.google.com
GTS CA 1C3		 2022-04-11 -
2022-07-04		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-04-11 -
2022-07-04		 3 months crt.sh
*.google.de
GTS CA 1C3		 2022-04-11 -
2022-07-04		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2022-04-11 -
2022-07-04		 3 months crt.sh
fw.adsafeprotected.com
Amazon		 2021-08-11 -
2022-09-09		 a year crt.sh
*.doubleclick.net
GTS CA 1C3		 2022-04-11 -
2022-07-04		 3 months crt.sh
static.adsafeprotected.com
Amazon		 2021-09-05 -
2022-10-04		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-09-21 -
2022-09-20		 a year crt.sh
dt.adsafeprotected.com
Amazon		 2022-04-10 -
2023-05-08		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-04-11 -
2022-07-04		 3 months crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-22 -
2022-09-21		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2021-07-08 -
2022-08-08		 a year crt.sh
*.admicro.vn
Sectigo RSA Domain Validation Secure Server CA		 2021-11-25 -
2022-11-02		 a year crt.sh
*.c.docs.google.com
GTS CA 1C3		 2022-04-12 -
2022-06-21		 2 months crt.sh

This page contains 32 frames:

Primary Page: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Frame ID: 4FF968148CE537293CA66ADB7607070A
Requests: 168 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-4924254a9ce4dc9b959b6e4a9b662d60.html
Frame ID: ED97720E9A8034A79A780DC1F2A9303E
Requests: 1 HTTP requests in this frame

Frame: https://identify.aicactus.io/pixel.html
Frame ID: 68796A7853FB45C0646F99C1CA3790B0
Requests: 1 HTTP requests in this frame

Frame: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: FAD0A5595121332CD1954113BC5EE60A
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4a1EcAAAAAGsrEXWWyyw8TCAhe7gBa-MdUA2K&co=aHR0cHM6Ly93d3cud2VidHJldGhvLmNvbTo0NDM.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=5izivqom8v65
Frame ID: B3E55BB9135B94245D849C770C26B714
Requests: 7 HTTP requests in this frame

Frame: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 9375C02D2CE92B45C839FF5E83001964
Requests: 26 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPD8kAIQ2OPDowMYq83NxgEwAQ&v=APEucNWq6-y-tU1oBEx4j3qWiRm1KTXutmaSeA84vYWYxtUh22tP7uy6_kOiZ-mFRDFk1oytmB9WkUOqIea36V4dW0-xvMzW7XYYZ_gPOt__mClyFSl4XzDmOmjQ4EdQHHwxVvz7tN_N7ebpk6aCAzTMmqaiakYM0wKmZ1VpMYS9sjuuZOxvnNA
Frame ID: C28B25BAF9DBB84AC5A482525F20E56F
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: C8047F867847F8F0B21DEEE5EF49324A
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/10176755/1628770975891/index.html
Frame ID: 749B3BCED2E6F5C08DD609AC22A25F64
Requests: 24 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 8247A68970EB86F5E339DE9525017332
Requests: 3 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: FF6719573618747124321B82AAB4FC12
Requests: 1 HTTP requests in this frame

Frame: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: A662BA2CE70B2429E9C94013D2159FE3
Requests: 23 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0FFB7F5FFAB9E687A8DCC40C4C151B5C
Requests: 9 HTTP requests in this frame

Frame: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 7F25B24F7A7E6CD9F1332F8CAEE48D7F
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYyeb4xgEwAQ&v=APEucNWCenc2ROjG5Zr6tlSlt6Wy77VcDKqzAdfWCNe_uQ2xMb8Fo-E1UXtxQtIRrjgU66h6Q-CPRxrIzwTPp3Ni2RqXiWULzqh3AgqA3RXcMdgGeyYYH1DshoOtY1nEUHB_RJCOMoY3X8DA9NaxuDPPnObmq4Dy4CMntQ2qux6ZlMUAO29kqZY
Frame ID: 0268CE04C143F037C7081AD1C0A733E6
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/JAPUMHT_zNnrVfwA4fX3UESFQekER8YYbnBYivkpjVo.js
Frame ID: 6D0F1E78923F3C4F2F8F1FDF3FD801F3
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsssh2h5nIbLppdgroLzEkYdvuJxZDWC-1AytBuEZPpmC3n1xc03IqCuP3qQHrVgpRgwps5-sJVDQTNyfm4PBxkpRkkcBKAFyic18xhqmhbOz3jyPm8J6oMariUzQF0uM4ZTsgZ9Xrn5iAQp74MvLyvlaMqPJfEGaVD3jpgr7ovdzFWftyayjiOxUaODzxNvFKsydXtivaLm4aT-ovrTYHjvQN7z3ChtOrbuEOxQ21jSLfXeqhcBQtJcOvrioS61BZzhf6rfePkVzfRy32AkhY23sI210cC-yf0d6Oias1JZ5sQGRjjByGoRI6CDVsfSB1Yk2vBan-srWuK06yAa1kWVibbWuuax8xgvItF3krYwqRQS&sig=Cg0ArKJSzLQGNsq04XmgEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: BD0CD9093F8A9FB389273B60C3A13436
Requests: 13 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 1450322624DFE8D91289AF71CB548AB9
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/3743105294731802651/index.html?e=69&leftOffset=0&topOffset=0&c=2sRKxn12zM&t=1&renderingType=2
Frame ID: 0BE5CBA7B7FF960F4C1F4271E219D1A3
Requests: 13 HTTP requests in this frame

Frame: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 5CEAF46EDAA35488FDF27B7634C956A3
Requests: 30 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: D752AA501BD52F2063ADE49B8E280238
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0613F6E0E777FC8F72C9CC6F23B9905A
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/LOnNfct_OK6AKwq7GByGz0_K8O7BrCXN6Fs6Py5gnPc.js
Frame ID: B6CE6C0F377B56AB2F7FB6F15D805B5E
Requests: 1 HTTP requests in this frame

Frame: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 6EE78305C67FC0AB3D6451C8DD4E605D
Requests: 18 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html
Frame ID: 725AA845B55EFE03BA8DDC7BBA235494
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: F2ED5B6A1111B51FAB361D405144EB73
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/JAPUMHT_zNnrVfwA4fX3UESFQekER8YYbnBYivkpjVo.js
Frame ID: 67B29476AB06A7F6539C02FC4DE39934
Requests: 1 HTTP requests in this frame

Frame: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: E815DD4BF3F151A80D678CE0533CB01F
Requests: 18 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 898A31EA3FA933C35453695D4A088FCF
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/JAPUMHT_zNnrVfwA4fX3UESFQekER8YYbnBYivkpjVo.js
Frame ID: B4F252FBA09132CE4C7EBA7E1C181D13
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 93FD23D7A8ED9EF5AE0AB1442343A80E
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 38A51E3D356C051E1B0972A2BADB9593
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Matt Liu bế Hương Giang từ xe xuống, nàng Hậu nũng nịu ôm chặt người yêu trước hàng trăm người

Detected technologies

Overall confidence: 100%
Detected patterns
  • TweenMax(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • googletagservices\.com/tag/js/gpt(?:_mobile)?\.js
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
  • googleapis\.com/.+webfont
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

435
Requests

87 %
HTTPS

48 %
IPv6

50
Domains

87
Subdomains

56
IPs

7
Countries

8896 kB
Transfer

15897 kB
Size

40
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 73
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763323034/?random=986521178&cv=9&fst=1650933223388&num=1&value=0&label=XP8JCMbckcoBEJrF_esC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg4k0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&tiba=Matt%20Liu%20b%E1%BA%BF%20H%C6%B0%C6%A1ng%20Giang%20t%E1%BB%AB%20xe%20xu%E1%BB%91ng%2C%20n%C3%A0ng%20H%E1%BA%ADu%20n%C5%A9ng%20n%E1%BB%8Bu%20%C3%B4m%20ch%E1%BA%B7t%20ng%C6%B0%E1%BB%9Di%20y%C3%AAu%20tr%C6%B0%E1%BB%9Bc%20h%C3%A0ng%20tr%C4%83m%20ng%C6%B0&auid=1687743279.1650933223&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=5z1nYtnQGtG-mLAPlKaJ8AI&sscte=1&crd=&eitems=ChEI8I2ZkwYQr-zJ6qze6ZDqARIdAAutJY5PocDiVUu-h0109Z9kb01pLbdGn5nYLVY HTTP 302
  • https://www.google.com/pagead/1p-conversion/763323034/?random=986521178&cv=9&fst=1650933223388&num=1&value=0&label=XP8JCMbckcoBEJrF_esC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg4k0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&tiba=Matt%20Liu%20b%E1%BA%BF%20H%C6%B0%C6%A1ng%20Giang%20t%E1%BB%AB%20xe%20xu%E1%BB%91ng%2C%20n%C3%A0ng%20H%E1%BA%ADu%20n%C5%A9ng%20n%E1%BB%8Bu%20%C3%B4m%20ch%E1%BA%B7t%20ng%C6%B0%E1%BB%9Di%20y%C3%AAu%20tr%C6%B0%E1%BB%9Bc%20h%C3%A0ng%20tr%C4%83m%20ng%C6%B0&auid=1687743279.1650933223&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=5z1nYtnQGtG-mLAPlKaJ8AI&eitems=ChEI8I2ZkwYQr-zJ6qze6ZDqARIdAAutJY4qtct4dCK2Vc_C77mrnhrgAkwAkiEmL5E&random=2970198285&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-conversion/763323034/?random=986521178&cv=9&fst=1650933223388&num=1&value=0&label=XP8JCMbckcoBEJrF_esC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg4k0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&tiba=Matt%20Liu%20b%E1%BA%BF%20H%C6%B0%C6%A1ng%20Giang%20t%E1%BB%AB%20xe%20xu%E1%BB%91ng%2C%20n%C3%A0ng%20H%E1%BA%ADu%20n%C5%A9ng%20n%E1%BB%8Bu%20%C3%B4m%20ch%E1%BA%B7t%20ng%C6%B0%E1%BB%9Di%20y%C3%AAu%20tr%C6%B0%E1%BB%9Bc%20h%C3%A0ng%20tr%C4%83m%20ng%C6%B0&auid=1687743279.1650933223&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=5z1nYtnQGtG-mLAPlKaJ8AI&eitems=ChEI8I2ZkwYQr-zJ6qze6ZDqARIdAAutJY4qtct4dCK2Vc_C77mrnhrgAkwAkiEmL5E&random=2970198285&resp=GooglemKTybQhCsO&ipr=y&prhg=0
Request Chain 174
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJP7Ro96lEOjLXRnVC4syPY&google_cver=1
Request Chain 175
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Ymc97LCLAgfB1LGNpxlCegAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJP7Ro96lEOjLXRnVC4syPY&google_cver=1
Request Chain 176
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEM_OzMFSe-y1yFpIc-h5WVs&google_cver=1
Request Chain 177
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0OTY4ODAzMjEwMDM2OTE1MQ%3D%3D
Request Chain 195
  • https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEGFlvEbSsqn6DaZaTnCcGXU&google_cver=1&google_push=AYg5qPJHovtbdCDmkHu8US75vqCQLSWM4t_XqT0qjYCQVNvNRYjKkRDkcZtV0dZKgHz0CWZqf1OMn97f6tHB_ydMHoaMAQBBeg HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEGFlvEbSsqn6DaZaTnCcGXU&google_cver=1&google_push=AYg5qPJHovtbdCDmkHu8US75vqCQLSWM4t_XqT0qjYCQVNvNRYjKkRDkcZtV0dZKgHz0CWZqf1OMn97f6tHB_ydMHoaMAQBBeg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=VHJ4UUZFaGcxTko5OWk1&google_gid=CAESEGFlvEbSsqn6DaZaTnCcGXU&google_cver=1&google_push=AYg5qPJHovtbdCDmkHu8US75vqCQLSWM4t_XqT0qjYCQVNvNRYjKkRDkcZtV0dZKgHz0CWZqf1OMn97f6tHB_ydMHoaMAQBBeg
Request Chain 196
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESENTlJSwD-ZNYY2xgzvM2fPY&google_cver=1&google_push=AYg5qPKvkMV-9daHp6WChHOv8EDow1mjLi_xxc7vd4drXS5ZqiG-Fqi2KAnHqly1eCJRa_F_s6KVivnVP3yt-1aimdMfV0meJPk HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESENTlJSwD-ZNYY2xgzvM2fPY&google_cver=1&google_push=AYg5qPKvkMV-9daHp6WChHOv8EDow1mjLi_xxc7vd4drXS5ZqiG-Fqi2KAnHqly1eCJRa_F_s6KVivnVP3yt-1aimdMfV0meJPk HTTP 302
  • https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgoogle HTTP 307
  • https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgoogle HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=59&user_id=fb6ddc5b-98d9-4dad-be63-827057d69950&ssp=google HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKvkMV-9daHp6WChHOv8EDow1mjLi_xxc7vd4drXS5ZqiG-Fqi2KAnHqly1eCJRa_F_s6KVivnVP3yt-1aimdMfV0meJPk&google_hm=c40nf7WTTY-IEXVBzT9CEw==
Request Chain 197
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEDpGKR5nF04E2ZnhqfIQNdo&google_cver=1&google_push=AYg5qPJF5NF_THOWxYbRjI-saJ85Yl_xV2Mj0hNr5vbqtOkNj6Wf8ygt1FgfAIQY1B3G-syqzeBpcYyjqH7zYEa2l4dSQrIgfcU HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJF5NF_THOWxYbRjI-saJ85Yl_xV2Mj0hNr5vbqtOkNj6Wf8ygt1FgfAIQY1B3G-syqzeBpcYyjqH7zYEa2l4dSQrIgfcU&google_hm=MTU2ODE1NDM0ODMyNDM4NTQ2MQ%3D%3D
Request Chain 198
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBCVDkrPzN3-bn6GWp4e3BQ&google_cver=1&google_push=AYg5qPIHyPR5PoaGWSCU6Nu0hYvgRgaNsCaxaxLw3AVL9cZz4-5f15AZtq37LW4NpHu35kdjEY89z1ZL8v-KdxRyEvqP9bhOpDQ HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBCVDkrPzN3-bn6GWp4e3BQ&google_cver=1&google_push=AYg5qPIHyPR5PoaGWSCU6Nu0hYvgRgaNsCaxaxLw3AVL9cZz4-5f15AZtq37LW4NpHu35kdjEY89z1ZL8v-KdxRyEvqP9bhOpDQ&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tondlXX_S-Ch1zMmoCuAPQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIHyPR5PoaGWSCU6Nu0hYvgRgaNsCaxaxLw3AVL9cZz4-5f15AZtq37LW4NpHu35kdjEY89z1ZL8v-KdxRyEvqP9bhOpDQ
Request Chain 199
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEDPcjn0G6O5mrOsqmlJmkWY&google_cver=1&google_push=AYg5qPIYKWfHKiivDY4k5PjMWZGK5F-Eb4iaRZrI7XBkIN9Mj0eQYHaur_fClLCUCAf2dIJF1rfMVFch6icQ6lHlWnQRix7qXUU HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=6d715d18&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AYg5qPIYKWfHKiivDY4k5PjMWZGK5F-Eb4iaRZrI7XBkIN9Mj0eQYHaur_fClLCUCAf2dIJF1rfMVFch6icQ6lHlWnQRix7qXUU
Request Chain 200
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEAaDZGYnNeB-l1bFYDIRKgE&google_cver=1&google_push=AYg5qPJIfD0eDWyZIRdH5q7QD4M0hpSceyRPxTepvaCe4T5gjrAgKBeRCuhg3gm9wAgcOfQV_3dLP9wzvibc5_5LGVdfAGlImiQ HTTP 302
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AYg5qPJIfD0eDWyZIRdH5q7QD4M0hpSceyRPxTepvaCe4T5gjrAgKBeRCuhg3gm9wAgcOfQV_3dLP9wzvibc5_5LGVdfAGlImiQ&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&cb=1650933228949 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJIfD0eDWyZIRdH5q7QD4M0hpSceyRPxTepvaCe4T5gjrAgKBeRCuhg3gm9wAgcOfQV_3dLP9wzvibc5_5LGVdfAGlImiQ&google_hm=
Request Chain 228
  • https://fw.adsafeprotected.com/rfw/st/996673/61756187/skeleton.js?adsafe_url=https%3A%2F%2Fwww.webtretho.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:30b785ef-c92a-0ec9-f418-f7500c490bf0,c:aQyXlA,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-7b845c4746-8pqj5,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,br:c,abv:na,an:n,oam:0,scm:publ1,nbld:0,mtim:147,fm:t44bA57+11%7C12%7C13%7C141%7C15%7C16*.996673-61756187%7C161%7C162%7C163%7C1641,idMap:16*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:na,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:162,oid:8a0db45a-c4f8-11ec-a386-aad150a49fd8,v:19.8.305,sp:1,st:0,fwm:1,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
  • https://static.adsafeprotected.com/skeleton.js
Request Chain 262
  • https://d.agkn.com/pixel/2175/?google_gid=CAESEN02drEg6nttjhpYvu4HPTo&google_cver=1&google_push=AYg5qPJFtLxA5ZG82g5Przo-fxeF3-ASmbMEoZ0Yko7Ho0aVf2ecoohcxnOU1-VKtBpDaYffBL6in0KRsYQVebCPgDo6k0KEc6Y HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJFtLxA5ZG82g5Przo-fxeF3-ASmbMEoZ0Yko7Ho0aVf2ecoohcxnOU1-VKtBpDaYffBL6in0KRsYQVebCPgDo6k0KEc6Y&google_hm=Q0FFU0VOMDJkckVnNm50dGpocFl2dTRIUFRv
Request Chain 264
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESELldGM9dy7BK-iDUSAerbTA&google_cver=1&google_push=AYg5qPJgdxRHWxgIf9ogCrMDut-DTpMe1MTg4j2v08RaNUaWm_70vK06SwmgJ7CS3Q81rFLrdLiXagEeMsWC_NYQsSGIuTyrwa8 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tondlXX_S-Ch1zMmoCuAPQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJgdxRHWxgIf9ogCrMDut-DTpMe1MTg4j2v08RaNUaWm_70vK06SwmgJ7CS3Q81rFLrdLiXagEeMsWC_NYQsSGIuTyrwa8
Request Chain 265
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENJ-oklFtMuU6MnmOaEv-qQ&google_cver=1&google_push=AYg5qPIDCsmouvvtDctop9tGNC0aEmzSy6WIu36AxSdfdJE0FXNP_krvsvvwC6Y3ZSyrgA9ULUfDgNIbo0lmyI-T4-vTsOyKoQc HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDJGRjBPVjEtMVMtQ0g0MQ==&google_push=AYg5qPIDCsmouvvtDctop9tGNC0aEmzSy6WIu36AxSdfdJE0FXNP_krvsvvwC6Y3ZSyrgA9ULUfDgNIbo0lmyI-T4-vTsOyKoQc
Request Chain 266
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAoy78I562__h2XCjmaH0mM&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM
Request Chain 276
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBrYJ8Pfgi12qmXwiWDaiD0&google_cver=1
Request Chain 277
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Ymc97LCLAgfB1LGNpxlCegAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBrYJ8Pfgi12qmXwiWDaiD0&google_cver=1
Request Chain 278
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEG2uH6XQHhGAX2f_oYlY-r0&google_cver=1
Request Chain 279
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0OTY4ODAzMjEwMDM2OTE1MQ%3D%3D
Request Chain 304
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEKT5iOb_NRvYYtwB6z84IVg&google_cver=1&google_push=AYg5qPLe30Ntqcs8aK_Gzj5CEyrkyjz_pcXsN5Vw4eMMNtHqDbI4mUfKvYgwCdXULNwi8Wb00biNw6TYYpO8Tc7ieJpsdJ4na4Q HTTP 302
  • https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPLe30Ntqcs8aK_Gzj5CEyrkyjz_pcXsN5Vw4eMMNtHqDbI4mUfKvYgwCdXULNwi8Wb00biNw6TYYpO8Tc7ieJpsdJ4na4Q&google_hm=h9vl-hsczVzKP6E5IGH6hA
Request Chain 305
  • https://p.rfihub.com/cm?in=1&pub=445&google_gid=CAESEHbbtkT_YQYVXLj52bwiUW0&google_cver=1&google_push=AYg5qPIxqSzVoq7j2jI8UYulA9VQ_6IiTTRBKjitvF5m-r3QNCLreijqpGkVKs4_Nih-BvqvEVRrVvjt3LI92DIanItKDO5lOO4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPIxqSzVoq7j2jI8UYulA9VQ_6IiTTRBKjitvF5m-r3QNCLreijqpGkVKs4_Nih-BvqvEVRrVvjt3LI92DIanItKDO5lOO4&google_hm=MzUxNjY1NDU5NDI1OTU4MTgzMw== HTTP 302
  • https://a.rfihub.com/cm?pub=445&google_error=5
Request Chain 306
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESENaAT_5wiMQqsrzEbxz0XIs&google_cver=1&google_push=AYg5qPJ_oX68r0B48ZEakb8szkGpAbKvxpCvX7DpUr0hiy5nO3-7CmH7EDBcwo-SOsf5H4gqB5krH2I9YDpfjMSE8IAvQDN62J4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJ_oX68r0B48ZEakb8szkGpAbKvxpCvX7DpUr0hiy5nO3-7CmH7EDBcwo-SOsf5H4gqB5krH2I9YDpfjMSE8IAvQDN62J4&google_hm=c40nf7WTTY-IEXVBzT9CEw==
Request Chain 307
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ
Request Chain 308
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEE7kfezuT-go_rfuXGcPLwg&google_cver=1&google_push=AYg5qPJFFOqSsWl2H9FzkSYURSxVvcYNX3zCQbEm0DBgPAahoNrE4RZuiBT_yE7tCm0Gm60i1YkrHkmEb_rz4nnk0C-XGQU5jN4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=6d715d18&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AYg5qPJFFOqSsWl2H9FzkSYURSxVvcYNX3zCQbEm0DBgPAahoNrE4RZuiBT_yE7tCm0Gm60i1YkrHkmEb_rz4nnk0C-XGQU5jN4
Request Chain 309
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESELQMcFpV_NCR2yEUzHmFEZ4&google_cver=1&google_push=AYg5qPIf7h1jqatbG8tv-EPibCkWjMQXj_pFtvciFyMjlOjfZaSmmqk50x0VMY1BuGVuXLgKDpiDMShvoQ7zWpCNhPsKFCbTS5g HTTP 302
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=AYg5qPIf7h1jqatbG8tv-EPibCkWjMQXj_pFtvciFyMjlOjfZaSmmqk50x0VMY1BuGVuXLgKDpiDMShvoQ7zWpCNhPsKFCbTS5g&google_gid=CAESELQMcFpV_NCR2yEUzHmFEZ4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg3NzQ0NDMzNjI1NzU4MjU0Mzc5MA%3D%3D&google_push=AYg5qPIf7h1jqatbG8tv-EPibCkWjMQXj_pFtvciFyMjlOjfZaSmmqk50x0VMY1BuGVuXLgKDpiDMShvoQ7zWpCNhPsKFCbTS5g
Request Chain 310
  • https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEPNQ00KIzLnbIHl_ymi7aRE&google_cver=1&google_push=AYg5qPJZGqcV_OMFSsBlqT4nh_A2gCppljwBJrRcnpPo_O1HavcE8ffWmcA4FWzUwrJuRcE9vD--PM8Ngepx5FnwMBM5Qx1ToNAg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AYg5qPJZGqcV_OMFSsBlqT4nh_A2gCppljwBJrRcnpPo_O1HavcE8ffWmcA4FWzUwrJuRcE9vD--PM8Ngepx5FnwMBM5Qx1ToNAg HTTP 302
  • https://onetag-sys.com/sync/i,19/?google_error=5
Request Chain 334
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESEB_XIXM7O6cO2jIu3JrNYZs&google_cver=1&google_push=AYg5qPJntLKgq5848U7A5xEaVYiljrYSt_ItyVJl_-puaJjhNx_kRJekIXion7qmlt_xGnGh5qNOuU60DVTpjRTfLpdkqjh_VWFV HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjQ4Mjc5NzY1MTk5NDE0NDQ4Nw==&gdpr=&gdpr_consent= HTTP 302
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESECgF-jhC7TuftvmPkoKY16g&google_cver=1
Request Chain 335
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEHubu3zFKRkXu6BsglPlTZI&google_cver=1&google_push=AYg5qPKLCHQfldgkQo7U0cABHOTh32bUYWR3oW4p1pK9uvECFxvddU27n1DM-nDU6pbnKCuHByFKLjyy5DcUJGc-EpykS0MQoewr HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPKLCHQfldgkQo7U0cABHOTh32bUYWR3oW4p1pK9uvECFxvddU27n1DM-nDU6pbnKCuHByFKLjyy5DcUJGc-EpykS0MQoewr
Request Chain 336
  • https://a.tribalfusion.com/i.match?p=b6&u=CAESEB6GGRQbbx8U32XvZNvK_og&google_cver=1&google_push=AYg5qPL557z5Aj3puJeOIfqluppiPJWCRgH4bhJetyEcz5gX7Jug8vX_jhiywXG7Gybt6qH8KJEY6FtKcmaEc9ZwJspwhZTgQHEk&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPL557z5Aj3puJeOIfqluppiPJWCRgH4bhJetyEcz5gX7Jug8vX_jhiywXG7Gybt6qH8KJEY6FtKcmaEc9ZwJspwhZTgQHEk%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEB6GGRQbbx8U32XvZNvK_og&google_cver=1&google_push=AYg5qPL557z5Aj3puJeOIfqluppiPJWCRgH4bhJetyEcz5gX7Jug8vX_jhiywXG7Gybt6qH8KJEY6FtKcmaEc9ZwJspwhZTgQHEk&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPL557z5Aj3puJeOIfqluppiPJWCRgH4bhJetyEcz5gX7Jug8vX_jhiywXG7Gybt6qH8KJEY6FtKcmaEc9ZwJspwhZTgQHEk%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Request Chain 337
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEFrI-Q6nJovhy7Pk5DTpOCw&google_cver=1&google_push=AYg5qPJu8udNlxZpOclHGtwU06WRbhEgy9EVeodLfnIrDODk1rD0LiR8bN_kNi7G6K3L621s1L3dC6ik4tndOIt_p17-1BmjbVFd HTTP 302
  • https://r.scoota.co/sync?ssp=bidswitch&bidswitch_ssp_id=google HTTP 302
  • https://r.scoota.co/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=29&expires=30&user_id=6ee336c8-5dcc-4515-aeb3-11a1cb5edc56&ssp=google HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJu8udNlxZpOclHGtwU06WRbhEgy9EVeodLfnIrDODk1rD0LiR8bN_kNi7G6K3L621s1L3dC6ik4tndOIt_p17-1BmjbVFd&google_hm=c40nf7WTTY-IEXVBzT9CEw==
Request Chain 339
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEL9N2wpUCL7CenEXi7dRnI0&google_cver=1&google_push=AYg5qPK0KFq5kMT95KKPrtisdoCmoOAqdeAF1V_bW2H1Z3bScDErHzs6K7kR5hmlCUckOOzq0rIo8yIjoBmdxLtL3qGlaunndk2d HTTP 307
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEL9N2wpUCL7CenEXi7dRnI0&google_cver=1&google_push=AYg5qPK0KFq5kMT95KKPrtisdoCmoOAqdeAF1V_bW2H1Z3bScDErHzs6K7kR5hmlCUckOOzq0rIo8yIjoBmdxLtL3qGlaunndk2d&sovrn_retry=true HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPK0KFq5kMT95KKPrtisdoCmoOAqdeAF1V_bW2H1Z3bScDErHzs6K7kR5hmlCUckOOzq0rIo8yIjoBmdxLtL3qGlaunndk2d&google_hm=bd18803b56f2c90a44e17957
Request Chain 340
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEEo9SCvmkV7TYi5hbZqxEp4&google_cver=1&google_push=AYg5qPL7Dxr83Y9AICVK-RCHZbFJR2mKHLiuaAKM8BaMhKz9R1gtKVQohJQ15vhf1EezC1iFamEkqNjBFqjxBF2e5Nv1mzcXOG4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg3NzQ0NDMzNjI1NzU4MjU0Mzc5MA%3D%3D&google_push=AYg5qPL7Dxr83Y9AICVK-RCHZbFJR2mKHLiuaAKM8BaMhKz9R1gtKVQohJQ15vhf1EezC1iFamEkqNjBFqjxBF2e5Nv1mzcXOG4
Request Chain 343
  • https://gcdn.2mdn.net/videoplayback/id/d4755f6162d05106/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682469230/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signature/5EECCE1040866738B931CE1BE2A05C305D9AB0D4.77E709DCBD0F5F66704C9F19D480D3588BA5307A/key/ck2/file/file.mp4 HTTP 302
  • https://r5---sn-5hnekn76.c.2mdn.net/videoplayback/id/d4755f6162d05106/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682469230/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/1CCDE96F375FD95724F314C6CC9042C0E06B8B96.0A7A08D85922A1D0DDD353E73CBFADBD93D48D6D/key/cms1/cms_redirect/yes/mh/Mi/mip/2a00:c98:2050:a007:2::3/mm/42/mn/sn-5hnekn76/ms/onc/mt/1650932828/mv/u/mvi/5/pl/56/file/file.mp4 HTTP 302
  • https://r2---sn-5hnekn76.c.2mdn.net/videoplayback/id/d4755f6162d05106/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682469230/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/1CCDE96F375FD95724F314C6CC9042C0E06B8B96.0A7A08D85922A1D0DDD353E73CBFADBD93D48D6D/key/cms1/cms_redirect/yes/mh/Mi/mip/2a00:c98:2050:a007:2::3/mm/42/mn/sn-5hnekn76/ms/onc/mt/1650932828/mv/u/mvi/5/pl/56/ir/1/rr/12/file/file.mp4
Request Chain 370
  • https://p.rfihub.com/cm?in=1&pub=445&google_gid=CAESEM8Ttt5mHHOeWk57D3h35Lo&google_cver=1&google_push=AYg5qPIJ1Pca7Gv99g_bT7DtW0WJ5SXXEF6GL-wRrFXlTtdz52bjRyXRbL3uVFvSEtOOXDIbeaRGZdFKvDPvHGNELxJ2reV2h-oa HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPIJ1Pca7Gv99g_bT7DtW0WJ5SXXEF6GL-wRrFXlTtdz52bjRyXRbL3uVFvSEtOOXDIbeaRGZdFKvDPvHGNELxJ2reV2h-oa&google_hm=MzUxNjY1NDU5NDI1OTU4MTgzMw== HTTP 302
  • https://a.rfihub.com/cm?pub=445&google_error=5
Request Chain 371
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEHHIX-uT-fFM7iD8ACJ_MDQ&google_cver=1&google_push=AYg5qPK5IQ3VT83gCzLOVPYBH_rtumPrr1IfEzDLh7mjeW8VE0xDpYSTcHr-SESEr1PLQfEnN-lAnbb2DPCuefIzYiGMWL4ZsSX5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPK5IQ3VT83gCzLOVPYBH_rtumPrr1IfEzDLh7mjeW8VE0xDpYSTcHr-SESEr1PLQfEnN-lAnbb2DPCuefIzYiGMWL4ZsSX5&google_hm=uzpNLx0eRcGoO_7pgeVdG4Q
Request Chain 373
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEK-udkh6GYvCsFDpGJBuVow&google_cver=1&google_push=AYg5qPLTIlHUk7I_EzKD_KA70p7jfVuqm_ZSVCiiN6yURVk2iRsb05FDIU2Z0X6BWEZCYd76uSO3YD_995uIxieMvY78aEeo3c2n HTTP 302
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEK-udkh6GYvCsFDpGJBuVow&google_cver=1&google_push=AYg5qPLTIlHUk7I_EzKD_KA70p7jfVuqm_ZSVCiiN6yURVk2iRsb05FDIU2Z0X6BWEZCYd76uSO3YD_995uIxieMvY78aEeo3c2n HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzk5NDgyMjMxODY1MTY2MDEyMQ&google_push=AYg5qPLTIlHUk7I_EzKD_KA70p7jfVuqm_ZSVCiiN6yURVk2iRsb05FDIU2Z0X6BWEZCYd76uSO3YD_995uIxieMvY78aEeo3c2n
Request Chain 375
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESELasfuegd4wTTNeWwHLwK4o&google_cver=1&google_push=AYg5qPINp56IYwuaPI4wHK1Hu-_eG3a5RX_zOK8DJiipMtXscyP25a77GO8Yt1FoFJLqPpX9rU1vQQGrV2owbO5ZcP-CxDZY3CjO HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg3NzQ0NDMzNjI1NzU4MjU0Mzc5MA%3D%3D&google_push=AYg5qPINp56IYwuaPI4wHK1Hu-_eG3a5RX_zOK8DJiipMtXscyP25a77GO8Yt1FoFJLqPpX9rU1vQQGrV2owbO5ZcP-CxDZY3CjO
Request Chain 376
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEN0aZXRF-wzdUnzHMq73Mx8&google_cver=1&google_push=AYg5qPIqS6lDkpnIQBUgU_fRL93X1CjjKCztej85UrsZXxrfu33ZOifWyPsmrHwo8jXkWMRi1j72DJyZshq8gFBNP7IJotRsxbRLVw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1jSGRWNlVwRTJ1SFFWc2p2VVBmeWVkTUNLdWRsMVhoNX5B&google_push=AYg5qPIqS6lDkpnIQBUgU_fRL93X1CjjKCztej85UrsZXxrfu33ZOifWyPsmrHwo8jXkWMRi1j72DJyZshq8gFBNP7IJotRsxbRLVw
Request Chain 395
  • https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKCL57XsHBCABBiAATIIgoSA_Oqki0U HTTP 301
  • https://tpc.googlesyndication.com/simgad/7103612115487317334
Request Chain 403
  • https://googleads.g.doubleclick.net/xbbe/pixel?d=CM6y0QEQpvfjARiL7-3IASABMAE&v=APEucNUOa3P0aHYxH7aMBW896mI2QN2N_Lc0LYnVeY2Cpdd7vCuhxtLO_zgWuKwVW9PP_L9NEbOMpzT5mGkAQT4Vdrc6f-Tcew HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA6b7AydI7UBv14F9K2UOGw&google_cver=1
Request Chain 412
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEILssvYX37rDFHMsc9A9Z_k&google_cver=1&google_push=AYg5qPKD2FD8AJ7iDUWU766Bij-DlWawTAausO1_DAl6G0Scx4xfJeiFYNkHb4QwBNcvgpgFd8WPxDpXO0QcmqeTX6iM-6ITGxXs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzA5MDcwNDIzMDc0Mjk0Nzk4Ng%3D%3D&google_push=AYg5qPKD2FD8AJ7iDUWU766Bij-DlWawTAausO1_DAl6G0Scx4xfJeiFYNkHb4QwBNcvgpgFd8WPxDpXO0QcmqeTX6iM-6ITGxXs
Request Chain 413
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEG1mRYA5xKDQfbNxFz8ZeaU&google_cver=1&google_push=AYg5qPKFbmjM5Iuh8P_D2-yJF1pnxXGfWOlNDRJ7GgNC-Cd-_XZaZFKTq6wOk7ErKv4_KZlbLC_odTk_XKs3jymbL73dvhUd2pe7 HTTP 302
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=google HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=3516654594259581833&expires=30&ssp=google HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKFbmjM5Iuh8P_D2-yJF1pnxXGfWOlNDRJ7GgNC-Cd-_XZaZFKTq6wOk7ErKv4_KZlbLC_odTk_XKs3jymbL73dvhUd2pe7&google_hm=c40nf7WTTY-IEXVBzT9CEw==
Request Chain 414
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMq0c6zkqnSmrfhIZuSF1wo&google_cver=1&google_push=AYg5qPLZsqc9rbhqcAo-rtFe2twdJI6wsCthwRGNidXQL_0SPAxdJbqVOdEWvisYxFtmGp3osT4eEWe2gaRoKqkFC_YzKi07AKQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzk5NDgyMjMxODY1MTY2MDEyMQ&google_push=AYg5qPLZsqc9rbhqcAo-rtFe2twdJI6wsCthwRGNidXQL_0SPAxdJbqVOdEWvisYxFtmGp3osT4eEWe2gaRoKqkFC_YzKi07AKQ
Request Chain 415
  • https://onetag-sys.com/sync/i,19/?google_gid=CAESEGEx4QLlCE-JIGhixCxQ8Wc&google_cver=1&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
Request Chain 416
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEAYjtzc8D8g0jha1oqKgDrA&google_cver=1&google_push=AYg5qPJItJwwWjTS77t5VpkOJ6e6oe-1Us_W7tUQlXNx-faDHH4Ci1g_hzk8RJuw__Vkriuqy8ZXOQz7vke2PrNVcDaDjDWItt2zvQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1jSGRWNlVwRTJ1SFFWc2p2VVBmeWVkTUNLdWRsMVhoNX5B&google_push=AYg5qPJItJwwWjTS77t5VpkOJ6e6oe-1Us_W7tUQlXNx-faDHH4Ci1g_hzk8RJuw__Vkriuqy8ZXOQz7vke2PrNVcDaDjDWItt2zvQ
Request Chain 424
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?CtsSyncId=79D265CFBA344D21B2E42331A1C906DF&RedC=c.clarity.ms&MXFR=1D2AE661325F600C26CBF7F3365F6E50 HTTP 302
  • https://c.clarity.ms/c.gif?CtsSyncId=79D265CFBA344D21B2E42331A1C906DF&MUID=3283EED520EE6BB30029FF47213C6A44

435 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi
www.webtretho.com/f/hong-showbiz/ 		214 KB
40 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
c42cae75913ec96ba31fccf326428b94dd67b74811da10d337f9504eee0e4561
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 26 Apr 2022 00:31:23 GMT
etag
W/"35787-mLUMiKWEI07PZr6F7skD4pBppww"
expires
Tue, 26 Apr 2022 01:31:23 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-cache
MISS
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
js
www.googletagmanager.com/gtag/ 		98 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-43173086-1
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e73cb29d06e940b29c9e76ca982683ed9bf180197cb21e3ef95d455f7b3a9f2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38806
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 00:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 26 Apr 2022 00:33:43 GMT
579287c1.83b51110.chunk.css
st.webtretho.com/_next/static/css/ 		483 KB
57 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/css/579287c1.83b51110.chunk.css
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
5a46500fc330c3cb0f2ff3e4c77bfc67c85f1caf81d6e6904e87da6b51b288cc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:43 GMT
content-encoding
gzip
last-modified
Tue, 05 Apr 2022 15:14:16 GMT
server
nginx
age
1760355
etag
W/"624c5cc8-78dcf"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=2592000,public, must-revalidate, proxy-revalidate
expires
Thu, 14 Jul 2022 15:34:28 GMT
gtm.js
www.googletagmanager.com/ 		385 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NTFWKLK
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
6357d0585407b92bcde642e269c884655cf6d4820df3cc0ff6d8b4307c9ad0e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
77743
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 00:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 26 Apr 2022 00:33:43 GMT
logo-w.png
www.webtretho.com/static/img/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.webtretho.com/static/img/logo-w.png
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
f66663288c356836650b769dbe1b68bc97e4d08f5b230f2ffc1e1c72480b0b06

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:31:23 GMT
content-encoding
gzip
last-modified
Tue, 26 Oct 2021 15:51:07 GMT
server
nginx
etag
W/"617823eb-1251"
vary
Accept-Encoding
content-type
image/png
cache-control
max-age=5184000, public
expires
Sat, 25 Jun 2022 00:31:23 GMT
logo-20_new.png
www.webtretho.com/static/img/anniversary/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.webtretho.com/static/img/anniversary/logo-20_new.png
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
7bfd19845d91b69d293846e050b9f41efbc02106594ab7b867eaad88e7414500

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:31:23 GMT
content-encoding
gzip
last-modified
Wed, 09 Mar 2022 07:58:05 GMT
server
nginx
etag
W/"62285e0d-4220"
vary
Accept-Encoding
content-type
image/png
cache-control
max-age=5184000, public
expires
Sat, 25 Jun 2022 00:31:23 GMT
xVwWMHMMXfzOZmYr26z0Tu5qkKhOrZuo7vMhac33vVJGGten5eNolqAGjwIdoIEdSOvHhWCSJnWFL5bESs3swqpWXPRkkP3t734crJLT=w600-w10
lh3.googleusercontent.com/ 		907 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/xVwWMHMMXfzOZmYr26z0Tu5qkKhOrZuo7vMhac33vVJGGten5eNolqAGjwIdoIEdSOvHhWCSJnWFL5bESs3swqpWXPRkkP3t734crJLT=w600-w10
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
0f26c9b081df69f4e24dd632d150201820e81050f6b989fc2dd931aaed2f311b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
907
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:43 GMT
l8fbWJB7tx7iRlkbKAkQUptrS0fPiqUAejerhbQxxSWld774bkYULstXU78AsxMeTdYBCCBg9h2Jtvi7numWP0SMlmwK826sfNA0qgV60g=w600-w10
lh3.googleusercontent.com/ 		956 B
1018 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/l8fbWJB7tx7iRlkbKAkQUptrS0fPiqUAejerhbQxxSWld774bkYULstXU78AsxMeTdYBCCBg9h2Jtvi7numWP0SMlmwK826sfNA0qgV60g=w600-w10
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
0aa05ed4daa7f2b61776026cc4b613ef7ee7adce95b9e2ce8c7175b1eeb520d3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
956
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:43 GMT
_utx1qWWRU5KjXF2L83z1SlMX1NYv59Dcu7do2qmLaLqYiX0Ap0B5cTUpXMnbHxwAheBvXBl-WO3-OiZrG3OFUYaBN8SvtPBvHdUvQ4T4yY=w600-w10
lh3.googleusercontent.com/ 		378 B
440 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/_utx1qWWRU5KjXF2L83z1SlMX1NYv59Dcu7do2qmLaLqYiX0Ap0B5cTUpXMnbHxwAheBvXBl-WO3-OiZrG3OFUYaBN8SvtPBvHdUvQ4T4yY=w600-w10
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
3f79f9b094f6c293ae7ebf9ea570a1adea9ef7a3325ec0ba361d453a9c344564
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
378
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:43 GMT
rU1qBYdCPtUbZDybq8_9wC32L1hFSgR7775eL6UcqYwDmLPUZcb6CiDqxAKukEj8vv8sTa6rBPwEi1R1zH7mUtbZPuEmIpBYlt-KJhi9=w600-w10
lh3.googleusercontent.com/ 		388 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/rU1qBYdCPtUbZDybq8_9wC32L1hFSgR7775eL6UcqYwDmLPUZcb6CiDqxAKukEj8vv8sTa6rBPwEi1R1zH7mUtbZPuEmIpBYlt-KJhi9=w600-w10
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
36a6e46245a09bf885bd9d8cc497955e169b691f9add690cdfe06c9ac8b9ad22
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
388
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:43 GMT
rUu3EMRo1LQPYj6jCP8bFQY504AU1cxLbhqI-RL_kIKaKrVkcA5idxThFWvzrjInMaQyojw_8yDALmGhxsOPdUFJg0k1p1hgA0TFg987yrI=w600-w10
lh3.googleusercontent.com/ 		390 B
452 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/rUu3EMRo1LQPYj6jCP8bFQY504AU1cxLbhqI-RL_kIKaKrVkcA5idxThFWvzrjInMaQyojw_8yDALmGhxsOPdUFJg0k1p1hgA0TFg987yrI=w600-w10
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
bfca0b6f1dc25757d76491238330c153e79b2fa83a34e22cc12165ec01887b8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
390
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:43 GMT
Aktryw1ss08k-lqC1-RxiMoviJdYUQl6PTZBZXUQmOW9zyvbZzh3u1DGs3J9P2bNn5JaPghCdzAZvsaJ0amW_j6vfkhDjFBUFrJ98JM5=w600-w10
lh3.googleusercontent.com/ 		390 B
471 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/Aktryw1ss08k-lqC1-RxiMoviJdYUQl6PTZBZXUQmOW9zyvbZzh3u1DGs3J9P2bNn5JaPghCdzAZvsaJ0amW_j6vfkhDjFBUFrJ98JM5=w600-w10
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
4ee0e14dc6bfdcd52ada1be260f77ac32abf0efcf15a23f474ecfa4e62d73cd3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:44 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
390
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:44 GMT
AnRtrt0nvD-j7b7C3GCFTVCh2dfeoT0TX-mqiR5TcwhcttppKBnwqUv-r0pUzurH0dwFmact1kwlv2A7KgFctLiSLRUpB8JlOSPPpjAcKg=w600-w10
lh3.googleusercontent.com/ 		345 B
438 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/AnRtrt0nvD-j7b7C3GCFTVCh2dfeoT0TX-mqiR5TcwhcttppKBnwqUv-r0pUzurH0dwFmact1kwlv2A7KgFctLiSLRUpB8JlOSPPpjAcKg=w600-w10
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
175b7bf18f98fae8f11666d22da87b6e5b9903f8cf4e12a012074c6915e8f54b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.png"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
345
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:43 GMT
wtt-care.svg
www.webtretho.com/static/icon/ 		72 KB
72 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.webtretho.com/static/icon/wtt-care.svg
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
23d58779970abea74af6685f86a98f6acc1223a16944b54f6ebdc1fb71dfda1c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:31:23 GMT
last-modified
Tue, 26 Oct 2021 15:51:07 GMT
server
nginx
etag
"617823eb-120a1"
content-type
image/svg+xml
cache-control
max-age=5184000, public
content-length
73889
expires
Sat, 25 Jun 2022 00:31:23 GMT
logo.png
www.webtretho.com/static/img/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.webtretho.com/static/img/logo.png
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
64cafe249e9d812908ddb760e41d094b2c8de11c98408ecae3d5bf51d271ee49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:31:23 GMT
content-encoding
gzip
last-modified
Tue, 26 Oct 2021 15:51:07 GMT
server
nginx
etag
W/"617823eb-21a0"
vary
Accept-Encoding
content-type
image/png
cache-control
max-age=5184000, public
expires
Sat, 25 Jun 2022 00:31:23 GMT
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-43173086-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
3533
date
Mon, 25 Apr 2022 23:34:50 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Tue, 26 Apr 2022 01:34:50 GMT
Banner-hd-default-dsk.jpg
www.webtretho.com/static/img/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.webtretho.com/static/img/Banner-hd-default-dsk.jpg
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
ebeb8017dea624e96d74fc47c4f8c622993e511b256f148dd41e20f20ee909a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:31:23 GMT
content-encoding
gzip
last-modified
Tue, 26 Oct 2021 15:51:07 GMT
server
nginx
etag
W/"617823eb-1393"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
max-age=5184000, public
expires
Sat, 25 Jun 2022 00:31:23 GMT
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1853257280&t=pageview&_s=1&dl=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&ul=en-us&de=UTF-8&dt=Matt%20Liu%20b%E1%BA%BF%20H%C6%B0%C6%A1ng%20Giang%20t%E1%BB%AB%20xe%20xu%E1%BB%91ng%2C%20n%C3%A0ng%20H%E1%BA%ADu%20n%C5%A9ng%20n%E1%BB%8Bu%20%C3%B4m%20ch%E1%BA%B7t%20ng%C6%B0%E1%BB%9Di%20y%C3%AAu%20tr%C6%B0%E1%BB%9Bc%20h%C3%A0ng%20tr%C4%83m%20ng%C6%B0%E1%BB%9Di&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=4GBAAUABAAAAAC~&jid=1586742571&gjid=155978099&cid=1873700710.1650933223&tid=UA-43173086-1&_gid=565082439.1650933223&_r=1&gtm=2ou4k0&cd10=H%C3%B3ng%20Showbiz&cd11=yeumaunang88&z=178769529
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.webtretho.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.webtretho.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
post.js
st.webtretho.com/_next/static/1650275250293/pages/ 		38 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/1650275250293/pages/post.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e1251bbf5e3a03f563e3de8690f29d1c4bda783bd8e9b4e8e2b928c57031b844

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:43 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657085
etag
W/"625d3438-99d7"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
_app.js
st.webtretho.com/_next/static/1650275250293/pages/ 		116 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/1650275250293/pages/_app.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
02763466fbfa88b12dc9a69e0a8c0e51ab61a894ed4196907df03604592b85fc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:43 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657085
etag
W/"625d3438-1d1cc"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
85b95f6a074e49116a04d3b68b2d0e9084216637.49cbbf6b580f42dbebdc.js
st.webtretho.com/_next/static/chunks/ 		264 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/85b95f6a074e49116a04d3b68b2d0e9084216637.49cbbf6b580f42dbebdc.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
60f9494209a87a0f6ee00ec8fcfbc973bb2b8074dae2e00c2ce82964066f3d49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:43 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657085
etag
W/"625d3438-41e9c"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000,public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
171.de0215808bfd65f5731e.js
st.webtretho.com/_next/static/chunks/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/171.de0215808bfd65f5731e.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
cbcd7d6a74606267bc1991f924c9ec57b9e8c060e71265504eccbb50209274e6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:43 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
656995
etag
W/"625d3438-963"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:03:48 GMT
176.7a3d0addb1e696542bc6.js
st.webtretho.com/_next/static/chunks/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/176.7a3d0addb1e696542bc6.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
8d8abeda3163e5da9b652b5369ce86fbc45fd975b552255bdf2e60b17cc1e54e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:43 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657085
etag
W/"625d3438-127f"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
144.e0119963c9f892b13a4e.js
st.webtretho.com/_next/static/chunks/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/144.e0119963c9f892b13a4e.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
1d17b1204229892a289a9810b5bf713865bd65903e910fcd74cf5f243dbdc008

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-24c3"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
195.96bb532d743c2d46ee5e.js
st.webtretho.com/_next/static/chunks/ 		1 KB
714 B 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/195.96bb532d743c2d46ee5e.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
c4ab1a513e585c36df0f2e90505d9beeb4944b4d1a051be8296e07d110c62dd1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
656995
etag
W/"625d3438-458"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:03:49 GMT
b76d0c825d79fef287e8bd0af711927544b695ef.9b163aefece58407e99a.js
st.webtretho.com/_next/static/chunks/ 		18 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/b76d0c825d79fef287e8bd0af711927544b695ef.9b163aefece58407e99a.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e5d16e9f8bfad5c20d9dbd54a6ba433c540f31e4d84f667f49042e4eb8640269

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-47a6"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
23.6616de9c95c4ff5a7bcc.js
st.webtretho.com/_next/static/chunks/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/23.6616de9c95c4ff5a7bcc.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
34e6e09e027956a5440e0bfc21bc73f466a168b6b40f46749c7dfd72cba68b4f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-334a"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
149.0463a76266d717389aec.js
st.webtretho.com/_next/static/chunks/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/149.0463a76266d717389aec.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
dd70df7f293f7fdd881a28ae7e80ef7dad74e9a6058e8c1b768c761e4e71da44

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-1968"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
187.7d780e89728847cb95e6.js
st.webtretho.com/_next/static/chunks/ 		673 B
416 B 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/187.7d780e89728847cb95e6.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
c2a3115077a95647a42f0c264e3a04d19ce7e8dee6bc3a8dab639c77d0b19bf8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-2a1"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
34.f4c95d6b0466b245e254.js
st.webtretho.com/_next/static/chunks/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/34.f4c95d6b0466b245e254.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
0a1e6533d8962343d07b73603ccc21c8707b555f349afc9a9d674e4bd9358ca7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Tue, 12 Apr 2022 02:57:30 GMT
server
nginx
age
663704
etag
W/"6254ea9a-1dcf"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 08:12:00 GMT
28.b3cca400e8c50a7f9612.js
st.webtretho.com/_next/static/chunks/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/28.b3cca400e8c50a7f9612.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
a777ac5900a1c203090b369241723bd00a254fd1823b58cad36608a082f381f3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-4e98"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
33.10f6f1e97e30bbb8c809.js
st.webtretho.com/_next/static/chunks/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/33.10f6f1e97e30bbb8c809.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
db467521165cbab260e2e5bdcaea4bb3fe26be327bf3ab24ddd4c0bb4426315a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657082
etag
W/"625d3438-326d"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:22 GMT
webpack-ffc0c9d12fbf843463b1.js
st.webtretho.com/_next/static/runtime/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
318d64d9523ae836addeb466ce5ab80610204d5910d5bb0071097e702a0e45b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-2415"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
framework.3bca837b581138b6b5be.js
st.webtretho.com/_next/static/chunks/ 		148 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/framework.3bca837b581138b6b5be.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
3014731674382c35ed587acceca666543e438a17403ae7900e2a071dc5fbb4ac

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
66086
etag
W/"625d3438-24eb1"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000,public, must-revalidate, proxy-revalidate
expires
Wed, 03 Aug 2022 06:12:18 GMT
75fc9c18.8f6d3a2c1d8adac7e393.js
st.webtretho.com/_next/static/chunks/ 		58 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/75fc9c18.8f6d3a2c1d8adac7e393.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
7a91ecfa97f9e1ea7dd849541522c0a7caa2c59780c8aa7939b4624302dca688

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-e722"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
115d364b149c98aefec53b972f11a6cdd9aae483.e07fc869b02cb866326f.js
st.webtretho.com/_next/static/chunks/ 		69 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/115d364b149c98aefec53b972f11a6cdd9aae483.e07fc869b02cb866326f.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
343d97f1f8322a9d39361c45cc5c9cf6ee401c76ae688e010918656048316df2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-11589"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
a86c483d79d787639325e3990190ac91dcd2236c.3b7fdb05423654c9cef1.js
st.webtretho.com/_next/static/chunks/ 		58 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/a86c483d79d787639325e3990190ac91dcd2236c.3b7fdb05423654c9cef1.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
d1dd6ac18492d83589132251f09bae39e805ca06ba01b87648d345c9ff38a448

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-e898"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
6b24190e2c9ef5d5f952995a31be664d76b7d6c4.99172823599bc28c9749.js
st.webtretho.com/_next/static/chunks/ 		2 MB
651 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/6b24190e2c9ef5d5f952995a31be664d76b7d6c4.99172823599bc28c9749.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
a408c6b95435cdda63eb60270c3166015182938f9a9c4a65f8dfb0eb29976848

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-213e14"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000,public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
618f7b4a592c1d22c73b1392794fd492a760c651.180640d502662520a52b.js
st.webtretho.com/_next/static/chunks/ 		12 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/618f7b4a592c1d22c73b1392794fd492a760c651.180640d502662520a52b.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
4d67a80e24c2b1a12976ca31eab486a2bb8ff6498189888126870502a3d5050a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-2ef4"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
738a5b3de2ecd05141c7d0eff8832e0961963ee6.4f496b2bb1bc03f651bf.js
st.webtretho.com/_next/static/chunks/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/738a5b3de2ecd05141c7d0eff8832e0961963ee6.4f496b2bb1bc03f651bf.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
60e0c32dbf5eab01ae0752be4d8e1cbece0fad2d0ff0cad14f9ac7a465beaa93

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-3cd3"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
7da7c143a811cd7b20b7c7ed94645ad42e241460.4653192c23f6b3ff939f.js
st.webtretho.com/_next/static/chunks/ 		19 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/7da7c143a811cd7b20b7c7ed94645ad42e241460.4653192c23f6b3ff939f.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
7d8fcb2740286e4a067eedcbc86c5a2cc7c486442325f7d7f5aac956f41891d6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-4c93"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
main-d7f0b237142f0705c131.js
st.webtretho.com/_next/static/runtime/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
09c53a0198a7e6749bd7822a78e537a722d6bcff91e2f0284028aa0faa25479c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-323a"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
579287c1.319bab04f8bfa4cabe50.js
st.webtretho.com/_next/static/chunks/ 		61 B
143 B 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/579287c1.319bab04f8bfa4cabe50.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
846bd2506ff67e6fb04c1b886fa912d325ecc49f6a5045e71e2bec59bc843341

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Tue, 12 Apr 2022 02:57:30 GMT
server
nginx
age
663704
etag
W/"6254ea9a-3d"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 08:12:00 GMT
a4c92b5b.6a0b3fb95c33b5f84d2b.js
st.webtretho.com/_next/static/chunks/ 		122 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/a4c92b5b.6a0b3fb95c33b5f84d2b.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
936ba8bf496ed6bd6c128d1fdd550f09a39fa364bc7f8d94292cbd6bf21a685f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Tue, 12 Apr 2022 02:57:30 GMT
server
nginx
age
663704
etag
W/"6254ea9a-1e83f"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 08:12:00 GMT
3193d4b30e84fd85d5253840d66ccc21b404ee13.9b8c20a002ed82a4b89b.js
st.webtretho.com/_next/static/chunks/ 		30 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/3193d4b30e84fd85d5253840d66ccc21b404ee13.9b8c20a002ed82a4b89b.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
83fe367392b2bf7feffe2df33ba7a9fa11c77e3ec554a70c6c1c5fcfe7066654

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-77f9"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
a26180a7205e7c3d794de6f275f09a5c350e1018.7b178ad933893b7c2910.js
st.webtretho.com/_next/static/chunks/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/a26180a7205e7c3d794de6f275f09a5c350e1018.7b178ad933893b7c2910.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
8ece892dd9f6f9422486965af38d8523ab24df3e5076f8d08bc0d5a00ce3a5af

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-3e61"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
f1eab338be6806a76db84ea682555b459fb9f9f1.3501aaa532701e2bde67.js
st.webtretho.com/_next/static/chunks/ 		238 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/f1eab338be6806a76db84ea682555b459fb9f9f1.3501aaa532701e2bde67.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
9ee24378d463b62bed1f56ccb1a5a15ad397dd3202a6fd9230920a1b7536763f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-3b6cc"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000,public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
d5fe0cffab3d6211ecf3b55f9bb2634f8ef788e8.85fd99196c68e9c3c946.js
st.webtretho.com/_next/static/chunks/ 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/d5fe0cffab3d6211ecf3b55f9bb2634f8ef788e8.85fd99196c68e9c3c946.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
28b2dab05b3a894d406fbb24453e5b4a079501190f6fb8c14b8b02cb09987a95

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-5e7a"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
44b5818b753eba1011b001b8daa49c65bd286935.7df8bfbc13b3016977da.js
st.webtretho.com/_next/static/chunks/ 		56 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/44b5818b753eba1011b001b8daa49c65bd286935.7df8bfbc13b3016977da.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
9caea4887df78b4db82317ce9ea1b48f0992efdeaf84b5855b83d16f70c62cd3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-df09"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
d540c859ac487b467c10bf9ed4d768439c664654.163547ca24b914a87253.js
st.webtretho.com/_next/static/chunks/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/d540c859ac487b467c10bf9ed4d768439c664654.163547ca24b914a87253.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e8d1498ca22f44cb3f8bf74df6565cded6c69f73957b46909240163db6603585

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-34d8"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
ba1764c5d73defadac08c2a9cb32f8f845a51d16.86fb82f43987d0d49962.js
st.webtretho.com/_next/static/chunks/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/ba1764c5d73defadac08c2a9cb32f8f845a51d16.86fb82f43987d0d49962.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e68a542d16ab26d7748e1af28667863081c5c0ea294ae83a7db96253d3939a9f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-495d"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
1743f4cca207901c6f52dd0874a05fb575485826.54a1775790a04209fb12.js
st.webtretho.com/_next/static/chunks/ 		163 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/1743f4cca207901c6f52dd0874a05fb575485826.54a1775790a04209fb12.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
44cd3b3a80fa71818d0a3624031904bbf87324274110a17a7d2a70024a11a5c6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-28d26"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000,public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
fa028b20765372ce9d0aa915f0ab7b45f0486a87.ff3662f7f564f12df218.js
st.webtretho.com/_next/static/chunks/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/fa028b20765372ce9d0aa915f0ab7b45f0486a87.ff3662f7f564f12df218.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
4bffe3f1aedc52461c3863d557b25f666f7a4b8fa98574fb9398e498e3f5ff93

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-2bec"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
8a2056e10977f0e725fb905fc1b058fbfd6d0494.7f90fbae0ba7ffd88bfe.js
st.webtretho.com/_next/static/chunks/ 		50 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/8a2056e10977f0e725fb905fc1b058fbfd6d0494.7f90fbae0ba7ffd88bfe.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
062262c00b3ac517127f7c9cb58e148f4ac087e93034ae9319accde18f7f3b7b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-c8ea"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
680d0df58e38e8bae03c25c699ee1e76b514b20d.52cb9a1d4d285327229e.js
st.webtretho.com/_next/static/chunks/ 		47 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/680d0df58e38e8bae03c25c699ee1e76b514b20d.52cb9a1d4d285327229e.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
ac17b249663d7eb30946ee224b9687e9962ab7a6167b431fb0ee38820d77d63c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-bc77"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
e3ca27907944ae6ae426c47e1c323601c59ca85b.d58e29de04ff1f1d0d40.js
st.webtretho.com/_next/static/chunks/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/e3ca27907944ae6ae426c47e1c323601c59ca85b.d58e29de04ff1f1d0d40.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
4495ad8ac78e2df206dd48bbe441e08e9c807d5c42ee4817afd2e31684a621a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-21bc"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
51f2363abe8b1f3bfbce9e9f215f38b4f938eb97.c1bfadbc1668fbc5bb55.js
st.webtretho.com/_next/static/chunks/ 		7 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/51f2363abe8b1f3bfbce9e9f215f38b4f938eb97.c1bfadbc1668fbc5bb55.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
10c1f8bcb6814056212a233201f2b5196c26c5b04b8e06cdab14a523ccd8363b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-1c62"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
_buildManifest.js
st.webtretho.com/_next/static/1650275250293/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/1650275250293/_buildManifest.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
465177c8672c67eccf0552d2563e6205f217cde232aa792330519b8bbf6b9f55

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-1af4"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
js
www.googletagmanager.com/gtag/ 		180 KB
66 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-QP5Y1Q9C46&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-43173086-1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2938a62358444ec26cc0c3693366763a68b9bdac85b2701cc2ca7fa80aab1524
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
67866
x-xss-protection
0
expires
Tue, 26 Apr 2022 00:33:43 GMT
conversion_async.js
www.googleadservices.com/pagead/ 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTFWKLK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f2.1e100.net
Software
cafe /
Resource Hash
b9dff679ff9931afbbb8019d522a7d03d7787a7d7818037d48f3a502c652e2b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14892
x-xss-protection
0
server
cafe
etag
4605403730725282575
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 26 Apr 2022 00:33:43 GMT
hotjar-1881467.js
static.hotjar.com/c/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-1881467.js?sv=6
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-76.fra50.r.cloudfront.net
Software
/
Resource Hash
ea243e27076943a5861ac8d64689741faa79d0b5fb4b51913e58928f2a09ac7e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
content-encoding
br
x-content-type-options
nosniff
cache-control
max-age=60
x-amz-cf-pop
FRA50-C1
etag
W/9fedfd2b141e35be0192ecd3e5b60b6e
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cross-origin-resource-policy
cross-origin
content-length
1901
via
1.1 a394c864b23364262af48fed4e7e9fac.cloudfront.net (CloudFront)
x-amz-cf-id
GkXBf1tBpwZeCEqgEoZAkQh80Xp0oPfIdcHzzE_fvbuSK-6hpQIw9g==
8x8hjj6rpt
www.clarity.ms/tag/ 		662 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/tag/8x8hjj6rpt?ref=gtm2
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:27::cafe:1799 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
1f9350ef410262714893a88b5ed357895441970506511398c43568c4c505143e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
x-powered-by
ASP.NET
x-azure-ref
05z1nYgAAAAC6sCluTmZZTL5JRRCzWtvaTUFOMzBFREdFMDcxNQA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache
CONFIG_NOCACHE
content-type
application/x-javascript
cache-control
no-cache, no-store
request-context
appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
content-length
662
expires
-1
aiactiv-sdk.min.js
sdk-cdn.aiactiv.io/ 		242 KB
242 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sdk-cdn.aiactiv.io/aiactiv-sdk.min.js?t=1650933223312
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
171.244.201.57 , Viet Nam, ASN7552 (VIETEL-AS-AP Viettel Group, VN),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
8cac28b7e48477a843c2c62c296e785e263d09bb7e61c07aacb874f210bd4d8e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Tue, 26 Apr 2022 00:33:43 GMT
Last-Modified
Mon, 25 Apr 2022 08:20:05 GMT
Server
nginx/1.18.0 (Ubuntu)
ETag
"626659b5-3c868"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
247912
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1853257280&t=pageview&_s=1&dl=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&ul=en-us&de=UTF-8&dt=Matt%20Liu%20b%E1%BA%BF%20H%C6%B0%C6%A1ng%20Giang%20t%E1%BB%AB%20xe%20xu%E1%BB%91ng%2C%20n%C3%A0ng%20H%E1%BA%ADu%20n%C5%A9ng%20n%E1%BB%8Bu%20%C3%B4m%20ch%E1%BA%B7t%20ng%C6%B0%E1%BB%9Di%20y%C3%AAu%20tr%C6%B0%E1%BB%9Bc%20h%C3%A0ng%20tr%C4%83m%20ng%C6%B0%E1%BB%9Di&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=6GDAAUABAAAAAC~&jid=545142431&gjid=1730082631&cid=1873700710.1650933223&tid=UA-43173086-14&_gid=565082439.1650933223&_r=1&gtm=2wg4k0NTFWKLK&cd11=yeumaunang88&cd4=N%C3%93NG&z=364875480
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.webtretho.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.webtretho.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
444 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-43173086-1&cid=1873700710.1650933223&jid=1586742571&gjid=155978099&_gid=565082439.1650933223&_u=4GBAAUAAAAAAAC~&z=290553741
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c06::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.webtretho.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 26 Apr 2022 00:33:43 GMT
content-type
text/plain
access-control-allow-origin
https://www.webtretho.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
70 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-43173086-14&cid=1873700710.1650933223&jid=545142431&gjid=1730082631&_gid=565082439.1650933223&_u=6GDAAUABAAAAAC~&z=1581897778
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c06::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.webtretho.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 26 Apr 2022 00:33:43 GMT
content-type
text/plain
access-control-allow-origin
https://www.webtretho.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/g/ 		0
17 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-QP5Y1Q9C46&gtm=2oe4k0&_p=1853257280&_z=ccd.NbB&cid=1873700710.1650933223&ul=en-us&sr=1600x1200&_s=1&sid=1650933223&sct=1&seg=0&dl=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&dt=Matt%20Liu%20b%E1%BA%BF%20H%C6%B0%C6%A1ng%20Giang%20t%E1%BB%AB%20xe%20xu%E1%BB%91ng%2C%20n%C3%A0ng%20H%E1%BA%ADu%20n%C5%A9ng%20n%E1%BB%8Bu%20%C3%B4m%20ch%E1%BA%B7t%20ng%C6%B0%E1%BB%9Di%20y%C3%AAu%20tr%C6%B0%E1%BB%9Bc%20h%C3%A0ng%20tr%C4%83m%20ng%C6%B0%E1%BB%9Di&en=page_view&_fv=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QP5Y1Q9C46&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:43 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.webtretho.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-43173086-1&cid=1873700710.1650933223&jid=1586742571&_u=4GBAAUAAAAAAAC~&z=753218154
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-43173086-1&cid=1873700710.1650933223&jid=1586742571&_u=4GBAAUAAAAAAAC~&z=753218154
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-43173086-14&cid=1873700710.1650933223&jid=545142431&_u=6GDAAUABAAAAAC~&z=64268405
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-43173086-14&cid=1873700710.1650933223&jid=545142431&_u=6GDAAUABAAAAAC~&z=64268405
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
modules.0076bf93c385ddf0ff58.js
script.hotjar.com/ 		239 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1881467.js?sv=6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-39.fra50.r.cloudfront.net
Software
/
Resource Hash
e0e44c153e6969ff112250bc468dd4615e5f48f2b2db3e3ffabc11be9d9b6313
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 13 Apr 2022 10:49:06 GMT
content-encoding
br
x-content-type-options
nosniff
age
1086277
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
63817
access-control-allow-origin
*
last-modified
Wed, 13 Apr 2022 10:48:29 GMT
etag
"838915b4bc2438e3190a8320d0520962"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 d55780b776b171387055eca956ae29a8.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
dQsRE8EKebcchdL5euNmc_701Iukhqk86LRZ0lxyTukktabZflHWWg==
/
www.googleadservices.com/pagead/conversion/763323034/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion/763323034/?random=1650933223388&cv=9&fst=1650933223388&num=1&value=0&label=XP8JCMbckcoBEJrF_esC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg4k0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&tiba=Matt%20Liu%20b%E1%BA%BF%20H%C6%B0%C6%A1ng%20Giang%20t%E1%BB%AB%20xe%20xu%E1%BB%91ng%2C%20n%C3%A0ng%20H%E1%BA%ADu%20n%C5%A9ng%20n%E1%BB%8Bu%20%C3%B4m%20ch%E1%BA%B7t%20ng%C6%B0%E1%BB%9Di%20y%C3%AAu%20tr%C6%B0%E1%BB%9Bc%20h%C3%A0ng%20tr%C4%83m%20ng%C6%B0&auid=1687743279.1650933223&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f2.1e100.net
Software
cafe /
Resource Hash
2c871ab8c9ed9463c466fa43d69aaa96481cd6852176f3ddfe1271d726d812c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1513
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
box-4924254a9ce4dc9b959b6e4a9b662d60.html
vars.hotjar.com/ Frame ED97 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://vars.hotjar.com/box-4924254a9ce4dc9b959b6e4a9b662d60.html
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1881467.js?sv=6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-123.fra50.r.cloudfront.net
Software
/
Resource Hash
67f8c7fd7353ad063da1f3115924c458c494cb134f4d87de4407a132842c9bc9

Request headers

Referer
https://www.webtretho.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
1086277
cache-control
max-age=31536000
content-encoding
br
content-length
1044
content-type
text/html
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 13 Apr 2022 10:49:06 GMT
etag
"1635635016e428baa170305e9282c34a"
last-modified
Wed, 13 Apr 2022 10:48:29 GMT
vary
Accept-Encoding
via
1.1 e6d97713eb9b65f883e0f86b833878dc.cloudfront.net (CloudFront)
x-amz-cf-id
_ub2sMsD1aF6eJFPrGagF1oPHd_ku0NCs0r5dQsEgbA8vQJ-nY-7_g==
x-amz-cf-pop
FRA50-C1
x-cache
Hit from cloudfront
x-robots-tag
none
/
www.google.de/pagead/1p-conversion/763323034/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763323034/?random=986521178&cv=9&fst=1650933223388&num=1&value=0&label=XP8JCMbckcoBEJrF_esC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&...
  • https://www.google.com/pagead/1p-conversion/763323034/?random=986521178&cv=9&fst=1650933223388&num=1&value=0&label=XP8JCMbckcoBEJrF_esC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_a...
  • https://www.google.de/pagead/1p-conversion/763323034/?random=986521178&cv=9&fst=1650933223388&num=1&value=0&label=XP8JCMbckcoBEJrF_esC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah...
42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-conversion/763323034/?random=986521178&cv=9&fst=1650933223388&num=1&value=0&label=XP8JCMbckcoBEJrF_esC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg4k0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&tiba=Matt%20Liu%20b%E1%BA%BF%20H%C6%B0%C6%A1ng%20Giang%20t%E1%BB%AB%20xe%20xu%E1%BB%91ng%2C%20n%C3%A0ng%20H%E1%BA%ADu%20n%C5%A9ng%20n%E1%BB%8Bu%20%C3%B4m%20ch%E1%BA%B7t%20ng%C6%B0%E1%BB%9Di%20y%C3%AAu%20tr%C6%B0%E1%BB%9Bc%20h%C3%A0ng%20tr%C4%83m%20ng%C6%B0&auid=1687743279.1650933223&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=5z1nYtnQGtG-mLAPlKaJ8AI&eitems=ChEI8I2ZkwYQr-zJ6qze6ZDqARIdAAutJY4qtct4dCK2Vc_C77mrnhrgAkwAkiEmL5E&random=2970198285&resp=GooglemKTybQhCsO&ipr=y&prhg=0
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:43 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/gif
location
https://www.google.de/pagead/1p-conversion/763323034/?random=986521178&cv=9&fst=1650933223388&num=1&value=0&label=XP8JCMbckcoBEJrF_esC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg4k0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&tiba=Matt%20Liu%20b%E1%BA%BF%20H%C6%B0%C6%A1ng%20Giang%20t%E1%BB%AB%20xe%20xu%E1%BB%91ng%2C%20n%C3%A0ng%20H%E1%BA%ADu%20n%C5%A9ng%20n%E1%BB%8Bu%20%C3%B4m%20ch%E1%BA%B7t%20ng%C6%B0%E1%BB%9Di%20y%C3%AAu%20tr%C6%B0%E1%BB%9Bc%20h%C3%A0ng%20tr%C4%83m%20ng%C6%B0&auid=1687743279.1650933223&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=5z1nYtnQGtG-mLAPlKaJ8AI&eitems=ChEI8I2ZkwYQr-zJ6qze6ZDqARIdAAutJY4qtct4dCK2Vc_C77mrnhrgAkwAkiEmL5E&random=2970198285&resp=GooglemKTybQhCsO&ipr=y&prhg=0
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
1881467
vc.hotjar.io/sessions/ 		0
257 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vc.hotjar.io/sessions/1881467?s=0.25&r=0.17116288870481333
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-62.fra50.r.cloudfront.net
Software
Python/3.7 aiohttp/3.5.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
via
1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
server
Python/3.7 aiohttp/3.5.4
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
access-control-allow-origin
*
cache-control
no-store
x-amz-cf-id
AEdPJIYKT0K0nogfy5UL1jdC20OXBvctG1hYiugSG7OzlY5iKpnOwg==
clarity.js
d.clarity.ms/s/0.6.34/ 		53 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d.clarity.ms/s/0.6.34/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/8x8hjj6rpt?ref=gtm2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.76.174.66 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:43 GMT
content-encoding
br
etag
"1d84ac37b962954"
last-modified
Thu, 07 Apr 2022 21:07:26 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public,max-age=86400
accept-ranges
bytes
request-context
appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
collect
d.clarity.ms/ 		0
72 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.clarity.ms/collect
Requested by
Host: d.clarity.ms
URL: https://d.clarity.ms/s/0.6.34/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.76.174.66 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.webtretho.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

access-control-allow-origin
https://www.webtretho.com
date
Tue, 26 Apr 2022 00:33:43 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
569d938a-0415-4914-a3a1-fc80bafb1ba4
tag-cdn.aiactiv.io/containers/tags-pages/v1/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://tag-cdn.aiactiv.io/containers/tags-pages/v1/569d938a-0415-4914-a3a1-fc80bafb1ba4
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
171.244.201.56 , Viet Nam, ASN7552 (VIETEL-AS-AP Viettel Group, VN),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.webtretho.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
accept, origin, content-type, authorization, X-HTTP-Method-Override, If-Modified-Since, X-Page, X-PerPage, If-None-Match
access-control-allow-methods
GET, OPTIONS, DELETE, PUT, POST, PATCH, HEAD
access-control-allow-origin
https://www.webtretho.com
access-control-max-age
86400
allow
GET, OPTIONS
cache-control
private
content-length
0
date
Tue, 26 Apr 2022 00:33:45 GMT
strict-transport-security
max-age=15724800; includeSubDomains
trace
www.cloudflare.com/cdn-cgi/ 		291 B
437 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.cloudflare.com/cdn-cgi/trace
Requested by
Host: sdk-cdn.aiactiv.io
URL: https://sdk-cdn.aiactiv.io/aiactiv-sdk.min.js?t=1650933223312
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7c60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e723549bc90d89491e97d8fa080d1028a716730cf5552f2051bb9a169f947f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
x-frame-options
DENY
content-type
text/plain
access-control-allow-origin
*
cache-control
no-cache
cf-ray
701b3a8f1d506957-FRA
expires
Thu, 01 Jan 1970 00:00:01 GMT
569d938a-0415-4914-a3a1-fc80bafb1ba4
tag-cdn.aiactiv.io/containers/tags-pages/v1/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag-cdn.aiactiv.io/containers/tags-pages/v1/569d938a-0415-4914-a3a1-fc80bafb1ba4
Requested by
Host: sdk-cdn.aiactiv.io
URL: https://sdk-cdn.aiactiv.io/aiactiv-sdk.min.js?t=1650933223312
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
171.244.201.56 , Viet Nam, ASN7552 (VIETEL-AS-AP Viettel Group, VN),
Reverse DNS
Software
/
Resource Hash
e33985eef36bc4b35d37840939db9248170e09a216ea7a1c38ccd51831b96774
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.webtretho.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 26 Apr 2022 00:33:45 GMT
content-encoding
gzip
last-modified
Mon, 21 Mar 2022 04:39:10 GMT
access-control-max-age
86400
access-control-allow-methods
GET, OPTIONS, DELETE, PUT, POST, PATCH, HEAD
content-type
application/json
access-control-allow-origin
https://www.webtretho.com
cache-control
public, max-age=30, private
access-control-allow-credentials
true
strict-transport-security
max-age=15724800; includeSubDomains
access-control-allow-headers
accept, origin, content-type, authorization, X-HTTP-Method-Override, If-Modified-Since, X-Page, X-PerPage, If-None-Match
content-length
1010
pixel.html
identify.aicactus.io/ Frame 6879 		463 B
691 B 		Document
General
Check archive.org
Download Go to
Full URL
https://identify.aicactus.io/pixel.html
Requested by
Host: sdk-cdn.aiactiv.io
URL: https://sdk-cdn.aiactiv.io/aiactiv-sdk.min.js?t=1650933223312
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
27.71.231.241 , Viet Nam, ASN38731 (VTDC-AS-VN Vietel - CHT Compamy Ltd, VN),
Reverse DNS
Software
/
Resource Hash
329b195932ba7ff45a2997e878e32279b48a0660c67b812defaa3a7b45127af9
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.webtretho.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-encoding
gzip
content-length
361
content-type
text/html
date
Tue, 26 Apr 2022 00:33:46 GMT
strict-transport-security
max-age=15724800; includeSubDomains
vary
Origin
x-request-id
03ee2cb7-5a3f-45ec-bf4d-1fa071f66f2c
collect
d.clarity.ms/ 		0
48 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.clarity.ms/collect
Requested by
Host: d.clarity.ms
URL: https://d.clarity.ms/s/0.6.34/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.76.174.66 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.webtretho.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

access-control-allow-origin
https://www.webtretho.com
date
Tue, 26 Apr 2022 00:33:45 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
p
tags.aiactiv.io/v1/ 		2 B
338 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tags.aiactiv.io/v1/p
Requested by
Host: sdk-cdn.aiactiv.io
URL: https://sdk-cdn.aiactiv.io/aiactiv-sdk.min.js?t=1650933223312
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
171.244.201.56 , Viet Nam, ASN7552 (VIETEL-AS-AP Viettel Group, VN),
Reverse DNS
Software
/
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.webtretho.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
*
date
Tue, 26 Apr 2022 00:33:46 GMT
access-control-allow-credentials
true
vary
Origin
content-length
2
strict-transport-security
max-age=15724800; includeSubDomains
content-type
text/plain; charset=utf-8
22.c05063dc6e6378a5e38e.js
st.webtretho.com/_next/static/chunks/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/22.c05063dc6e6378a5e38e.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
40e64eebf1c6e2933410a8cdb8d9aebff09d5bde0a0e40c2d9f57fc21922a991

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:47 GMT
content-encoding
gzip
last-modified
Tue, 12 Apr 2022 02:57:30 GMT
server
nginx
age
663707
etag
W/"6254ea9a-1bac"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 08:12:00 GMT
xVwWMHMMXfzOZmYr26z0Tu5qkKhOrZuo7vMhac33vVJGGten5eNolqAGjwIdoIEdSOvHhWCSJnWFL5bESs3swqpWXPRkkP3t734crJLT=w600
lh3.googleusercontent.com/ 		64 KB
64 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/xVwWMHMMXfzOZmYr26z0Tu5qkKhOrZuo7vMhac33vVJGGten5eNolqAGjwIdoIEdSOvHhWCSJnWFL5bESs3swqpWXPRkkP3t734crJLT=w600
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
7493588675677e6140e36a8383fbf3022b516af674bab22f1135c5408c164f9a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:47 GMT
x-content-type-options
nosniff
age
0
content-disposition
inline;filename="unnamed.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
65345
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sun, 24 Apr 2022 11:00:02 GMT
api.js
www.google.com/recaptcha/ 		884 B
606 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=6Le4a1EcAAAAAGsrEXWWyyw8TCAhe7gBa-MdUA2K
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/1650275250293/pages/_app.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
20032ba845a4bd9983854ff7d36e5c197523b1eefd65c66879e9e0549865ee3a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
585
x-xss-protection
1; mode=block
expires
Tue, 26 Apr 2022 00:33:47 GMT
gpt.js
www.googletagservices.com/tag/js/ 		84 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/chunks/7da7c143a811cd7b20b7c7ed94645ad42e241460.4653192c23f6b3ff939f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c8cadeafda893da177470421700da9ee30a722fe9c265461260ba862fc850f98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28668
x-xss-protection
0
server
sffe
etag
"1197 / 583 of 1000 / last-modified: 1650924372"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Tue, 26 Apr 2022 00:33:47 GMT
api
www.webtretho.com/ 		5 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.webtretho.com/api
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/chunks/6b24190e2c9ef5d5f952995a31be664d76b7d6c4.99172823599bc28c9749.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
30d68b50373410e7d6789c03bf85fdba67afb6c864860dfaaf1458b0d534c222
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

Accept
application/json
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Access-Control-Allow-Credentials
true
accept-language
de-DE,de;q=0.9
Access-Control-Allow-Headers
Accept, X-Requested-With, Content-Type, Authorization, Access-Control-Allow-Headers
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
application/json

Response headers

strict-transport-security
max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff, nosniff
age
6
date
Tue, 26 Apr 2022 00:31:28 GMT
x-xss-protection
1; mode=block, 1; mode=block
x-request-id
641dc58c-3643-412d-9fe7-ef8dcea837f9
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"1506-42QkLbcS5bjzYrISRbo4SoPi2Jg"
x-download-options
noopen
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.webtretho.com
cache-control
max-age=3600
access-control-allow-credentials
true
expires
Tue, 26 Apr 2022 01:31:28 GMT
api
www.webtretho.com/ 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.webtretho.com/api
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/chunks/6b24190e2c9ef5d5f952995a31be664d76b7d6c4.99172823599bc28c9749.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
1c38e9b063a82e3556dd7f33fec29e444b00046582e2bbc50a9989ad4f3d4cea
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

Accept
application/json
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Access-Control-Allow-Credentials
true
accept-language
de-DE,de;q=0.9
Access-Control-Allow-Headers
Accept, X-Requested-With, Content-Type, Authorization, Access-Control-Allow-Headers
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
application/json

Response headers

strict-transport-security
max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff, nosniff
age
78
date
Tue, 26 Apr 2022 00:31:28 GMT
x-xss-protection
1; mode=block, 1; mode=block
x-request-id
87069b72-7d5d-48bf-8f4d-98772e6c44b5
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"48c-/Pau6Qi8G891FNpVvY2QjFUpddk"
x-download-options
noopen
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.webtretho.com
cache-control
max-age=3600
access-control-allow-credentials
true
expires
Tue, 26 Apr 2022 01:31:28 GMT
162.1ffd4eb9807d567ee8ef.js
st.webtretho.com/_next/static/chunks/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/162.1ffd4eb9807d567ee8ef.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
1b19f49ee34291d6d48919b75a6aa68fe4df1d6222f064818bd7ea37b447c000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:47 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657085
etag
W/"625d3438-1117"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:22 GMT
af6f81240e973cb4855fc9e5b7ef6c1df0896cd3.700eab114594f9be9e3a.js
st.webtretho.com/_next/static/chunks/ 		43 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/af6f81240e973cb4855fc9e5b7ef6c1df0896cd3.700eab114594f9be9e3a.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
d964a9a6737e9a29da6730b1e5ed27ea31b53d3c32cf3af4dac9d2991f803741

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:47 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657085
etag
W/"625d3438-acac"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:22 GMT
211.170155628aacd0ccb4e2.js
st.webtretho.com/_next/static/chunks/ 		981 B
706 B 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/211.170155628aacd0ccb4e2.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
1ff35261c90e2ea6b8398208bae2acf53e20f215b1829ec7b47d7e45560c9173

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-3d5"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:22 GMT
177.43fd3c8b3d97ea086285.js
st.webtretho.com/_next/static/chunks/ 		552 B
482 B 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/177.43fd3c8b3d97ea086285.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
428989cd2a66793e2cde0728cee9a01c148cd1d1ee517336069c60590886e2f3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-228"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:22 GMT
142.d85a6f461c6707a0d5c0.js
st.webtretho.com/_next/static/chunks/ 		74 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/142.d85a6f461c6707a0d5c0.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
56e164fda5558c116b09caa15adde21bfd3b75e7987035a1f79638eb7994dcbe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-12742"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:22 GMT
151.c65b7f2367e272491f0f.js
st.webtretho.com/_next/static/chunks/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/151.c65b7f2367e272491f0f.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
c2dde2535b501f44c9dade0e3406f0274c539c3c32c385ef1ad5c21b6a159f22

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-157c"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:22 GMT
186.db790c3f95c0fee2faee.js
st.webtretho.com/_next/static/chunks/ 		2 KB
632 B 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/186.db790c3f95c0fee2faee.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
ac95bff637a5b50b2465783a7028df6b3588f59af4f1e0923c32d658620dedde

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-709"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:22 GMT
156.1692f275cacc944cf882.js
st.webtretho.com/_next/static/chunks/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/156.1692f275cacc944cf882.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
4c84ebf01080daa5f382d183dbd7b5dfc1b6a71834c155ffba7770d5f038f96d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-11ac"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:22 GMT
183.eed80d2de38dae811202.js
st.webtretho.com/_next/static/chunks/ 		1 KB
757 B 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/183.eed80d2de38dae811202.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
d7ec9536f20060341782af0fecc91836bfce059060086533938f52b8119e184d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-542"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:22 GMT
199.9a38112fd92b468414aa.js
st.webtretho.com/_next/static/chunks/ 		2 KB
1022 B 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/199.9a38112fd92b468414aa.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
2c94b9287c0a915401efbdf4bb07e8a44a62edbb2fd9da16762a5ed43309ce91

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
656995
etag
W/"625d3438-607"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:03:53 GMT
188.a0bafe233d6743a625d2.js
st.webtretho.com/_next/static/chunks/ 		745 B
528 B 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/188.a0bafe233d6743a625d2.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
2d8f7afecf5c533608cc76d0b6f56fa13f886c2bc3cf5e3977138fb384c39b73

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
656995
etag
W/"625d3438-2e9"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:03:53 GMT
201.c4d3e642f1caa14c6f29.js
st.webtretho.com/_next/static/chunks/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/201.c4d3e642f1caa14c6f29.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
843e620cd5540dfe694bd860e0dd8e895074c59785b9843d550fb35f9f3ea9db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-a10"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:22 GMT
194.d4016c76ae91753565c1.js
st.webtretho.com/_next/static/chunks/ 		2 KB
919 B 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/194.d4016c76ae91753565c1.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
ea242062642c9fbfed60a788520406ba0498c6579e9a94500ef52ecfe413330a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-6c6"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:22 GMT
180.dffa4250ef3fb6578900.js
st.webtretho.com/_next/static/chunks/ 		2 KB
623 B 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/180.dffa4250ef3fb6578900.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
4d4776b63e7039b0e93625a4ab29def9f2ce710d5685b6b61e704d69a6fc8a8f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657086
etag
W/"625d3438-75f"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:22 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=1853257280&t=pageview&_s=2&dl=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&ul=en-us&de=UTF-8&dt=Matt%20Liu%20b%E1%BA%BF%20H%C6%B0%C6%A1ng%20Giang%20t%E1%BB%AB%20xe%20xu%E1%BB%91ng%2C%20n%C3%A0ng%20H%E1%BA%ADu%20n%C5%A9ng%20n%E1%BB%8Bu%20%C3%B4m%20ch%E1%BA%B7t%20ng%C6%B0%E1%BB%9Di%20y%C3%AAu%20tr%C6%B0%E1%BB%9Bc%20h%C3%A0ng%20tr%C4%83m%20ng%C6%B0%E1%BB%9Di&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=6GDAAUABAAAAAC~&jid=&gjid=&cid=1873700710.1650933223&tid=UA-43173086-1&_gid=565082439.1650933223&gtm=2ou4k0&cd10=H%C3%B3ng%20Showbiz&cd11=yeumaunang88&z=1385020916
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 25 Apr 2022 15:28:02 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
32745
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
star.png
www.webtretho.com/static/img/ 		50 KB
51 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.webtretho.com/static/img/star.png
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
ee6c0f621745e1cab45392204a460a84c2673d528febfff337884f4857a17ada

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:31:28 GMT
content-encoding
gzip
last-modified
Tue, 26 Oct 2021 15:51:07 GMT
server
nginx
etag
W/"617823eb-c9ae"
vary
Accept-Encoding
content-type
image/png
cache-control
max-age=5184000, public
expires
Sat, 25 Jun 2022 00:31:28 GMT
api
www.webtretho.com/ 		6 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.webtretho.com/api
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/chunks/6b24190e2c9ef5d5f952995a31be664d76b7d6c4.99172823599bc28c9749.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
f4f64b87c86c09c59cf3e0a9827d6703fcb2ed10db96495d91fc259d231eb105
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

Accept
application/json
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Access-Control-Allow-Credentials
true
accept-language
de-DE,de;q=0.9
Access-Control-Allow-Headers
Accept, X-Requested-With, Content-Type, Authorization, Access-Control-Allow-Headers
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
application/json

Response headers

strict-transport-security
max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff, nosniff
age
26
date
Tue, 26 Apr 2022 00:31:28 GMT
x-xss-protection
1; mode=block, 1; mode=block
x-request-id
16d30d7a-3914-4831-906d-e1ff449a2ee4
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"182b-+cM4AxgkZ8YQjR72gOFgI9DK0jc"
x-download-options
noopen
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.webtretho.com
cache-control
max-age=3600
access-control-allow-credentials
true
expires
Tue, 26 Apr 2022 01:31:28 GMT
api
www.webtretho.com/ 		48 KB
17 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.webtretho.com/api
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/chunks/6b24190e2c9ef5d5f952995a31be664d76b7d6c4.99172823599bc28c9749.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
583dac8694c20e5149d74befb127ed1f69feda69dc2e6b1ed4a9d710305cdc3b
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

Accept
application/json
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Access-Control-Allow-Credentials
true
accept-language
de-DE,de;q=0.9
Access-Control-Allow-Headers
Accept, X-Requested-With, Content-Type, Authorization, Access-Control-Allow-Headers
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
application/json

Response headers

strict-transport-security
max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff, nosniff
age
125
date
Tue, 26 Apr 2022 00:31:28 GMT
x-xss-protection
1; mode=block, 1; mode=block
x-request-id
b62b0262-41dd-46ea-8fee-e8e150868c08
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"be20-PI8+YvExyovOqIalHYdtdT+8rn8"
x-download-options
noopen
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.webtretho.com
cache-control
max-age=3600
access-control-allow-credentials
true
expires
Tue, 26 Apr 2022 01:31:28 GMT
api
www.webtretho.com/ 		731 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.webtretho.com/api
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/chunks/6b24190e2c9ef5d5f952995a31be664d76b7d6c4.99172823599bc28c9749.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
56643d9fd91e911106879f82432144e1e8fca40bc3e783b7b1d3085a16f844bc
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

Accept
application/json
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Access-Control-Allow-Credentials
true
accept-language
de-DE,de;q=0.9
Access-Control-Allow-Headers
Accept, X-Requested-With, Content-Type, Authorization, Access-Control-Allow-Headers
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 26 Apr 2022 00:31:28 GMT
content-encoding
gzip
x-content-type-options
nosniff, nosniff
age
26
vary
Accept-Encoding, Origin, Accept-Encoding
x-xss-protection
1; mode=block, 1; mode=block
x-request-id
fff0121b-dce7-455c-84d3-73473327ff4e
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"2db-Do44QBKyzkHkGvvcigwbWgM/SDU"
x-download-options
noopen
strict-transport-security
max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.webtretho.com
cache-control
max-age=3600
access-control-allow-credentials
true
expires
Tue, 26 Apr 2022 01:31:28 GMT
profile.js
st.webtretho.com/_next/static/1650275250293/pages/ 		0
9 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/1650275250293/pages/profile.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657085
etag
W/"625d3438-778e"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:23 GMT
579287c1.83b51110.chunk.css
st.webtretho.com/_next/static/css/ 		0
57 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/css/579287c1.83b51110.chunk.css
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Tue, 05 Apr 2022 15:14:16 GMT
server
nginx
age
1760360
etag
W/"624c5cc8-78dcf"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=2592000,public, must-revalidate, proxy-revalidate
expires
Thu, 14 Jul 2022 15:34:28 GMT
579287c1.319bab04f8bfa4cabe50.js
st.webtretho.com/_next/static/chunks/ 		0
131 B 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/579287c1.319bab04f8bfa4cabe50.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Tue, 12 Apr 2022 02:57:30 GMT
server
nginx
age
663708
etag
W/"6254ea9a-3d"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 08:12:00 GMT
a4c92b5b.6a0b3fb95c33b5f84d2b.js
st.webtretho.com/_next/static/chunks/ 		0
32 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/a4c92b5b.6a0b3fb95c33b5f84d2b.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Tue, 12 Apr 2022 02:57:30 GMT
server
nginx
age
663708
etag
W/"6254ea9a-1e83f"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 08:12:00 GMT
3193d4b30e84fd85d5253840d66ccc21b404ee13.9b8c20a002ed82a4b89b.js
st.webtretho.com/_next/static/chunks/ 		0
7 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/3193d4b30e84fd85d5253840d66ccc21b404ee13.9b8c20a002ed82a4b89b.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657090
etag
W/"625d3438-77f9"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
a26180a7205e7c3d794de6f275f09a5c350e1018.7b178ad933893b7c2910.js
st.webtretho.com/_next/static/chunks/ 		0
6 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/a26180a7205e7c3d794de6f275f09a5c350e1018.7b178ad933893b7c2910.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657090
etag
W/"625d3438-3e61"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
f1eab338be6806a76db84ea682555b459fb9f9f1.3501aaa532701e2bde67.js
st.webtretho.com/_next/static/chunks/ 		0
49 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/f1eab338be6806a76db84ea682555b459fb9f9f1.3501aaa532701e2bde67.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657090
etag
W/"625d3438-3b6cc"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000,public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
d5fe0cffab3d6211ecf3b55f9bb2634f8ef788e8.85fd99196c68e9c3c946.js
st.webtretho.com/_next/static/chunks/ 		0
9 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/d5fe0cffab3d6211ecf3b55f9bb2634f8ef788e8.85fd99196c68e9c3c946.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657090
etag
W/"625d3438-5e7a"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
44b5818b753eba1011b001b8daa49c65bd286935.7df8bfbc13b3016977da.js
st.webtretho.com/_next/static/chunks/ 		0
15 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/44b5818b753eba1011b001b8daa49c65bd286935.7df8bfbc13b3016977da.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657090
etag
W/"625d3438-df09"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
d540c859ac487b467c10bf9ed4d768439c664654.163547ca24b914a87253.js
st.webtretho.com/_next/static/chunks/ 		0
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/d540c859ac487b467c10bf9ed4d768439c664654.163547ca24b914a87253.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657090
etag
W/"625d3438-34d8"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
ba1764c5d73defadac08c2a9cb32f8f845a51d16.86fb82f43987d0d49962.js
st.webtretho.com/_next/static/chunks/ 		0
7 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/ba1764c5d73defadac08c2a9cb32f8f845a51d16.86fb82f43987d0d49962.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657090
etag
W/"625d3438-495d"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
1743f4cca207901c6f52dd0874a05fb575485826.54a1775790a04209fb12.js
st.webtretho.com/_next/static/chunks/ 		0
41 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/1743f4cca207901c6f52dd0874a05fb575485826.54a1775790a04209fb12.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657090
etag
W/"625d3438-28d26"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000,public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
fa028b20765372ce9d0aa915f0ab7b45f0486a87.ff3662f7f564f12df218.js
st.webtretho.com/_next/static/chunks/ 		0
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/fa028b20765372ce9d0aa915f0ab7b45f0486a87.ff3662f7f564f12df218.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657090
etag
W/"625d3438-2bec"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
8a2056e10977f0e725fb905fc1b058fbfd6d0494.7f90fbae0ba7ffd88bfe.js
st.webtretho.com/_next/static/chunks/ 		0
10 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/8a2056e10977f0e725fb905fc1b058fbfd6d0494.7f90fbae0ba7ffd88bfe.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657090
etag
W/"625d3438-c8ea"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
b76d0c825d79fef287e8bd0af711927544b695ef.9b163aefece58407e99a.js
st.webtretho.com/_next/static/chunks/ 		0
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/b76d0c825d79fef287e8bd0af711927544b695ef.9b163aefece58407e99a.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657090
etag
W/"625d3438-47a6"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
23.6616de9c95c4ff5a7bcc.js
st.webtretho.com/_next/static/chunks/ 		0
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/23.6616de9c95c4ff5a7bcc.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657090
etag
W/"625d3438-334a"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:18 GMT
b2658e7beddcb6f3617a5f2d2e7b978404b9677e.7019f38005dc9ff6512a.js
st.webtretho.com/_next/static/chunks/ 		0
5 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/b2658e7beddcb6f3617a5f2d2e7b978404b9677e.7019f38005dc9ff6512a.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
657085
etag
W/"625d3438-3e64"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:02:23 GMT
l8fbWJB7tx7iRlkbKAkQUptrS0fPiqUAejerhbQxxSWld774bkYULstXU78AsxMeTdYBCCBg9h2Jtvi7numWP0SMlmwK826sfNA0qgV60g=w600
lh3.googleusercontent.com/ 		79 KB
79 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/l8fbWJB7tx7iRlkbKAkQUptrS0fPiqUAejerhbQxxSWld774bkYULstXU78AsxMeTdYBCCBg9h2Jtvi7numWP0SMlmwK826sfNA0qgV60g=w600
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
1af700b8f2b1ad10fb501c1bf1558493a5b5a7df68c90d9ad7cd235ebb49b47e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
age
0
content-disposition
inline;filename="unnamed.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
80425
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sun, 24 Apr 2022 11:00:02 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/ 		364 KB
365 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6Le4a1EcAAAAAGsrEXWWyyw8TCAhe7gBa-MdUA2K
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a4d47dd6793fe24c23ab3c34f630ce5d0f42ef12a9e19eabd2fba286296647e9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.webtretho.com/
Origin
https://www.webtretho.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:08:36 GMT
x-content-type-options
nosniff
age
5112
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
372898
x-xss-protection
0
last-modified
Mon, 18 Apr 2022 04:06:57 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Apr 2023 23:08:36 GMT
pubads_impl_2022042101.js
securepubads.g.doubleclick.net/gpt/ 		362 KB
124 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
sffe /
Resource Hash
baa7346a51ac22b01b0f63ef8be8a7b0946a67fbe68ccf2c8a783a769bad8870
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 21:02:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
12707
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
126124
x-xss-protection
0
last-modified
Thu, 21 Apr 2022 08:41:17 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Tue, 25 Apr 2023 21:02:01 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		165 B
754 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.webtretho.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
017f39343c970a03a4f9b13faebbecd2099d12b87ba6e7f6507e0dc91bc6885d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
118
x-xss-protection
0
expires
Tue, 26 Apr 2022 00:33:48 GMT
api
www.webtretho.com/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.webtretho.com/api
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/chunks/6b24190e2c9ef5d5f952995a31be664d76b7d6c4.99172823599bc28c9749.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
61fae2c3593c2ee7150e5b64502de43e394eeda2a036407310c110cac539fd70
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

Accept
application/json
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Access-Control-Allow-Credentials
true
accept-language
de-DE,de;q=0.9
Access-Control-Allow-Headers
Accept, X-Requested-With, Content-Type, Authorization, Access-Control-Allow-Headers
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
application/json

Response headers

strict-transport-security
max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff, nosniff
age
-78
date
Tue, 26 Apr 2022 00:31:28 GMT
x-xss-protection
1; mode=block, 1; mode=block
x-request-id
530d1ccb-24c3-4c50-9e82-9d70db414efd
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"16f7-2t4SxXdV8WfjZApc6sfDrMayNzA"
x-download-options
noopen
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.webtretho.com
cache-control
max-age=3600
access-control-allow-credentials
true
expires
Tue, 26 Apr 2022 01:31:28 GMT
integrator.js
adservice.google.de/adsid/ 		107 B
792 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.webtretho.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.webtretho.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		145 KB
38 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3350176106606403&correlator=218061265132374&eid=31065713%2C31067069%2C31064226&output=ldjh&gdfp_req=1&vrg=2022042101&ptt=17&impl=fif&iu_parts=89328808%2CForum_NgoinhaWTT_ATF_Leaderboard_728x90&enc_prev_ius=%2F0%2F1&prev_iu_szs=600x250&ifi=1&adks=4205063212&sfv=1-0-38&ecs=20220426&fsapi=false&prev_scp=channel%3Dbeta%26Post_ID%3D9bacd8c5-96fd-43eb-821e-e9c5854e4aa3%26Community_ID%3D61c91242-d82b-11e9-aa5c-ecf4bbcb1ac8&sc=1&cookie_enabled=1&abxe=1&dt=1650933228148&lmt=1650933228&dlt=1650933223013&idt=5097&biw=1600&bih=1200&adxs=335&adys=4814&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&frm=20&vis=1&scr_x=0&scr_y=0&psz=642x21&msz=600x0&fws=4&ohw=1600&ga_vid=1873700710.1650933223&ga_sid=1650933228&ga_hid=1853257280&ga_fc=true&btvi=1&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
ea3b426f52eb2e3b1be82153c25ab7d1c77db0fbbbfed7b5f347efe3f477a47b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:49 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39103
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.webtretho.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		17 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3350176106606403&correlator=218061265132374&eid=31065713%2C31067069%2C31064226&output=ldjh&gdfp_req=1&vrg=2022042101&ptt=17&impl=fif&iu_parts=89328808%2CForum_NgoinhaWTT_Leaderboard&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=2&adks=2496478511&sfv=1-0-38&ecs=20220426&fsapi=false&prev_scp=channel%3Dbeta%26Post_ID%3D9bacd8c5-96fd-43eb-821e-e9c5854e4aa3%26Community_ID%3D61c91242-d82b-11e9-aa5c-ecf4bbcb1ac8&sc=1&cookie_enabled=1&abxe=1&dt=1650933228153&lmt=1650933228&dlt=1650933223013&idt=5097&biw=1600&bih=1200&adxs=314&adys=115&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&frm=20&vis=1&scr_x=0&scr_y=0&psz=972x0&msz=972x0&fws=4&ohw=1600&ga_vid=1873700710.1650933223&ga_sid=1650933228&ga_hid=1853257280&ga_fc=true&btvi=0&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
100bf767c3990184a6c3e7803f7a39a5d721c967e57a59730d33bb52990775a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:49 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9623
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.webtretho.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		19 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3350176106606403&correlator=218061265132374&eid=31065713%2C31067069%2C31064226&output=ldjh&gdfp_req=1&vrg=2022042101&ptt=17&impl=fif&iu_parts=89328808%2CForum_NgoinhaWTT_BTF_Rec2_300x250&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=3&adks=2846472083&sfv=1-0-38&ecs=20220426&fsapi=false&prev_scp=channel%3Dbeta%26Post_ID%3D9bacd8c5-96fd-43eb-821e-e9c5854e4aa3%26Community_ID%3D61c91242-d82b-11e9-aa5c-ecf4bbcb1ac8&sc=1&cookie_enabled=1&abxe=1&dt=1650933228158&lmt=1650933228&dlt=1650933223013&idt=5097&biw=1600&bih=1200&adxs=966&adys=170&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&frm=20&vis=1&scr_x=0&scr_y=0&psz=320x0&msz=320x0&fws=4&ohw=1600&ga_vid=1873700710.1650933223&ga_sid=1650933228&ga_hid=1853257280&ga_fc=true&btvi=0&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
ac91b1dd5fc366aa22165d23f77d780bfa9189da1eb13c4709f3b1a0486c79aa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:49 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8691
x-xss-protection
0
google-lineitem-id
5512381434
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138327618091
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.webtretho.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		85 KB
27 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3350176106606403&correlator=218061265132374&eid=31065713%2C31067069%2C31064226&output=ldjh&gdfp_req=1&vrg=2022042101&ptt=17&impl=fif&iu_parts=89328808%2CForum_NgoinhaWTT_BTF_Rec3_300x250&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=4&adks=3634190145&sfv=1-0-38&ecs=20220426&fsapi=false&prev_scp=channel%3Dbeta%26Post_ID%3D9bacd8c5-96fd-43eb-821e-e9c5854e4aa3%26Community_ID%3D61c91242-d82b-11e9-aa5c-ecf4bbcb1ac8&sc=1&cookie_enabled=1&abxe=1&dt=1650933228161&lmt=1650933228&dlt=1650933223013&idt=5097&biw=1600&bih=1200&adxs=966&adys=893&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&frm=20&vis=1&scr_x=0&scr_y=0&psz=320x0&msz=320x0&fws=4&ohw=1600&ga_vid=1873700710.1650933223&ga_sid=1650933228&ga_hid=1853257280&ga_fc=true&btvi=0&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
639155024ca9ad9275c5af7599376a19379d441883552dd548a71fb475a51c31
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27114
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.webtretho.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		120 KB
37 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3350176106606403&correlator=218061265132374&eid=31065713%2C31067069%2C31064226&output=ldjh&gdfp_req=1&vrg=2022042101&ptt=17&impl=fif&iu_parts=89328808%2CForum_NgoinhaWTT_Rec4&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&ifi=5&adks=2376808355&sfv=1-0-38&ecs=20220426&fsapi=false&prev_scp=channel%3Dbeta%26Post_ID%3D9bacd8c5-96fd-43eb-821e-e9c5854e4aa3%26Community_ID%3D61c91242-d82b-11e9-aa5c-ecf4bbcb1ac8&sc=1&cookie_enabled=1&abxe=1&dt=1650933228164&lmt=1650933228&dlt=1650933223013&idt=5097&biw=1600&bih=1200&adxs=966&adys=1173&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&frm=20&vis=1&scr_x=0&scr_y=0&psz=320x0&msz=320x0&fws=4&ohw=1600&ga_vid=1873700710.1650933223&ga_sid=1650933228&ga_hid=1853257280&ga_fc=true&btvi=0&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
37c479b0d9618fa643a88b14654e5b8280d6ad07f52888778ac16b6fe299a62e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37348
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.webtretho.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		18 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3350176106606403&correlator=218061265132374&eid=31065713%2C31067069%2C31064226&output=ldjh&gdfp_req=1&vrg=2022042101&ptt=17&impl=fif&iu_parts=89328808%2CForum_NgoinhaWTT_Rec2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=6&adks=631769597&sfv=1-0-38&ecs=20220426&fsapi=false&prev_scp=channel%3Dbeta%26Post_ID%3D9bacd8c5-96fd-43eb-821e-e9c5854e4aa3%26Community_ID%3D61c91242-d82b-11e9-aa5c-ecf4bbcb1ac8&sc=1&cookie_enabled=1&abxe=1&dt=1650933228166&lmt=1650933228&dlt=1650933223013&idt=5097&biw=1600&bih=1200&adxs=132&adys=70&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&frm=20&vis=1&scr_x=0&scr_y=0&psz=170x-1&msz=170x-1&fws=516&ohw=1600&ga_vid=1873700710.1650933223&ga_sid=1650933228&ga_hid=1853257280&ga_fc=true&btvi=0&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
36f1b68b30489df4ce3ab5885e898575f72f9e887ab7b9e89b6dc4532b22a845
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9989
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.webtretho.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		116 KB
36 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3350176106606403&correlator=218061265132374&eid=31065713%2C31067069%2C31064226&output=ldjh&gdfp_req=1&vrg=2022042101&ptt=17&impl=fif&iu_parts=89328808%2CForum_NgoinhaWTT_Rec3&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=7&adks=1067135881&sfv=1-0-38&ecs=20220426&fsapi=false&prev_scp=channel%3Dbeta%26Post_ID%3D9bacd8c5-96fd-43eb-821e-e9c5854e4aa3%26Community_ID%3D61c91242-d82b-11e9-aa5c-ecf4bbcb1ac8&sc=1&cookie_enabled=1&abxe=1&dt=1650933228169&lmt=1650933228&dlt=1650933223013&idt=5097&biw=1600&bih=1200&adxs=1298&adys=70&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3DWebtrethoPage%26fbclid%3DIwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w&frm=20&vis=1&scr_x=0&scr_y=0&psz=170x-1&msz=170x-1&fws=516&ohw=1600&ga_vid=1873700710.1650933223&ga_sid=1650933228&ga_hid=1853257280&ga_fc=true&btvi=0&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
620b6cdd6a7d56e566a8af1511297622478d3d346af5ce7b2fcc11763ef0590e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36874
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.webtretho.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FAD0 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.webtretho.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, immutable, max-age=31536000
content-encoding
gzip
content-length
3108
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 00:33:48 GMT
expires
Wed, 26 Apr 2023 00:33:48 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
anchor
www.google.com/recaptcha/api2/ Frame B3E5 		41 KB
21 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4a1EcAAAAAGsrEXWWyyw8TCAhe7gBa-MdUA2K&co=aHR0cHM6Ly93d3cud2VidHJldGhvLmNvbTo0NDM.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=5izivqom8v65
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
49141ee85a330a46cb4a6f2bf8013939f0b563cdfa8a0b728392cc45f5cdbbb9
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-rpiT/M+D+a44iS6WFTUXNQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.webtretho.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-length
21840
content-security-policy
script-src 'report-sample' 'nonce-rpiT/M+D+a44iS6WFTUXNQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 00:33:48 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
avatar.png
www.webtretho.com/static/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.webtretho.com/static/img/avatar.png
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
11f025532b48b1e62a42674bfdbb8630a57a1b2ea9881753b4ebd0f2769e04f1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:31:28 GMT
content-encoding
gzip
last-modified
Tue, 26 Oct 2021 15:51:07 GMT
server
nginx
etag
W/"617823eb-df7"
vary
Accept-Encoding
content-type
image/png
cache-control
max-age=5184000, public
expires
Sat, 25 Jun 2022 00:31:28 GMT
api
www.webtretho.com/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.webtretho.com/api
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/chunks/6b24190e2c9ef5d5f952995a31be664d76b7d6c4.99172823599bc28c9749.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
fa697a8aa6470a68997f6074bee3fe8890e34ea44fb72bdf1aa4dd6ed1cfea6e
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

Accept
application/json
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Access-Control-Allow-Credentials
true
accept-language
de-DE,de;q=0.9
Access-Control-Allow-Headers
Accept, X-Requested-With, Content-Type, Authorization, Access-Control-Allow-Headers
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
application/json

Response headers

strict-transport-security
max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff, nosniff
age
26
date
Tue, 26 Apr 2022 00:31:28 GMT
x-xss-protection
1; mode=block, 1; mode=block
x-request-id
108663ea-fbc6-4ff6-8a10-48627f26c774
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"88f-MHgK6et5RS3PJr9nfUz9G+gYSwk"
x-download-options
noopen
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.webtretho.com
cache-control
max-age=3600
access-control-allow-credentials
true
expires
Tue, 26 Apr 2022 01:31:28 GMT
api
www.webtretho.com/ 		2 KB
959 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.webtretho.com/api
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/chunks/6b24190e2c9ef5d5f952995a31be664d76b7d6c4.99172823599bc28c9749.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
653d3e6118b356b87f052d776f8899eaa758f2bf6bb0cbf2529a658215f6e14e
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

Accept
application/json
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Access-Control-Allow-Credentials
true
accept-language
de-DE,de;q=0.9
Access-Control-Allow-Headers
Accept, X-Requested-With, Content-Type, Authorization, Access-Control-Allow-Headers
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
application/json

Response headers

strict-transport-security
max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff, nosniff
age
4
date
Tue, 26 Apr 2022 00:31:28 GMT
x-xss-protection
1; mode=block, 1; mode=block
x-request-id
c7bdcafd-d0d7-49f5-86ec-bd7708a0a8e5
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"682-DdwtlKUUja27zBG99qN6LuC67AA"
x-download-options
noopen
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.webtretho.com
cache-control
max-age=3600
access-control-allow-credentials
true
expires
Tue, 26 Apr 2022 01:31:28 GMT
api
www.webtretho.com/ 		9 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.webtretho.com/api
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/chunks/6b24190e2c9ef5d5f952995a31be664d76b7d6c4.99172823599bc28c9749.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
5876aa208449c3a4e139d6a17fc83e36642057a75ca557bbf0a204b0e5cbb6ac
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff, nosniff
age
26
date
Tue, 26 Apr 2022 00:31:28 GMT
x-xss-protection
1; mode=block, 1; mode=block
x-request-id
b771cfd6-0fe1-449b-aa49-07067ad4b641
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"229f-kwYnGdodqbc94kEBi2ryZONdr7w"
x-download-options
noopen
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.webtretho.com
cache-control
max-age=3600
access-control-allow-credentials
true
expires
Tue, 26 Apr 2022 01:31:28 GMT
styles__ltr.css
www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/ Frame B3E5 		51 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4a1EcAAAAAGsrEXWWyyw8TCAhe7gBa-MdUA2K&co=aHR0cHM6Ly93d3cud2VidHJldGhvLmNvbTo0NDM.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=5izivqom8v65
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 15:35:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
32322
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24237
x-xss-protection
0
last-modified
Mon, 18 Apr 2022 04:06:57 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Apr 2023 15:35:06 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/ Frame B3E5 		364 KB
364 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4a1EcAAAAAGsrEXWWyyw8TCAhe7gBa-MdUA2K&co=aHR0cHM6Ly93d3cud2VidHJldGhvLmNvbTo0NDM.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=5izivqom8v65
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a4d47dd6793fe24c23ab3c34f630ce5d0f42ef12a9e19eabd2fba286296647e9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:08:36 GMT
x-content-type-options
nosniff
age
5112
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
372898
x-xss-protection
0
last-modified
Mon, 18 Apr 2022 04:06:57 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Apr 2023 23:08:36 GMT
collect
d.clarity.ms/ 		0
48 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.clarity.ms/collect
Requested by
Host: d.clarity.ms
URL: https://d.clarity.ms/s/0.6.34/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.76.174.66 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.webtretho.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

access-control-allow-origin
https://www.webtretho.com
date
Tue, 26 Apr 2022 00:33:48 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame B3E5 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 19 Apr 2022 18:59:48 GMT
x-content-type-options
nosniff
age
538440
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2228
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Tue, 26 Apr 2022 18:59:48 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame B3E5 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4a1EcAAAAAGsrEXWWyyw8TCAhe7gBa-MdUA2K&co=aHR0cHM6Ly93d3cud2VidHJldGhvLmNvbTo0NDM.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=5izivqom8v65
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 19 Apr 2022 17:06:41 GMT
x-content-type-options
nosniff
age
545227
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 19 Apr 2023 17:06:41 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame B3E5 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4a1EcAAAAAGsrEXWWyyw8TCAhe7gBa-MdUA2K&co=aHR0cHM6Ly93d3cud2VidHJldGhvLmNvbTo0NDM.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=5izivqom8v65
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 19 Apr 2022 14:17:54 GMT
x-content-type-options
nosniff
age
555354
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 19 Apr 2023 14:17:54 GMT
webworker.js
www.google.com/recaptcha/api2/ Frame B3E5 		102 B
134 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4a1EcAAAAAGsrEXWWyyw8TCAhe7gBa-MdUA2K&co=aHR0cHM6Ly93d3cud2VidHJldGhvLmNvbTo0NDM.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=5izivqom8v65
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
20b97f4764680efdd44b021cb57bfb2b93850d0aaf8af024986393b0cb80f2d0
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4a1EcAAAAAGsrEXWWyyw8TCAhe7gBa-MdUA2K&co=aHR0cHM6Ly93d3cud2VidHJldGhvLmNvbTo0NDM.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=5izivqom8v65
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
cross-origin-embedder-policy
require-corp
x-frame-options
SAMEORIGIN
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
112
x-xss-protection
1; mode=block
expires
Tue, 26 Apr 2022 00:33:48 GMT
_oFbVPePUbEezG7yrCb89Ta7JSBLkF3kFOS2CjgB_plND7dKtYhj5gh5or3J4t0bmsv-0KOxSjWqFuraAG7qTzkju2qEaSTEZHdUN6LNZA=w160
lh3.googleusercontent.com/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/_oFbVPePUbEezG7yrCb89Ta7JSBLkF3kFOS2CjgB_plND7dKtYhj5gh5or3J4t0bmsv-0KOxSjWqFuraAG7qTzkju2qEaSTEZHdUN6LNZA=w160
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
d303cf1d13d699f41e2520b8281efbdca20b84f9f1a623b52d1f060508fa3950
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6562
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:48 GMT
EsrSU9AE7EGDkLBHo6Vt9NFsmtOVUg8YVWFUmNaHY5TJJ1reTwmbYJmFfgqbiO_mcrPsmfR5bo-cvHP3lKY_5jMHHx6btqz536rAgnIUYw=w160
lh3.googleusercontent.com/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/EsrSU9AE7EGDkLBHo6Vt9NFsmtOVUg8YVWFUmNaHY5TJJ1reTwmbYJmFfgqbiO_mcrPsmfR5bo-cvHP3lKY_5jMHHx6btqz536rAgnIUYw=w160
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
c6927f0880b87203aac8ddd54fdb83f0c810f2af855b79929bd68daa06c07ad0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
age
0
content-disposition
inline;filename="unnamed.png"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19392
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Mon, 18 Apr 2022 09:51:10 GMT
UYTvEhFPmqXcPhOb9JvGwX2ym19bU6JIIaxkMu7LZS3JiODJOsUUolze507gvJN3yf93sB_edsPfpZKub8oRLR_SUAeoUu2GncffnDp90w=w160
lh3.googleusercontent.com/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/UYTvEhFPmqXcPhOb9JvGwX2ym19bU6JIIaxkMu7LZS3JiODJOsUUolze507gvJN3yf93sB_edsPfpZKub8oRLR_SUAeoUu2GncffnDp90w=w160
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
598ce94f8c2b8d5deacdb62254051a1d9f95897ffb1fa6d7a73ec10ef995f84c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.png"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27780
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:48 GMT
k8Bui0Ih9zTq-jY6c3G-BzR1iFDngr9FdkOwWmztCStZaXVuQny28lMiSk_EQ9pGDI_M0ja7EVsuGU7nfTnCmtHg2a13acXQLKo0dWN9=w160
lh3.googleusercontent.com/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/k8Bui0Ih9zTq-jY6c3G-BzR1iFDngr9FdkOwWmztCStZaXVuQny28lMiSk_EQ9pGDI_M0ja7EVsuGU7nfTnCmtHg2a13acXQLKo0dWN9=w160
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
060a31999a2299dc18cc6b8e9975e6aae0871169fad062cd317952d071b3e06a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
age
0
content-disposition
inline;filename="unnamed.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7375
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Mon, 18 Apr 2022 09:51:10 GMT
LPD-zxx2pOToVx2IIEu8mpORaOODfH0cd7x5YFRO_z9D7cswqcsA2-ur03gTiS5eEKpY4CLUThc0I5Sm00ylToSeHR8KgZmzL8RfHPAu=w160
lh3.googleusercontent.com/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/LPD-zxx2pOToVx2IIEu8mpORaOODfH0cd7x5YFRO_z9D7cswqcsA2-ur03gTiS5eEKpY4CLUThc0I5Sm00ylToSeHR8KgZmzL8RfHPAu=w160
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
dc6fe4e32f9012ff9d6f82bfb9e1d2624992d39eeaa1cbb73f733f2c0cfc0d90
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5765
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:48 GMT
DSwV-A3teuP-zq-OV5chzipj1oh8Pvg40heTji9bXLV-QoLBZlidWWOte_eopVZ66ykQDWM03xjUb4uvFpX5DsB65_Uc66cvmxrOa2bjzQ=w160
lh3.googleusercontent.com/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/DSwV-A3teuP-zq-OV5chzipj1oh8Pvg40heTji9bXLV-QoLBZlidWWOte_eopVZ66ykQDWM03xjUb4uvFpX5DsB65_Uc66cvmxrOa2bjzQ=w160
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
c043149c1afda53688ff4e4414a8f5131c9893b949a72391b951fbd6febdef65
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5254
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:48 GMT
container.html
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9375 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.webtretho.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, immutable, max-age=31536000
content-encoding
gzip
content-length
3108
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 00:33:48 GMT
expires
Wed, 26 Apr 2023 00:33:48 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
pixel
googleads.g.doubleclick.net/xbbe/ Frame C28B 		624 B
297 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CPD8kAIQ2OPDowMYq83NxgEwAQ&v=APEucNWq6-y-tU1oBEx4j3qWiRm1KTXutmaSeA84vYWYxtUh22tP7uy6_kOiZ-mFRDFk1oytmB9WkUOqIea36V4dW0-xvMzW7XYYZ_gPOt__mClyFSl4XzDmOmjQ4EdQHHwxVvz7tN_N7ebpk6aCAzTMmqaiakYM0wKmZ1VpMYS9sjuuZOxvnNA
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
gzip
content-length
276
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 00:33:48 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
ad
googleads.g.doubleclick.net/dbm/ Frame 9375 		89 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DhY1dBmzI9gwyGAlLJSPL-0E8D6GcRJt13C78E1ekzN-eP03mKqesH7dEPIzMcLw72fQIzum4TxSJV9fED9xpcIM9CCI9ztFupZGqZmRQvpU9iK9XgCDEbwjc3v8eFaYy2jpLyMVNQaVAZDJ8zHu_Jm8T_-A&dbm_d=AKAmf-CWRBPXoGrh4LqWpvtmKXzuClGty9eKfyg_4ylrf01euqLWcdCZi_7LQs1N0rrqTFfMLavkFq_A4-hO1Mn2J1zRB3V31a3HLCeNBmxQa9cn4veC23tDbwMwRbd8wA3sIkZC66LhRuGFyGqGIY7pxdd_vvPzrr2z5SRc30A7F3P78F2Yh0tA-SfRnUe6fS3Uwiac0qLnngzUyLvBxb7Gdxyj0ujvReKCnGEuILSfiZVqGaTx0yKGN0VtGmxL3SWnu_hxepbEOCpzjtkVqomvYems2v6VzyrOOYOHKtCcqj7QftqmWdaYjHv3kz9pVMbRd0sg6UNT7x2W53ackfHy0-aicdDzJnhNBf5MZfLtflSqOTPcMoSj8-RdC7Lnz-r7_FpsF-b9UF2ZZFMP4Vx0alnat79fUpksEBl3AurmstB0MaEGLDCZQ2weURrhlHH4am7uZkdgeeCsxS7FSqY-M7VymlkEyosaF8PA9HLtSw4E0wZCWAmJzbVyo10xBSNCVc1mTikDOVUehq4BIWqXA56C93kKi0fhpASXFXoljT4Ii4XjWJJk7dU2avp_AvHjW83IM1HX-0ZhD4An2n9mJ7yBLqUVq8Sa4ggktgyBp0uqTb8GT1yHyAd6DXXeNu_YRmkZPcZl67Qs4csQGFyhQqK4pe0wEPgmAmNXpK7mAcHH4XUL_69gqnQ7c8XOHnDVOOkCJh8nLH-L3jzYwDz5UK191BAVzJO-EpWElqxFWtF-7GfB_J2-G4CDotZYSocADMqmlS34VwryQLdD2hOYHANFCz7-PNZCLN6Kp8ivPKGRXeGdigXymOIVzg37iDKMjPcjYN5Uvviii7vUf5QPlHwRX6SPtaEv_4zUqQ_M64Hf5wG4qHzjEc8NOBigz1EA7YxEiSOdOJRsm9VsSnrOkvZ3fTCyXnZ9GbtnN9giMTAZpucm7o6zMq7xk61rxCodmzF25lbnVZN4DtkkEy1X05T8scQMlD8t_zSZfXfLibWZJqsXslUf8qeCxc-uMDPqlaiOgTNzOvj_yFLzjC3Ipqk_l_83k1o1wIXKXwcRkgmRQ3aMvH6BQyj69YOwp21TcZMlOhVQEM5PDf0M07HPHwvDwZluO4ueUZlD6e8LzFj0MgTaRwFC_0taRfRfVCDsXsJuvYVohTnE7SfCdd9WDj-yiITL0w6nOeO0yfnItFDPDh1rVqDrsxQFUK-TTHTVnZqyi7X64xfyom_ugn56Vx1KHfFasNX55dJMw9FejxVkqlAssEKB8DVt0Aah4siozvsXfQyZohzetkZ9yLZeM59lZYHL7bBlcGREYNHvBuAjY-lytfnyhCfnMvKJXnlmgiRQkCEUDpGSCkHQL-GLwSoA0qNh7gEaCqDW6bA_1cTTGH5-uiMxsv9O2xNjYBAvmKWQadN5dLiUmQ53g04MniL2Gik5kz4X-OcvALSi_7UyzMyDwDO1DCmerOha6xYpSoMVNlChzosJoEIxiw9xc-FmjuuUEV-XlRqLazRYHlTfxI0El-ZybPuUVNbpfeWeUrVCBFegI2jvGMwnPzS01eUuKIXaDSmY5F28i2V781ocOzVmKwPIE8gX7Wjs-qAUaSGmaCgwTU3PT86DGXXyRSJ7WauDeb9J1rg9b8XwkGmaI6txl2dOw5n-Gu9smbwzfBKt62njCA73myXwjdCJEbzKMdVia63GZVuzXFk0p05aAkjpTfWknXObRQ93sSRL1kMgi21eST106tktpqEFhvr9njpmsCyG_5RbRTCx2xNrYxT1yLJ_jFRHogZrXgz2WsgV4L9sDXNio1raGElAmgeIMbp8Fmr7VGMZCAu7vyWq5jPJ53iweOzLnYUAodk7gQu9rpIjKqcPfvg8s-0jOaWKd3sN25yCbtPwjzfZR5RWsgTwqwNuVhCmAcgdQQWoRwjPiRoxROUkc4IX1EzaTRDGeGDWrw6ipHPPLdXs4W0yWWWI_0WM5c5i0E3wbRkiMUCRsJoqs-5GwyQ2C9WDc2ccVXII34kvKeUG_k7xzJcSddQL4kg2pxVzF9Mw-j-18vzWVn4Zcu30Cf3aRxSx0TIqC9iaVKb16Y1K7LK-LOBF-m3v4-FuAd2ekhFfdiOk4iRb_psdN8jqMs4FW6Gxvc3N1iEvwT2GfGuDjEIE17gIvC48WlekhnAFE5CfyQoz7lH4gacGfE6_cGtvhMT2qnHyT91KZ0O1Mhq-5SIiiIcb9JfWj75CODoOfdlgkECLZhZW8xFi4OQAHhjFZBPy5A1_fREnAr_58a35XF22LPMuanCqxzZCEru9gRuHxf60nf88AKVazpmsRTDx06_vS4-ikla2llKL8YHjOSJNx1xPkuX-OntV93mCRo2ejZsMwKUEWRC7uDs0xHxR17djyt_sdm6a_W9N70VPf6ixsNUc0XPGPg_u9Zy-_Vez0AEnI2aOYUCBzb6AMpOH800a4rvpEqlUdDTPQsi219dLlV_s4DsmZ_sTp8Lv8GUATZX8FOHpiilELgWegnaMFHfwB6CX7rpFzWeEl66r_LSaZH9R0Z06c3h31n55OzPZbRNh-MocgvbDJ0xo9noFwp1Os-3p6RwmJ3Vk-kXYgbQTXMKJIvqb57qFqXGklEq1vVESmzwubRzlyJF-QsiowmpZhl91-0qCl7VFa80Nhwk96O_MljuW7C7pdLV0x_wOohz0z59zMtVmtAObQoFKc3tEfkeqQ8pLX7nyDN36S74agDnAOuxltMzgpjsGqIWplN5qbn-1NMN2OYy5lbM1hU9vk8DzK3ZFpynqWmwwYubYfnJDQCHwjY6KidtFN0WWr0ZBWfRqm2BPgC-3BVvoDlIH34Eg7yQMwaQkSgbOw6xJ_QqG5TJlKfRGuLvNPjUEt80eF7sLCh9SyMbDKo6OUWnkptOhUG_UbDznkilblVq6h8WJiQb-2T1QpSqboSEhnsqIxwDLCJWr-1TvYUnwOQvyN56U8l7GwjwvBnSPcnwD50u12MfBHO_p2LhmEtbx3dC1NQcnf7KhXhLSLLfz6qaocwakfZy5LcViHPRP3A_MskFXYwJS4KZJuZ-7_hKVMztmMJ3SGuUFhc2mZ3t75rhYZ4_6gkxzIh1_gaJNNPB8M3OKHVBIRThiWvCD2k3tHyHUxBUOM2cmT-rx_4J44QCTqbfCRdj3MIv1FG-8FQ1fER9b3eeCW023FV_hyRFiuNWw2NrAJWSuY9xDLz1-Wt4eXZ73UaFaZqWB6B4JJqJXWfjLwAC0zmw8mSXcyyt_c6oaZHlQZQEYZ6HtCDaIN_LHCJnEInYBc7kWkKGyIV-O_G-TWeQYLe15pv4CswW2yiXdsst26u4WK8jx7yQOFD-g6GLkEMbwF-MSHtuWsad3mBH4oI2rQl_Xdla83e6sgG9LCeAxKVdLJ4t0BDpSDYG0tcFFEm-oz_u0FQ0KqM20gEdFBzhGuARxrYmIkJjiw8fq6AWbj53y&cid=CAASJeRoFj9EEZJLW0OuxuOWt7TpK2FwDsW3FjBx19dCnFkIMkSvSm4&rfl=1%2Chttps%253A%252F%252Fwww.webtretho.com%252F%240
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
90c5abafaf023dc970d5cb9b7ce906ee99a4126933c0507c15cf8a8de472dc05
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35404
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 9375 		42 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-APea8giCW_yczfSuzBPkZINLgbxL1dOJlZEUSj98s2g9AokPwNwPa5UA04aFlQ-1e-p1kR6k5_9nzrgl8UUVczIXc_IvGwiqeaKUZkWwrAeSQ3arQ
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame 9375 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/window_focus_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:32:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
49
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1359
x-xss-protection
0
server
cafe
etag
1484984001845508991
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:32:59 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 9375 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36950
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1650454428054601"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 26 Apr 2022 00:33:48 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame 9375 		15 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:32:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
68
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6409
x-xss-protection
0
server
cafe
etag
15284592792851369840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:32:40 GMT
l
www.google.com/ads/measurement/ Frame 9375 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQJzfyEICOb4qiTtH02apL4i073CHBoM64O_Z0w5K19ol8lUVvB8SdPZH6NXubMWUEP0iAhVnFoVru4-Yb5YjfUg3ACiA
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers
2XHPY-RSbv10KkhkP0UJ6nZG2FP9sxH4G7lqGX2DoEC3jfG6IU1p5ZC6J0QLfq8SescHOV-Exdag-qo_326cLia_gW8=w80-e365
lh3.googleusercontent.com/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/2XHPY-RSbv10KkhkP0UJ6nZG2FP9sxH4G7lqGX2DoEC3jfG6IU1p5ZC6J0QLfq8SescHOV-Exdag-qo_326cLia_gW8=w80-e365
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
b921f4059f021611472748433f0312372844505cacc69b33d72f43ef78be8740
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
age
0
content-disposition
inline;filename="unnamed.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2412
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=31536000, no-transform
timing-allow-origin
*
expires
Mon, 17 Apr 2023 02:48:09 GMT
sbiz6ciQNlbZ0Rdx_aRjidg8gTo-kaqM1rJHroMBXQbN-wuYPmYwM9Ee61DRayQGcm5YA6tluUbwelWEENqhATSS3Zo=w80-e365
lh3.googleusercontent.com/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/sbiz6ciQNlbZ0Rdx_aRjidg8gTo-kaqM1rJHroMBXQbN-wuYPmYwM9Ee61DRayQGcm5YA6tluUbwelWEENqhATSS3Zo=w80-e365
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
f92408753dcb5fa6d0fd4b4ac2b6ed2b64f93340a00dd774653faef70bec9ccf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
age
0
content-disposition
inline;filename="unnamed.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2052
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=31536000, no-transform
timing-allow-origin
*
expires
Wed, 12 Apr 2023 03:51:46 GMT
URYTq8-mUx3yqE9Skq2Z4keVLh8u0VKSGeDLsYrGSuCbzWEBCuj_AOckqcoOpO1RTi2CFwxSYC4RniiY3RDWuKvd-gTF=w80-e365
lh3.googleusercontent.com/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/URYTq8-mUx3yqE9Skq2Z4keVLh8u0VKSGeDLsYrGSuCbzWEBCuj_AOckqcoOpO1RTi2CFwxSYC4RniiY3RDWuKvd-gTF=w80-e365
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
6b730d238f23c90046d04b9f83f3562e2fefc9dd52f246a2c3a25a26a2c5df25
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
age
0
content-disposition
inline;filename="unnamed.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3733
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=31536000, no-transform
timing-allow-origin
*
expires
Tue, 18 Apr 2023 13:15:52 GMT
WCbZ7HptJk8L27p4if9_Bix2F93MPzwsed4OFJnOyuLZuK7owLaLKDkLXhIC8rM-pw2bwg8RCZ6241jLCEGrAkgg8hwK=w80-e365
lh3.googleusercontent.com/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/WCbZ7HptJk8L27p4if9_Bix2F93MPzwsed4OFJnOyuLZuK7owLaLKDkLXhIC8rM-pw2bwg8RCZ6241jLCEGrAkgg8hwK=w80-e365
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
c7b42a53653a228805775badb1251d03f4848ffd6282f7590716a0f8d42eac18
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
age
0
content-disposition
inline;filename="unnamed.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3223
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=31536000, no-transform
timing-allow-origin
*
expires
Tue, 25 Apr 2023 13:22:49 GMT
hflEYXGfVTZq_XD2xu_aI5jEtXonBWDe9UTs_be_0YBv7u3rrKeLrZguK1ZsIwoD0sMaRsFuUwnXFBHjR6fKZ187m_w-mQ=w80-e365
lh3.googleusercontent.com/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/hflEYXGfVTZq_XD2xu_aI5jEtXonBWDe9UTs_be_0YBv7u3rrKeLrZguK1ZsIwoD0sMaRsFuUwnXFBHjR6fKZ187m_w-mQ=w80-e365
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
e97bad6981037caddef88cee2e08d28aa0fd8ab727fd7d502009e17999a26239
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
age
0
content-disposition
inline;filename="unnamed.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2048
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=31536000, no-transform
timing-allow-origin
*
expires
Wed, 19 Apr 2023 05:24:19 GMT
41.6fdf01a7d7e80b2b125f.js
st.webtretho.com/_next/static/chunks/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/chunks/41.6fdf01a7d7e80b2b125f.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/webpack-ffc0c9d12fbf843463b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
cc2555ef0f701357d4119e8e995cc210be61d19b11df6616fe43e31076cc1168

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Tue, 12 Apr 2022 02:57:30 GMT
server
nginx
age
663684
etag
W/"6254ea9a-7a4"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 08:12:24 GMT
EhGXIGUAWD5o2uhjj0wxrjmPCi_tnzrf-Xk5KoZoKd2dOdJUZeaXrpf0H8P2DSAOke7Z5HjDRsW3tUUdtU2TXqCbRtoD=pp-w72-e365
lh3.googleusercontent.com/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/EhGXIGUAWD5o2uhjj0wxrjmPCi_tnzrf-Xk5KoZoKd2dOdJUZeaXrpf0H8P2DSAOke7Z5HjDRsW3tUUdtU2TXqCbRtoD=pp-w72-e365
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
7f21ad2825687a445b113c44093b82e20b88aa7d5ee04a660c286656b38f2461
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 21:54:07 GMT
x-content-type-options
nosniff
age
9581
content-disposition
inline;filename="unnamed.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2459
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=31536000, no-transform
timing-allow-origin
*
expires
Tue, 18 Apr 2023 09:53:49 GMT
community.js
st.webtretho.com/_next/static/1650275250293/pages/ 		0
7 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://st.webtretho.com/_next/static/1650275250293/pages/community.js
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/runtime/main-d7f0b237142f0705c131.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.90.220.252 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 09:49:44 GMT
server
nginx
age
656991
etag
W/"625d3438-630d"
vary
Accept-Encoding
x-cache
HIT from da08.vn05.swiftserve.com:443
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2592000, public, must-revalidate, proxy-revalidate
expires
Wed, 27 Jul 2022 10:03:57 GMT
rum
dsum-sec.casalemedia.com/ Frame C28B
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJP7Ro96lEOjLXRnVC4syPY&google_cver=1
43 B
894 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJP7Ro96lEOjLXRnVC4syPY&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPD8kAIQ2OPDowMYq83NxgEwAQ&v=APEucNWq6-y-tU1oBEx4j3qWiRm1KTXutmaSeA84vYWYxtUh22tP7uy6_kOiZ-mFRDFk1oytmB9WkUOqIea36V4dW0-xvMzW7XYYZ_gPOt__mClyFSl4XzDmOmjQ4EdQHHwxVvz7tN_N7ebpk6aCAzTMmqaiakYM0wKmZ1VpMYS9sjuuZOxvnNA
Protocol
HTTP/1.1
Server
23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-236-247.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 26 Apr 2022 00:33:48 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 26 Apr 2022 00:33:48 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:48 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJP7Ro96lEOjLXRnVC4syPY&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame C28B
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Ymc97LCLAgfB1LGNpxlCegAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJP7Ro96lEOjLXRnVC4syPY&google_cver=1
43 B
894 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJP7Ro96lEOjLXRnVC4syPY&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPD8kAIQ2OPDowMYq83NxgEwAQ&v=APEucNWq6-y-tU1oBEx4j3qWiRm1KTXutmaSeA84vYWYxtUh22tP7uy6_kOiZ-mFRDFk1oytmB9WkUOqIea36V4dW0-xvMzW7XYYZ_gPOt__mClyFSl4XzDmOmjQ4EdQHHwxVvz7tN_N7ebpk6aCAzTMmqaiakYM0wKmZ1VpMYS9sjuuZOxvnNA
Protocol
HTTP/1.1
Server
23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-236-247.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 26 Apr 2022 00:33:48 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 26 Apr 2022 00:33:48 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:48 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJP7Ro96lEOjLXRnVC4syPY&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
setuid
ib.adnxs.com/ Frame C28B
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEM_OzMFSe-y1yFpIc-h5WVs&google_cver=1
43 B
1020 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/setuid?entity=101&code=CAESEM_OzMFSe-y1yFpIc-h5WVs&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPD8kAIQ2OPDowMYq83NxgEwAQ&v=APEucNWq6-y-tU1oBEx4j3qWiRm1KTXutmaSeA84vYWYxtUh22tP7uy6_kOiZ-mFRDFk1oytmB9WkUOqIea36V4dW0-xvMzW7XYYZ_gPOt__mClyFSl4XzDmOmjQ4EdQHHwxVvz7tN_N7ebpk6aCAzTMmqaiakYM0wKmZ1VpMYS9sjuuZOxvnNA
Protocol
HTTP/1.1
Server
37.252.173.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 26 Apr 2022 00:33:48 GMT
X-Proxy-Origin
178.162.209.132; 178.162.209.132; 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
b9d04ba2-c75c-4cbe-9099-f25f2044535a
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:48 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ib.adnxs.com/setuid?entity=101&code=CAESEM_OzMFSe-y1yFpIc-h5WVs&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
290
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame C28B
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0OTY4ODAzMjEwMDM2OTE1MQ%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0OTY4ODAzMjEwMDM2OTE1MQ%3D%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPD8kAIQ2OPDowMYq83NxgEwAQ&v=APEucNWq6-y-tU1oBEx4j3qWiRm1KTXutmaSeA84vYWYxtUh22tP7uy6_kOiZ-mFRDFk1oytmB9WkUOqIea36V4dW0-xvMzW7XYYZ_gPOt__mClyFSl4XzDmOmjQ4EdQHHwxVvz7tN_N7ebpk6aCAzTMmqaiakYM0wKmZ1VpMYS9sjuuZOxvnNA
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:48 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 26 Apr 2022 00:33:48 GMT
X-Proxy-Origin
178.162.209.132; 178.162.209.132; 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
41dea159-b2d5-4f91-b0f6-33ccf2b66400
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0OTY4ODAzMjEwMDM2OTE1MQ%3D%3D
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
default-background.jpg
www.webtretho.com/static/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.webtretho.com/static/img/default-background.jpg
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
115fb965db1c8b7bcd3e5329673beebe79ed5dced4884188e51b6a7ddf2a3d86

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 26 Apr 2022 00:31:29 GMT
content-encoding
gzip
last-modified
Tue, 26 Oct 2021 15:51:07 GMT
server
nginx
etag
W/"617823eb-927"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
max-age=5184000, public
expires
Sat, 25 Jun 2022 00:31:29 GMT
BKyz78jFKT1dgLJQtSSqxeIacN5F67XJb8Xg9SIUW45689C5GO5C1XBs7TazYQiWaoroMuSN82I7YftseH8Yh0D_WEz4pA9FX2wFMk4e4w=w400
lh3.googleusercontent.com/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/BKyz78jFKT1dgLJQtSSqxeIacN5F67XJb8Xg9SIUW45689C5GO5C1XBs7TazYQiWaoroMuSN82I7YftseH8Yh0D_WEz4pA9FX2wFMk4e4w=w400
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
020a8141a77e53d2c15f2f15a95459e673dafdfd4333958e3702a55b5800556c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29022
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:48 GMT
DU--ha-GC_c_UCRiz-_b2FJca4H0uevTuX6sFRGWiUg97xf6PwT5S8PA8BUbCGYARJldcEmU0gEc-MNrmy9mQ36DT79s4VUytKkxEGsBwhY=w400
lh3.googleusercontent.com/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/DU--ha-GC_c_UCRiz-_b2FJca4H0uevTuX6sFRGWiUg97xf6PwT5S8PA8BUbCGYARJldcEmU0gEc-MNrmy9mQ36DT79s4VUytKkxEGsBwhY=w400
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
4a30059985c4efb4325853db9b5c726150b378d566ce7135c8583453779c3a99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:49 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22359
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:49 GMT
WVJYmKxOULEOuicmBy-jhSAJSXddzvpvW48cY-cYXAAC65lkARARKAqnnANdG9c_Km-ZnVorxmdzSbuFFTEwVWxgGGY0ZDNNs70hEm1m86w=w400
lh3.googleusercontent.com/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/WVJYmKxOULEOuicmBy-jhSAJSXddzvpvW48cY-cYXAAC65lkARARKAqnnANdG9c_Km-ZnVorxmdzSbuFFTEwVWxgGGY0ZDNNs70hEm1m86w=w400
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
e9407263ab4fca6728410696370e790de6f6116cd122e81c30f2603d6a8b0566
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:49 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28214
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:49 GMT
MsOKVOB1Pk8qMDpoKxf5jYHuSxiJlcNLIbnsWmgCs9PoHteQeqHrejgUCavsL0--uCrvHJPhUMzHVacAKWzAsCACuh4jKAUJ5VB6CRPu3Q=w400
lh3.googleusercontent.com/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/MsOKVOB1Pk8qMDpoKxf5jYHuSxiJlcNLIbnsWmgCs9PoHteQeqHrejgUCavsL0--uCrvHJPhUMzHVacAKWzAsCACuh4jKAUJ5VB6CRPu3Q=w400
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
23f56d65c05a72a3b098aabc6ceff98ffba32c1c6f15ef1e2e5216cddf330b33
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:49 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21821
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:49 GMT
qn_pXjRwqoWF8DiBHBK_1iFpGXIsiHALsGC4EDrWpBko34okmDZMNcpQgu2bcsc6E0cP0nGpfFekdH9v64h2vEQRmzIFJ3HWi8ktaQigZg=w400
lh3.googleusercontent.com/ 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/qn_pXjRwqoWF8DiBHBK_1iFpGXIsiHALsGC4EDrWpBko34okmDZMNcpQgu2bcsc6E0cP0nGpfFekdH9v64h2vEQRmzIFJ3HWi8ktaQigZg=w400
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
e5395e0a9a868114182016356850e98a9175a99b9bcc681ab3690b644f407989
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:49 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23452
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:49 GMT
nAnJFCAYmclz-HiIS9M157boYeKgH-nyP60W_I_z4wucSiagfuIYR0VseJ3ppCRXXfXuuqpRYsJQAL0caKEMBNjlmD99CAd4x7O16AyIM3Y=w400
lh3.googleusercontent.com/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/nAnJFCAYmclz-HiIS9M157boYeKgH-nyP60W_I_z4wucSiagfuIYR0VseJ3ppCRXXfXuuqpRYsJQAL0caKEMBNjlmD99CAd4x7O16AyIM3Y=w400
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
35c673a2e779698643e5188a6dc2fec476f4cba673c48b1f6d4679b74226563c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27244
x-xss-protection
0
expires
Wed, 27 Apr 2022 00:33:48 GMT
skeleton.js
fw.adsafeprotected.com/rjss/st/996673/61756187/ Frame 9375 		46 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fw.adsafeprotected.com/rjss/st/996673/61756187/skeleton.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.211.64.143 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-211-64-143.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
459b7b25fc143ae6cd3aa6e1b280c66a55b6ec0b61356665adab96bd3d6c6164

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
gzip
vary
accept-encoding
content-type
application/javascript;charset=utf-8
access-control-allow-origin
fw.adsafeprotected.com
cache-control
no-cache
access-control-allow-credentials
true
expires
Wed, 31 Dec 1969 23:59:59 GMT
express_html_inpage_rendering_lib_200_275.js
s0.2mdn.net/879366/ Frame 9375 		106 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Origin
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 11:28:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
47129
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37892
x-xss-protection
0
last-modified
Mon, 27 Sep 2021 18:44:52 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 11:28:19 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20220421/r20110914/elements/html/ Frame 9375 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20220421/r20110914/elements/html/omrhp.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DhY1dBmzI9gwyGAlLJSPL-0E8D6GcRJt13C78E1ekzN-eP03mKqesH7dEPIzMcLw72fQIzum4TxSJV9fED9xpcIM9CCI9ztFupZGqZmRQvpU9iK9XgCDEbwjc3v8eFaYy2jpLyMVNQaVAZDJ8zHu_Jm8T_-A&dbm_d=AKAmf-CWRBPXoGrh4LqWpvtmKXzuClGty9eKfyg_4ylrf01euqLWcdCZi_7LQs1N0rrqTFfMLavkFq_A4-hO1Mn2J1zRB3V31a3HLCeNBmxQa9cn4veC23tDbwMwRbd8wA3sIkZC66LhRuGFyGqGIY7pxdd_vvPzrr2z5SRc30A7F3P78F2Yh0tA-SfRnUe6fS3Uwiac0qLnngzUyLvBxb7Gdxyj0ujvReKCnGEuILSfiZVqGaTx0yKGN0VtGmxL3SWnu_hxepbEOCpzjtkVqomvYems2v6VzyrOOYOHKtCcqj7QftqmWdaYjHv3kz9pVMbRd0sg6UNT7x2W53ackfHy0-aicdDzJnhNBf5MZfLtflSqOTPcMoSj8-RdC7Lnz-r7_FpsF-b9UF2ZZFMP4Vx0alnat79fUpksEBl3AurmstB0MaEGLDCZQ2weURrhlHH4am7uZkdgeeCsxS7FSqY-M7VymlkEyosaF8PA9HLtSw4E0wZCWAmJzbVyo10xBSNCVc1mTikDOVUehq4BIWqXA56C93kKi0fhpASXFXoljT4Ii4XjWJJk7dU2avp_AvHjW83IM1HX-0ZhD4An2n9mJ7yBLqUVq8Sa4ggktgyBp0uqTb8GT1yHyAd6DXXeNu_YRmkZPcZl67Qs4csQGFyhQqK4pe0wEPgmAmNXpK7mAcHH4XUL_69gqnQ7c8XOHnDVOOkCJh8nLH-L3jzYwDz5UK191BAVzJO-EpWElqxFWtF-7GfB_J2-G4CDotZYSocADMqmlS34VwryQLdD2hOYHANFCz7-PNZCLN6Kp8ivPKGRXeGdigXymOIVzg37iDKMjPcjYN5Uvviii7vUf5QPlHwRX6SPtaEv_4zUqQ_M64Hf5wG4qHzjEc8NOBigz1EA7YxEiSOdOJRsm9VsSnrOkvZ3fTCyXnZ9GbtnN9giMTAZpucm7o6zMq7xk61rxCodmzF25lbnVZN4DtkkEy1X05T8scQMlD8t_zSZfXfLibWZJqsXslUf8qeCxc-uMDPqlaiOgTNzOvj_yFLzjC3Ipqk_l_83k1o1wIXKXwcRkgmRQ3aMvH6BQyj69YOwp21TcZMlOhVQEM5PDf0M07HPHwvDwZluO4ueUZlD6e8LzFj0MgTaRwFC_0taRfRfVCDsXsJuvYVohTnE7SfCdd9WDj-yiITL0w6nOeO0yfnItFDPDh1rVqDrsxQFUK-TTHTVnZqyi7X64xfyom_ugn56Vx1KHfFasNX55dJMw9FejxVkqlAssEKB8DVt0Aah4siozvsXfQyZohzetkZ9yLZeM59lZYHL7bBlcGREYNHvBuAjY-lytfnyhCfnMvKJXnlmgiRQkCEUDpGSCkHQL-GLwSoA0qNh7gEaCqDW6bA_1cTTGH5-uiMxsv9O2xNjYBAvmKWQadN5dLiUmQ53g04MniL2Gik5kz4X-OcvALSi_7UyzMyDwDO1DCmerOha6xYpSoMVNlChzosJoEIxiw9xc-FmjuuUEV-XlRqLazRYHlTfxI0El-ZybPuUVNbpfeWeUrVCBFegI2jvGMwnPzS01eUuKIXaDSmY5F28i2V781ocOzVmKwPIE8gX7Wjs-qAUaSGmaCgwTU3PT86DGXXyRSJ7WauDeb9J1rg9b8XwkGmaI6txl2dOw5n-Gu9smbwzfBKt62njCA73myXwjdCJEbzKMdVia63GZVuzXFk0p05aAkjpTfWknXObRQ93sSRL1kMgi21eST106tktpqEFhvr9njpmsCyG_5RbRTCx2xNrYxT1yLJ_jFRHogZrXgz2WsgV4L9sDXNio1raGElAmgeIMbp8Fmr7VGMZCAu7vyWq5jPJ53iweOzLnYUAodk7gQu9rpIjKqcPfvg8s-0jOaWKd3sN25yCbtPwjzfZR5RWsgTwqwNuVhCmAcgdQQWoRwjPiRoxROUkc4IX1EzaTRDGeGDWrw6ipHPPLdXs4W0yWWWI_0WM5c5i0E3wbRkiMUCRsJoqs-5GwyQ2C9WDc2ccVXII34kvKeUG_k7xzJcSddQL4kg2pxVzF9Mw-j-18vzWVn4Zcu30Cf3aRxSx0TIqC9iaVKb16Y1K7LK-LOBF-m3v4-FuAd2ekhFfdiOk4iRb_psdN8jqMs4FW6Gxvc3N1iEvwT2GfGuDjEIE17gIvC48WlekhnAFE5CfyQoz7lH4gacGfE6_cGtvhMT2qnHyT91KZ0O1Mhq-5SIiiIcb9JfWj75CODoOfdlgkECLZhZW8xFi4OQAHhjFZBPy5A1_fREnAr_58a35XF22LPMuanCqxzZCEru9gRuHxf60nf88AKVazpmsRTDx06_vS4-ikla2llKL8YHjOSJNx1xPkuX-OntV93mCRo2ejZsMwKUEWRC7uDs0xHxR17djyt_sdm6a_W9N70VPf6ixsNUc0XPGPg_u9Zy-_Vez0AEnI2aOYUCBzb6AMpOH800a4rvpEqlUdDTPQsi219dLlV_s4DsmZ_sTp8Lv8GUATZX8FOHpiilELgWegnaMFHfwB6CX7rpFzWeEl66r_LSaZH9R0Z06c3h31n55OzPZbRNh-MocgvbDJ0xo9noFwp1Os-3p6RwmJ3Vk-kXYgbQTXMKJIvqb57qFqXGklEq1vVESmzwubRzlyJF-QsiowmpZhl91-0qCl7VFa80Nhwk96O_MljuW7C7pdLV0x_wOohz0z59zMtVmtAObQoFKc3tEfkeqQ8pLX7nyDN36S74agDnAOuxltMzgpjsGqIWplN5qbn-1NMN2OYy5lbM1hU9vk8DzK3ZFpynqWmwwYubYfnJDQCHwjY6KidtFN0WWr0ZBWfRqm2BPgC-3BVvoDlIH34Eg7yQMwaQkSgbOw6xJ_QqG5TJlKfRGuLvNPjUEt80eF7sLCh9SyMbDKo6OUWnkptOhUG_UbDznkilblVq6h8WJiQb-2T1QpSqboSEhnsqIxwDLCJWr-1TvYUnwOQvyN56U8l7GwjwvBnSPcnwD50u12MfBHO_p2LhmEtbx3dC1NQcnf7KhXhLSLLfz6qaocwakfZy5LcViHPRP3A_MskFXYwJS4KZJuZ-7_hKVMztmMJ3SGuUFhc2mZ3t75rhYZ4_6gkxzIh1_gaJNNPB8M3OKHVBIRThiWvCD2k3tHyHUxBUOM2cmT-rx_4J44QCTqbfCRdj3MIv1FG-8FQ1fER9b3eeCW023FV_hyRFiuNWw2NrAJWSuY9xDLz1-Wt4eXZ73UaFaZqWB6B4JJqJXWfjLwAC0zmw8mSXcyyt_c6oaZHlQZQEYZ6HtCDaIN_LHCJnEInYBc7kWkKGyIV-O_G-TWeQYLe15pv4CswW2yiXdsst26u4WK8jx7yQOFD-g6GLkEMbwF-MSHtuWsad3mBH4oI2rQl_Xdla83e6sgG9LCeAxKVdLJ4t0BDpSDYG0tcFFEm-oz_u0FQ0KqM20gEdFBzhGuARxrYmIkJjiw8fq6AWbj53y&cid=CAASJeRoFj9EEZJLW0OuxuOWt7TpK2FwDsW3FjBx19dCnFkIMkSvSm4&rfl=1%2Chttps%253A%252F%252Fwww.webtretho.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:05:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1718
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3159
x-xss-protection
0
server
cafe
etag
1394524276809619753
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:05:10 GMT
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20220421/r20110914/ Frame 9375 		25 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20220421/r20110914/abg_lite.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DhY1dBmzI9gwyGAlLJSPL-0E8D6GcRJt13C78E1ekzN-eP03mKqesH7dEPIzMcLw72fQIzum4TxSJV9fED9xpcIM9CCI9ztFupZGqZmRQvpU9iK9XgCDEbwjc3v8eFaYy2jpLyMVNQaVAZDJ8zHu_Jm8T_-A&dbm_d=AKAmf-CWRBPXoGrh4LqWpvtmKXzuClGty9eKfyg_4ylrf01euqLWcdCZi_7LQs1N0rrqTFfMLavkFq_A4-hO1Mn2J1zRB3V31a3HLCeNBmxQa9cn4veC23tDbwMwRbd8wA3sIkZC66LhRuGFyGqGIY7pxdd_vvPzrr2z5SRc30A7F3P78F2Yh0tA-SfRnUe6fS3Uwiac0qLnngzUyLvBxb7Gdxyj0ujvReKCnGEuILSfiZVqGaTx0yKGN0VtGmxL3SWnu_hxepbEOCpzjtkVqomvYems2v6VzyrOOYOHKtCcqj7QftqmWdaYjHv3kz9pVMbRd0sg6UNT7x2W53ackfHy0-aicdDzJnhNBf5MZfLtflSqOTPcMoSj8-RdC7Lnz-r7_FpsF-b9UF2ZZFMP4Vx0alnat79fUpksEBl3AurmstB0MaEGLDCZQ2weURrhlHH4am7uZkdgeeCsxS7FSqY-M7VymlkEyosaF8PA9HLtSw4E0wZCWAmJzbVyo10xBSNCVc1mTikDOVUehq4BIWqXA56C93kKi0fhpASXFXoljT4Ii4XjWJJk7dU2avp_AvHjW83IM1HX-0ZhD4An2n9mJ7yBLqUVq8Sa4ggktgyBp0uqTb8GT1yHyAd6DXXeNu_YRmkZPcZl67Qs4csQGFyhQqK4pe0wEPgmAmNXpK7mAcHH4XUL_69gqnQ7c8XOHnDVOOkCJh8nLH-L3jzYwDz5UK191BAVzJO-EpWElqxFWtF-7GfB_J2-G4CDotZYSocADMqmlS34VwryQLdD2hOYHANFCz7-PNZCLN6Kp8ivPKGRXeGdigXymOIVzg37iDKMjPcjYN5Uvviii7vUf5QPlHwRX6SPtaEv_4zUqQ_M64Hf5wG4qHzjEc8NOBigz1EA7YxEiSOdOJRsm9VsSnrOkvZ3fTCyXnZ9GbtnN9giMTAZpucm7o6zMq7xk61rxCodmzF25lbnVZN4DtkkEy1X05T8scQMlD8t_zSZfXfLibWZJqsXslUf8qeCxc-uMDPqlaiOgTNzOvj_yFLzjC3Ipqk_l_83k1o1wIXKXwcRkgmRQ3aMvH6BQyj69YOwp21TcZMlOhVQEM5PDf0M07HPHwvDwZluO4ueUZlD6e8LzFj0MgTaRwFC_0taRfRfVCDsXsJuvYVohTnE7SfCdd9WDj-yiITL0w6nOeO0yfnItFDPDh1rVqDrsxQFUK-TTHTVnZqyi7X64xfyom_ugn56Vx1KHfFasNX55dJMw9FejxVkqlAssEKB8DVt0Aah4siozvsXfQyZohzetkZ9yLZeM59lZYHL7bBlcGREYNHvBuAjY-lytfnyhCfnMvKJXnlmgiRQkCEUDpGSCkHQL-GLwSoA0qNh7gEaCqDW6bA_1cTTGH5-uiMxsv9O2xNjYBAvmKWQadN5dLiUmQ53g04MniL2Gik5kz4X-OcvALSi_7UyzMyDwDO1DCmerOha6xYpSoMVNlChzosJoEIxiw9xc-FmjuuUEV-XlRqLazRYHlTfxI0El-ZybPuUVNbpfeWeUrVCBFegI2jvGMwnPzS01eUuKIXaDSmY5F28i2V781ocOzVmKwPIE8gX7Wjs-qAUaSGmaCgwTU3PT86DGXXyRSJ7WauDeb9J1rg9b8XwkGmaI6txl2dOw5n-Gu9smbwzfBKt62njCA73myXwjdCJEbzKMdVia63GZVuzXFk0p05aAkjpTfWknXObRQ93sSRL1kMgi21eST106tktpqEFhvr9njpmsCyG_5RbRTCx2xNrYxT1yLJ_jFRHogZrXgz2WsgV4L9sDXNio1raGElAmgeIMbp8Fmr7VGMZCAu7vyWq5jPJ53iweOzLnYUAodk7gQu9rpIjKqcPfvg8s-0jOaWKd3sN25yCbtPwjzfZR5RWsgTwqwNuVhCmAcgdQQWoRwjPiRoxROUkc4IX1EzaTRDGeGDWrw6ipHPPLdXs4W0yWWWI_0WM5c5i0E3wbRkiMUCRsJoqs-5GwyQ2C9WDc2ccVXII34kvKeUG_k7xzJcSddQL4kg2pxVzF9Mw-j-18vzWVn4Zcu30Cf3aRxSx0TIqC9iaVKb16Y1K7LK-LOBF-m3v4-FuAd2ekhFfdiOk4iRb_psdN8jqMs4FW6Gxvc3N1iEvwT2GfGuDjEIE17gIvC48WlekhnAFE5CfyQoz7lH4gacGfE6_cGtvhMT2qnHyT91KZ0O1Mhq-5SIiiIcb9JfWj75CODoOfdlgkECLZhZW8xFi4OQAHhjFZBPy5A1_fREnAr_58a35XF22LPMuanCqxzZCEru9gRuHxf60nf88AKVazpmsRTDx06_vS4-ikla2llKL8YHjOSJNx1xPkuX-OntV93mCRo2ejZsMwKUEWRC7uDs0xHxR17djyt_sdm6a_W9N70VPf6ixsNUc0XPGPg_u9Zy-_Vez0AEnI2aOYUCBzb6AMpOH800a4rvpEqlUdDTPQsi219dLlV_s4DsmZ_sTp8Lv8GUATZX8FOHpiilELgWegnaMFHfwB6CX7rpFzWeEl66r_LSaZH9R0Z06c3h31n55OzPZbRNh-MocgvbDJ0xo9noFwp1Os-3p6RwmJ3Vk-kXYgbQTXMKJIvqb57qFqXGklEq1vVESmzwubRzlyJF-QsiowmpZhl91-0qCl7VFa80Nhwk96O_MljuW7C7pdLV0x_wOohz0z59zMtVmtAObQoFKc3tEfkeqQ8pLX7nyDN36S74agDnAOuxltMzgpjsGqIWplN5qbn-1NMN2OYy5lbM1hU9vk8DzK3ZFpynqWmwwYubYfnJDQCHwjY6KidtFN0WWr0ZBWfRqm2BPgC-3BVvoDlIH34Eg7yQMwaQkSgbOw6xJ_QqG5TJlKfRGuLvNPjUEt80eF7sLCh9SyMbDKo6OUWnkptOhUG_UbDznkilblVq6h8WJiQb-2T1QpSqboSEhnsqIxwDLCJWr-1TvYUnwOQvyN56U8l7GwjwvBnSPcnwD50u12MfBHO_p2LhmEtbx3dC1NQcnf7KhXhLSLLfz6qaocwakfZy5LcViHPRP3A_MskFXYwJS4KZJuZ-7_hKVMztmMJ3SGuUFhc2mZ3t75rhYZ4_6gkxzIh1_gaJNNPB8M3OKHVBIRThiWvCD2k3tHyHUxBUOM2cmT-rx_4J44QCTqbfCRdj3MIv1FG-8FQ1fER9b3eeCW023FV_hyRFiuNWw2NrAJWSuY9xDLz1-Wt4eXZ73UaFaZqWB6B4JJqJXWfjLwAC0zmw8mSXcyyt_c6oaZHlQZQEYZ6HtCDaIN_LHCJnEInYBc7kWkKGyIV-O_G-TWeQYLe15pv4CswW2yiXdsst26u4WK8jx7yQOFD-g6GLkEMbwF-MSHtuWsad3mBH4oI2rQl_Xdla83e6sgG9LCeAxKVdLJ4t0BDpSDYG0tcFFEm-oz_u0FQ0KqM20gEdFBzhGuARxrYmIkJjiw8fq6AWbj53y&cid=CAASJeRoFj9EEZJLW0OuxuOWt7TpK2FwDsW3FjBx19dCnFkIMkSvSm4&rfl=1%2Chttps%253A%252F%252Fwww.webtretho.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e66bfceb15a6ee125dff79826be02a07b766843e6c660edf55ec0c22d1a407c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:28:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
306
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9777
x-xss-protection
0
server
cafe
etag
12512753850102923420
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:28:42 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 9375 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 15:03:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
466245
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Apr 2023 15:03:03 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame C804 		1 KB
748 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
gzip
content-length
724
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 00:33:48 GMT
etag
48472445140208031
expires
Wed, 27 Apr 2022 00:33:48 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 9375 		218 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b63db586c1504ae1e53d9e31befcc458d8df5dfac8a4f6f7d31537ad514c59fa

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/png
index.html
s0.2mdn.net/10176755/1628770975891/ Frame 749B 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/10176755/1628770975891/index.html
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c2a7142846ad99b18413f75319e4794420db4f9bbc30bf2d3f20c64a034959a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
4376
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
gzip
content-length
1844
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Mon, 25 Apr 2022 23:20:52 GMT
expires
Tue, 26 Apr 2022 23:20:52 GMT
last-modified
Thu, 12 Aug 2021 12:22:55 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
view
googleads4.g.doubleclick.net/pcs/ Frame 9375 		0
622 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuQX9NH0QiABar2U2zo_2CM3LGqAYSW2VVwikGBjqzM62_9xSQSdnHGVI4cdRFx-YufTPzSA4fwh49V6o8vBmt-vlJMHYBaqjgL2oukH9e9WKXdzpgtthvFLGbJwrf4lEWb12b-si9YJawbjKFQLBXdLPXKFvUwh7cBHzCHhck0HXzQm2iHN-CdhoCDj_Z1-Q1mdlyomlcXBROWGzHhQHDvMgLFUk5kp_PAi2wEsDEvHrR0uYPhyFvGOrvvZY_l6OM1ZRWNVOBLY-ncHJXZfcZbN5rUQaJHRZeQbgjCzYuxuVvoxVZ5EztKB0bs-HqEdmpbQv4fSoMMzdnbnaW1_keLljRhBrKwb44NmIsTYevjrI9Tmw1kqbLkuXrTlgUXJ_njj1Y5JoLAMqd7pk8Be8t_ihoGsXQ2yvpz1A5qn2afy6Mxze8t693pItkCFkzUMFeaSnLmnLM735gf4iAhCevSbQMPCw7isi0VQqbM5Ot6oCSXHdxZGjxkkYMEsLubN76s-65_MaU2UJsfH8NEwspwCghoCAqPFbQjFhFK44x1uVbrU1lppPfyQ643rD_BtUqLvuQRlUD9pBzef3iK3sT6THVNxXre-M-jraKZwmg37_I4LnyI1kWQXflbZuFxdm2iWttXF_X4w9oE8KEcyYis6e2yqL4uT28GRt1Mj4lz4_zOVKWN0dg9yG3evj3wUxTLeLb7Ih6Js01WvJTx1eQzCPprA1qFPjYx6ZRLXm4a-o3QNq5r06SvN7yrkXTo1c_Wjb1FHn1adSkkOD0RZznMAISGxDCNpB-Osa0axCS1qsDQe5p0g2kMWufb_blxHAG_MsBfkwPRmUy579bY8Tzy8EkdpdXsBzO5e8ejZOwRp7JnFVmye3YWUFbw6QJeX7wCtuQxURKvUrU-8zM9_klaLOS2Z86StWl3N98uTu5BTD34KB-Ln2GFxxXtdcInYByVkBAh8mKZRcYmnvD1vrLclKMmSIkv174iIx_5x5BEev4pjS5Tepw6fQYkI2zDLrYMLLX0pLBMwcGmLublekGNS1S_AtvdUKdZQ7Ycsbn3aaWt6FWBJ3ghph4rPhCxdj1gSJ-6DMRPDn8RcOkFEGogN8gx8b0TW8AulAxkCnDLLYYS6r0sv60XA7Yv-EZzSNtuKev-EXek3NkIr_K2uJWVoZZ1-YYvyGD__nlu59HeGhMebwwNNi-Lyc_T68xYYfThik8MQ3YtDrsi0nNi5M-4&sai=AMfl-YTi1B-d_l93CyxKsi-L5xj6ZyAIYeONXV5mW41vVpI8Eb5lUJwwazKqAsLxoPnKNYkRicD-oBsEM5jg1axJYA1a1S3w3xk0uOGSRXzTavMP4KmD91BdWbYjy_r_OGDie9dk2dCeJzsiMCfDQKOvD8cDeViDPqF2PD6ZmHxkiJUhb30Ps_0-jCsxdCWpgugjK3-unLOIyWf9f-xQtq7bfuOU&sig=Cg0ArKJSzP_8AjgySR42EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=108&cbvp=1&cstd=106&cisv=r20220421.76836&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date
Tue, 26 Apr 2022 00:33:48 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
/
google2waycm.netmng.com/cm/ Frame C804 		0
0
pixel
cm.g.doubleclick.net/ Frame C804
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEGFlvEbSsqn6DaZaTnCcGXU&google_cve...
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEGFlvEbSsqn6DaZaTnCcGXU&goog...
  • https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=VHJ4UUZFaGcxTko5OWk1&google_gid=CAESEGFlvEbSsqn6DaZaTnCcGXU&google_cver=1&google_push=AYg5qPJHovtbdCDmkHu8US75vqCQLSWM4t_XqT0qjYCQVNv...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=VHJ4UUZFaGcxTko5OWk1&google_gid=CAESEGFlvEbSsqn6DaZaTnCcGXU&google_cver=1&google_push=AYg5qPJHovtbdCDmkHu8US75vqCQLSWM4t_XqT0qjYCQVNvNRYjKkRDkcZtV0dZKgHz0CWZqf1OMn97f6tHB_ydMHoaMAQBBeg
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 26 Apr 2022 00:33:48 GMT
Server
PingMatch/v2.0.30-713-gdae83a2#rel-ec2-master i-04fd973f611872bb0@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
Location
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=VHJ4UUZFaGcxTko5OWk1&google_gid=CAESEGFlvEbSsqn6DaZaTnCcGXU&google_cver=1&google_push=AYg5qPJHovtbdCDmkHu8US75vqCQLSWM4t_XqT0qjYCQVNvNRYjKkRDkcZtV0dZKgHz0CWZqf1OMn97f6tHB_ydMHoaMAQBBeg
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame C804
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESENTlJSwD-ZNYY2xgzvM2fPY&google_cver=1&google_push=AYg5qPKvkMV-9daHp6WChHOv8EDow1mjLi_xxc7vd4drXS5ZqiG-Fqi2KAnHqly1eCJRa_F_s6KVivnVP3yt-1aimdMf...
  • https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESENTlJSwD-ZNYY2xgzvM2fPY&google_cver=1&google_push=AYg5qPKvkMV-9daHp6WChHOv8EDow1mjLi_xxc7vd4drXS5ZqiG-Fqi2KAnHqly1eCJRa_F_s6KVivnVP3yt-1...
  • https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgoogle
  • https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgoogle
  • https://x.bidswitch.net/sync?dsp_id=59&user_id=fb6ddc5b-98d9-4dad-be63-827057d69950&ssp=google
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKvkMV-9daHp6WChHOv8EDow1mjLi_xxc7vd4drXS5ZqiG-Fqi2KAnHqly1eCJRa_F_s6KVivnVP3yt-1aimdMfV0meJPk&google_hm=c40nf7WTTY-IEXVBzT9CEw==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKvkMV-9daHp6WChHOv8EDow1mjLi_xxc7vd4drXS5ZqiG-Fqi2KAnHqly1eCJRa_F_s6KVivnVP3yt-1aimdMfV0meJPk&google_hm=c40nf7WTTY-IEXVBzT9CEw==
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
//cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKvkMV-9daHp6WChHOv8EDow1mjLi_xxc7vd4drXS5ZqiG-Fqi2KAnHqly1eCJRa_F_s6KVivnVP3yt-1aimdMfV0meJPk&google_hm=c40nf7WTTY-IEXVBzT9CEw==
Date
Tue, 26 Apr 2022 00:33:49 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
pixel
cm.g.doubleclick.net/ Frame C804
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEDpGKR5nF04E2ZnhqfIQNdo&google_cver=1&google_push=AYg5qPJF5NF_THOWxYbRjI-saJ85Yl_xV2Mj0hNr5vbqtOkNj6Wf8ygt1FgfAIQY1B3G-syqzeBpcYyjqH7zYEa2l4dSQrI...
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJF5NF_THOWxYbRjI-saJ85Yl_xV2Mj0hNr5vbqtOkNj6Wf8ygt1FgfAIQY1B3G-syqzeBpcYyjqH7zYEa2l4dSQrIgfcU&google_hm=MTU2ODE1NDM0ODMyNDM4NTQ...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJF5NF_THOWxYbRjI-saJ85Yl_xV2Mj0hNr5vbqtOkNj6Wf8ygt1FgfAIQY1B3G-syqzeBpcYyjqH7zYEa2l4dSQrIgfcU&google_hm=MTU2ODE1NDM0ODMyNDM4NTQ2MQ%3D%3D
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Tue, 26 Apr 2022 00:33:48 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJF5NF_THOWxYbRjI-saJ85Yl_xV2Mj0hNr5vbqtOkNj6Wf8ygt1FgfAIQY1B3G-syqzeBpcYyjqH7zYEa2l4dSQrIgfcU&google_hm=MTU2ODE1NDM0ODMyNDM4NTQ2MQ%3D%3D
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
pixel
cm.g.doubleclick.net/ Frame C804
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tondlXX_S-Ch1zMmoCuAPQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tondlXX_S-Ch1zMmoCuAPQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIHyPR5PoaGWSCU6Nu0hYvgRgaNsCaxaxLw3AVL9cZz4-5f15AZtq37LW4NpHu35kdjEY89z1ZL8v-KdxRyEvqP9bhOpDQ
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tondlXX_S-Ch1zMmoCuAPQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIHyPR5PoaGWSCU6Nu0hYvgRgaNsCaxaxLw3AVL9cZz4-5f15AZtq37LW4NpHu35kdjEY89z1ZL8v-KdxRyEvqP9bhOpDQ
date
Tue, 26 Apr 2022 00:33:48 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame C804
Redirect Chain
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEDPcjn0G6O5mrOsqmlJmkWY&google_cver=1&google_push=AYg5qPIYKWfHKiivDY4k5PjMWZGK5F-Eb4iaRZrI7XBkIN9Mj0eQYHaur_fClLCUCAf2dIJF1rfMVFch6icQ6lHl...
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=6d715d18&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AYg5qPIYKWfHKiivDY4k5PjMWZGK5F-Eb4iaRZrI7XBkIN9M...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=6d715d18&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AYg5qPIYKWfHKiivDY4k5PjMWZGK5F-Eb4iaRZrI7XBkIN9Mj0eQYHaur_fClLCUCAf2dIJF1rfMVFch6icQ6lHlWnQRix7qXUU
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:48 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Tue, 26 Apr 2022 00:33:48 GMT
via
1.1 bee9d99ac2913ec4167e166e6bdb691e.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
FRA50-C1
x-cache
FunctionGeneratedResponse from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=6d715d18&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AYg5qPIYKWfHKiivDY4k5PjMWZGK5F-Eb4iaRZrI7XBkIN9Mj0eQYHaur_fClLCUCAf2dIJF1rfMVFch6icQ6lHlWnQRix7qXUU
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
XGsUpJymFBhQAfZ6qVmOPagOPeV4xcMeIm1A5JLqOX_HXYRiN5FfPg==
pixel
cm.g.doubleclick.net/ Frame C804
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEA...
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AYg5qPJIfD0eDWyZIRdH5q7QD4M0hpSceyRPxTepvaCe4T5gjrAgKBeRCuhg3gm9wAgcOfQV_3dLP9wzvibc5_5LGVdfAGlImiQ&redir=https%3A%2F%2Fcm.g.double...
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJIfD0eDWyZIRdH5q7QD4M0hpSceyRPxTepvaCe4T5gjrAgKBeRCuhg3gm9wAgcOfQV_3dLP9wzvibc5_5LGVdfAGlImiQ&google_hm=
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJIfD0eDWyZIRdH5q7QD4M0hpSceyRPxTepvaCe4T5gjrAgKBeRCuhg3gm9wAgcOfQV_3dLP9wzvibc5_5LGVdfAGlImiQ&google_hm=
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:48 GMT
server
Tengine
etag
OPTOUT
content-type
text/html
location
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJIfD0eDWyZIRdH5q7QD4M0hpSceyRPxTepvaCe4T5gjrAgKBeRCuhg3gm9wAgcOfQV_3dLP9wzvibc5_5LGVdfAGlImiQ&google_hm=
cache-control
no-store, no-cache, must-revalidate
expires
0
attr
cm.g.doubleclick.net/pixel/ Frame C804 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KWUJbgBywpt3g-sGHbTRP4UFH-hkvw6BaKcOJjk1kPDn-GyeJrYUvLXeBm9a4f5yyyvQO-
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 8247 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
47129
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 25 Apr 2022 11:28:19 GMT
expires
Tue, 25 Apr 2023 11:28:19 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
main.gr.19.8.305.js
static.adsafeprotected.com/ Frame 9375 		189 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/main.gr.19.8.305.js
Requested by
Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/996673/61756187/skeleton.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:5a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bad0b93d7fba2cfc878063b90eb88bcf9e3afb6f589d054d644f64200bea1598

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 21:16:44 GMT
content-encoding
gzip
age
11825
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Mon, 25 Apr 2022 10:51:50 GMT
server
AmazonS3
etag
W/"2d2026daa28487f27683d9d0319a98d6"
vary
Accept-Encoding
x-amz-version-id
MfTbLwitobAJFLHQOZB9ZusWTg66SLKu
via
1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
FRA50-C1
content-type
application/javascript
x-amz-cf-id
Tq9Cu_ciwZauiKUhXz1QLjeAxVru5NXZNkiwnrsBjDF2LK235ffOmg==
LOnNfct_OK6AKwq7GByGz0_K8O7BrCXN6Fs6Py5gnPc.js
pagead2.googlesyndication.com/bg/ Frame 8247 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/LOnNfct_OK6AKwq7GByGz0_K8O7BrCXN6Fs6Py5gnPc.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2ce9cd7dcb7f38ae802b0abb181c86cf4fcaf0eec1ac25cde85b3a3f2e609cf7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 09:08:20 GMT
content-encoding
br
x-content-type-options
nosniff
age
55528
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13636
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 11:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Apr 2023 09:08:20 GMT
style.css
s0.2mdn.net/10176755/1628770975891/stylesheets/ Frame 749B 		3 KB
811 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
757600e815b9ad3a942248d793becdf185f82abd8082097f90f96c9bc2579889
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:20:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4376
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
785
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:20:52 GMT
TweenMax.min.js
cdnjs.cloudflare.com/ajax/libs/gsap/1.20.4/ Frame 749B 		113 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/gsap/1.20.4/TweenMax.min.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ba1b9960f6bcc2d49080931ddd405a8fda579f905c7094d567d2b5823ae7970
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:48 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1661696
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
33534
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:10:25 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e71-1c274"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D3MrJK%2B7o5e4WOftBQiu3JuiFiKvnFJMPXa651J11XXKrVUIgL60n2X21DrVyeh7H3HJfdOHnVsG4%2BnGNPTpwojGCHz8yiHOEDmNBwoXdTgInA2Y6ydUxnWV6pnydcoor%2BnrTU0RTseON10MhKIHb2ON"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
701b3aa919d35c8c-FRA
expires
Sun, 16 Apr 2023 00:33:48 GMT
main.js
s0.2mdn.net/10176755/1628770975891/javascripts/ Frame 749B 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/10176755/1628770975891/javascripts/main.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
70d4b41fde62741a53e831c8a1cd97653a33834cca37017f6dc8e89d3579ee59
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:20:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4376
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1081
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:20:52 GMT
bg.jpg
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		137 KB
137 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/bg.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6122d435ed5dcf3bab4bf1c496f235953110d2ebc8afe241a3f502df91789e29
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:20:53 GMT
x-content-type-options
nosniff
age
4376
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
139928
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:20:53 GMT
push0.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/push0.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2186ed68a17f866f4d1884432650e03b1de65a96afa834e41a8ae9f5ba88cbe5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:20:54 GMT
x-content-type-options
nosniff
age
4375
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1719
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:20:54 GMT
push1.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/push1.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d6008724234574a34faf904692233f76652f1140c12d7ec0318791d66ccb4bed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:20:55 GMT
x-content-type-options
nosniff
age
4374
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1785
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:20:55 GMT
bg1b.jpg
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		100 KB
100 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/bg1b.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d4692b534405e7bfa214d6f0be637cb40e30b3ea901ef4de38ed154c69cc059b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:20:55 GMT
x-content-type-options
nosniff
age
4374
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
102711
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:55 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:20:55 GMT
push2.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/push2.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5539bbe3dfff73a6703e349f1b0b346a07db00cd21383666122abe6247d22a54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:20:55 GMT
x-content-type-options
nosniff
age
4374
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1976
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:20:55 GMT
logo_intro.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/logo_intro.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3f7f6a3c412122cc784df3b9e13581632f8a5e53c2105009320c94d886f378e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:20:57 GMT
x-content-type-options
nosniff
age
4372
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18261
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:20:57 GMT
bg2.jpg
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		60 KB
60 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/bg2.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7a3321061bf3a48a5649e0ea1a8e264ae5aa08d2da0bd8f62ba2fa34c8e0487a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:20:57 GMT
x-content-type-options
nosniff
age
4372
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
61834
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:20:57 GMT
bg2b.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		75 KB
75 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/bg2b.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8709b6dd40c3e036b2a786e68bd32bf809fe53b461c31f8aad0e0a65834c86e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:20:57 GMT
x-content-type-options
nosniff
age
4372
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
77089
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:20:57 GMT
push3.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/push3.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f24a6c91b2816f650c823fa79560f8746193dcce5921e3c7500c43d635e513bf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:20:58 GMT
x-content-type-options
nosniff
age
4371
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1877
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:20:58 GMT
bg3.jpg
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		199 KB
199 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/bg3.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
24e04dca645998f6060d40ab77cdf9b69de7cf5519a518aae6049d7faa7211f6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:20:58 GMT
x-content-type-options
nosniff
age
4371
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
203440
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:20:58 GMT
bg3b.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		108 KB
108 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/bg3b.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
91daae3b41b364005bf78fb77beb12c6f1298c76e6474f87478eb70240274b23
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:20:58 GMT
x-content-type-options
nosniff
age
4371
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
110625
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:20:58 GMT
push4.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/push4.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1549fa220c480885fdd21bc35c9c543b5270941e6b84dd5e8cfa8349d74451af
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:21:02 GMT
x-content-type-options
nosniff
age
4367
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2000
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:21:02 GMT
push6.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		985 B
1009 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/push6.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
db4bdf692ad81c7068c4443eaafbce183a24e03439f49665d0fc7154414c3af5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:21:03 GMT
x-content-type-options
nosniff
age
4366
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
985
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:21:03 GMT
push6b.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/push6b.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
83241f77efac1754623e5fb56e69a1b38ebff87cb3b6593b9709f0a8ed572af1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:21:04 GMT
x-content-type-options
nosniff
age
4365
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13360
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:55 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:21:04 GMT
push6c.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/push6c.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
160aa772761d237b0a086ed84ec204c340e6bb4dafe26d51dd606ee1fc35b7af
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:21:04 GMT
x-content-type-options
nosniff
age
4365
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1549
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:21:04 GMT
push6d.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		1016 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/push6d.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
115b2754daa5eead85949ded7f518b0c371fe94f9cc85744bd06552146bca9d2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:21:04 GMT
x-content-type-options
nosniff
age
4365
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1016
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:21:04 GMT
push7.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/push7.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2186ed68a17f866f4d1884432650e03b1de65a96afa834e41a8ae9f5ba88cbe5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:21:04 GMT
x-content-type-options
nosniff
age
4365
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1719
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:21:04 GMT
cta.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/cta.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8647f0ff2d3928b0dc28fce6b5f772165749bfec8ead2c88c661d785cea35ddc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:21:04 GMT
x-content-type-options
nosniff
age
4365
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1305
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:21:04 GMT
arrow.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		719 B
743 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/arrow.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
612b88bd6f51637617b7d4b2ceba1b8fceabe16a7b40bc9eaddafa8db86f0741
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:21:04 GMT
x-content-type-options
nosniff
age
4365
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
719
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:21:04 GMT
cta_hover.png
s0.2mdn.net/10176755/1628770975891/images/ Frame 749B 		99 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10176755/1628770975891/images/cta_hover.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae829f91c5894fabf92675d9ccf31d618cd5e4d9a518274c532a727d71e8b3ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/10176755/1628770975891/stylesheets/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 23:21:04 GMT
x-content-type-options
nosniff
age
4365
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
99
x-xss-protection
0
last-modified
Thu, 12 Aug 2021 12:22:56 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 23:21:04 GMT
skeleton.js
static.adsafeprotected.com/ Frame 9375
Redirect Chain
  • https://fw.adsafeprotected.com/rfw/st/996673/61756187/skeleton.js?adsafe_url=https%3A%2F%2Fwww.webtretho.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F2993e30136c7b1ed79535b87078eae94.safeframe.goo...
  • https://static.adsafeprotected.com/skeleton.js
17 B
464 B 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/skeleton.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Server
2600:9000:2156:5a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 15 Feb 2022 13:58:04 GMT
via
1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
age
5999746
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
content-length
17
last-modified
Mon, 17 Aug 2020 23:54:35 GMT
server
AmazonS3
etag
"53fab767ecbd3bf07990b10246befbd4"
x-amz-version-id
nylqTweorRThFHMBJSrf_fHcWx3KVKN3
cache-control
max-age=315360000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
psmY91yT3IFz7L2aeZcIDKxpsLTPwblTjzZdbhE4mwFsiHys4O5IdA==

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
x-server-name
app06.ie.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
location
https://static.adsafeprotected.com/skeleton.js
cache-control
no-cache
content-length
0
server
nginx
sca.17.5.12.js
static.adsafeprotected.com/ Frame FF67 		80 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/sca.17.5.12.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:5a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 15 Feb 2022 13:58:04 GMT
content-encoding
gzip
age
5999746
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Thu, 19 Aug 2021 16:31:24 GMT
server
AmazonS3
etag
W/"9304f57298c3834ff107ea7ccb547996"
vary
Accept-Encoding
x-amz-version-id
9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via
1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
FRA50-C1
content-type
application/javascript
x-amz-cf-id
uFFaQwPBKhdARUq9xxZy8FMdzGDfbSZ2VbYf2mZIinkwEvhPxQ2oEg==
dt
dt.adsafeprotected.com/ Frame 9375 		43 B
216 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=996673&asId=30b785ef-c92a-0ec9-f418-f7500c490bf0&tv=%7Bc:aQyXlZ,pingTime:-3,time:186,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:161%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:186,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:161,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B34~0%5D,as:%5B34~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:t44bA57+11%7C12%7C13%7C141%7C15%7C16*.996673-61756187%7C161%7C162%7C163%7C1641,idMap:16*,rmeas:1,rend:0,renddet:na%7D&br=c
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.92.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-203-92-83.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
x-server-name
dt02.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
dt
dt.adsafeprotected.com/ Frame 9375 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=996673&asId=30b785ef-c92a-0ec9-f418-f7500c490bf0&tv=%7Bc:aQyXm0,pingTime:-6,time:187,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:188,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:161,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B36~0%5D,as:%5B36~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:t44bA57+11%7C12%7C13%7C141%7C15%7C16*.996673-61756187%7C161%7C162%7C163%7C1641,idMap:16*,rmeas:1,rend:0,renddet:na%7D&tpiLookup=ao:www.webtretho.com*&br=c
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.92.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-203-92-83.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
x-server-name
dt05.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
view
googleads4.g.doubleclick.net/pcs/ Frame 9375 		0
26 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuQX9NH0QiABar2U2zo_2CM3LGqAYSW2VVwikGBjqzM62_9xSQSdnHGVI4cdRFx-YufTPzSA4fwh49V6o8vBmt-vlJMHYBaqjgL2oukH9e9WKXdzpgtthvFLGbJwrf4lEWb12b-si9YJawbjKFQLBXdLPXKFvUwh7cBHzCHhck0HXzQm2iHN-CdhoCDj_Z1-Q1mdlyomlcXBROWGzHhQHDvMgLFUk5kp_PAi2wEsDEvHrR0uYPhyFvGOrvvZY_l6OM1ZRWNVOBLY-ncHJXZfcZbN5rUQaJHRZeQbgjCzYuxuVvoxVZ5EztKB0bs-HqEdmpbQv4fSoMMzdnbnaW1_keLljRhBrKwb44NmIsTYevjrI9Tmw1kqbLkuXrTlgUXJ_njj1Y5JoLAMqd7pk8Be8t_ihoGsXQ2yvpz1A5qn2afy6Mxze8t693pItkCFkzUMFeaSnLmnLM735gf4iAhCevSbQMPCw7isi0VQqbM5Ot6oCSXHdxZGjxkkYMEsLubN76s-65_MaU2UJsfH8NEwspwCghoCAqPFbQjFhFK44x1uVbrU1lppPfyQ643rD_BtUqLvuQRlUD9pBzef3iK3sT6THVNxXre-M-jraKZwmg37_I4LnyI1kWQXflbZuFxdm2iWttXF_X4w9oE8KEcyYis6e2yqL4uT28GRt1Mj4lz4_zOVKWN0dg9yG3evj3wUxTLeLb7Ih6Js01WvJTx1eQzCPprA1qFPjYx6ZRLXm4a-o3QNq5r06SvN7yrkXTo1c_Wjb1FHn1adSkkOD0RZznMAISGxDCNpB-Osa0axCS1qsDQe5p0g2kMWufb_blxHAG_MsBfkwPRmUy579bY8Tzy8EkdpdXsBzO5e8ejZOwRp7JnFVmye3YWUFbw6QJeX7wCtuQxURKvUrU-8zM9_klaLOS2Z86StWl3N98uTu5BTD34KB-Ln2GFxxXtdcInYByVkBAh8mKZRcYmnvD1vrLclKMmSIkv174iIx_5x5BEev4pjS5Tepw6fQYkI2zDLrYMLLX0pLBMwcGmLublekGNS1S_AtvdUKdZQ7Ycsbn3aaWt6FWBJ3ghph4rPhCxdj1gSJ-6DMRPDn8RcOkFEGogN8gx8b0TW8AulAxkCnDLLYYS6r0sv60XA7Yv-EZzSNtuKev-EXek3NkIr_K2uJWVoZZ1-YYvyGD__nlu59HeGhMebwwNNi-Lyc_T68xYYfThik8MQ3YtDrsi0nNi5M-4&sai=AMfl-YTi1B-d_l93CyxKsi-L5xj6ZyAIYeONXV5mW41vVpI8Eb5lUJwwazKqAsLxoPnKNYkRicD-oBsEM5jg1axJYA1a1S3w3xk0uOGSRXzTavMP4KmD91BdWbYjy_r_OGDie9dk2dCeJzsiMCfDQKOvD8cDeViDPqF2PD6ZmHxkiJUhb30Ps_0-jCsxdCWpgugjK3-unLOIyWf9f-xQtq7bfuOU&sig=Cg0ArKJSzP_8AjgySR42EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=341&vt=11&dtpt=233&dett=3&cstd=106&cisv=r20220421.76836&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 26 Apr 2022 00:33:49 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
dt
dt.adsafeprotected.com/ Frame 9375 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=996673&asId=30b785ef-c92a-0ec9-f418-f7500c490bf0&tv=%7Bc:aQyXms,pingTime:-2,time:215,type:a,im:%7Bsf:0,pci:%7Btdr:55%7D,pom:1,prf:%7BbdA:244,bdZ:376,beA:378,beZ:379,mfA:525,cmA:527,inA:528,inZ:532,prA:532,prZ:536,si:540,poA:541,poZ:552,cmZ:552,mfZ:552,loA:565,loZ:568,ltA:593,ltZ:593%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:160.600,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:161%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:215,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:161,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B63~0%5D,as:%5B63~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:t44bA57+11%7C12%7C13%7C141%7C15%7C16*.996673-61756187%7C161%7C162%7C163%7C1641,idMap:16*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,sinceFw:52,readyFired:true%7D&br=c
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.92.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-203-92-83.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
x-server-name
dt03.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
gen_204
pagead2.googlesyndication.com/pagead/ Frame 8247 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BwVIg7D1nYujMKcn-7_UPgauDSAAAAAA4AeAEAg&bg=!t7SltPDNAAYXWUUuN1k7ACkAdvg8Wl0GnoKrtbYigg8DjjoTtS9imzsVafK71xmtlTzPFoMZ-sFvnQIAAADQUgAAAAJoAQeZAtt97IVNJ1CYKrE6ERmcGCUs-kwnu5MFrskR_gzL8T6xSdYYTu4L0wwFHftaUzdFcpLzeCYbRE8S9wFcZhrSelJn6IXZ29gSl2BUbU6A2Jyb6JD6sDrGg68zJGsBbASLKp1ggUhTyuExdv6HxSnKuhSJ-G1ttFNFhnCCJdmRNn4Cd5PyNzPZ8oZDMh6fAtYaMnp7PEsV07emnuTHVdPoGIXzeKau3HK-RF-cTZC-a6fUsTFCpsPerhH-yvotyK5PRaAQchI-X4SoeJN9l89OO9ukBKEpGgbhNuFsmealUi68k7CiVGM3TTkF01Z_-uX7bMWte7IcKe5N3D550juMsUFjg5MqP3cn1tgi3yGGbknCAM7Dm_PA_e3WYQkpn8QmbN-lruzPqR1PU9juAwrCPm9kBEtADPgJmUJ4qP3hG6rzIvXL0ludfEE34kH6zKpVVpg-GP8a_AdAuzLJqnCPbUb20EwOiRQv05B1xZs0oUgVbPEexSaIWkFdUf6RSTuWJ6AWmFivaXZeV9gyggjOE0Qhx1bg3TpuRmqNbqK2da0G3LiLqIZRZOI7XlSawbCGRQIjFXag3BpkwOiNoQqflX4L7l_LM7Yl7S5skxHA_PWNRdpuF2-GuUiLu-ChuMteIfLl812KkqOxcyXzqo4xbOB3GFqRRR9HBMr5eB8gYTInWICeZdC-3H8RH1tQtd30485ASVjcrGR5rRMvvvmjX8xJ3LDvSRnCTKkWvtDCM_kARSkyXK-nV9X7PXzxwmJPU3YlzhA4a-E9pN6uX5_dAhEEB1dJetEECsMmSL_YiP5stqIIX0tAeaJW6AIlLk5u7VU8TUD87c7bQ2OPXErA95nc_io-4dgQ9YMyJNw2TQp8QyFR7NjYOnHBvaB4y9MfiXuRA8dsOjqhsZUOnmAGh3NgH_w14kvK_FE2kqjB47ODd62VBvvL24W0mmpjUBpuOBJAPYTo5RxamwquJA
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dt
dt.adsafeprotected.com/ Frame 9375 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=996673&asId=30b785ef-c92a-0ec9-f418-f7500c490bf0&tv=%7Bc:aQyXnA,time:285,type:e,im:%7Bimprf:%7Bttecl:363,ecd:62,tsecr:5%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:69,o:216,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:161,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B64~0%5D,as:%5B64~160.600%5D%7D%7D,%7Bsl:i,t:216,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B69~100%5D,as:%5B69~160.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:t44bA57+11%7C12%7C13%7C141%7C15%7C16*.996673-61756187%7C161%7C162%7C163%7C1641,idMap:16*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf%7D&br=c
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.92.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-203-92-83.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
x-server-name
dt06.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
dt
dt.adsafeprotected.com/ Frame 9375 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=996673&asId=30b785ef-c92a-0ec9-f418-f7500c490bf0&tv=%7Bc:aQyXrk,pingTime:-10,time:517,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMDAuMC40ODk2LjEyNyBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1650933229433%7C%7C5a42bf09c4021d4d9cac1a599bf7e10e%7C%7C09af53e829b1687c5db16483617c3ced%7C%7Cceac7094a2df1d99e8fa4daf3db943c6%7C%7Cc10d25ede146e3b68e2fc3e2aadab91b%7C%7Ca7e7658c4bd6a7c0c597f603f9196427%7C%7C340be0fa99609baf35296129a6516def%7C%7C58f237dc48fa013906dbde8ecd92a614%7C%7C1629390669%7D
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.92.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-203-92-83.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
x-server-name
dt05.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
container.html
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A662 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.webtretho.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, immutable, max-age=31536000
content-encoding
gzip
content-length
3108
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 00:33:48 GMT
expires
Wed, 26 Apr 2023 00:33:48 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
css
fonts.googleapis.com/ Frame A662 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e88adda18aa09bcb1b6747436882f40a0074574df0ca4bc130779bb440e19d9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 00:19:11 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 26 Apr 2022 00:33:49 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 26 Apr 2022 00:33:49 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame A662 		2 KB
904 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:18:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
943
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
877
x-xss-protection
0
server
cafe
etag
13035868154101442325
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:18:06 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame A662 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CXYjW7D1nYuyQH4ny3wPtmKCwD8z4sOhp26DTuPQP_9Df_40wEAEg6IDAGGCVuviBlAegAYyhifECyAEJqQJxTZNWbypyPuACAKgDAcgDywSqBNcCT9BrJO7RiLQK99EEA8PAvT4dBGqKNAWAzMF3HJvYjRnvMqbByPcNoRfX40U_zl_6VCu9WgAgNvMTLnQ4H6aKAUwQTuXQwO0kG1dJbf7PmPxu17sVVorV4PQBr2EpglGhE3G_3EBh8YzqJgm_KpqRBaJ3Y1VpBG20ydbuZLa4oKC36KmG5CrTel15H5P0FPN_fUUEQiGU_djRVUfYIKRPfgZoQAdaEAf_HpHBWRKRecgDPNOYGT4BiHMQLU5zvYlvbX93PSt53sZiElS4Bb_jAXbxituKGUwyzhwWCPpz_hKKETGc28tPS_ei5nU1MZ7KXWe_Ebs0BQOMnkdKhq_pakzHrH0a2lYDqhDjHEm0XEt0Wo-aqh-B5gK7W27os1wcgBb4DCdfjRm8TvFWHxkucLfzhG56soEH_rGK5uSRIX7HDiAMa_Lo-1_dzqO3vyuOp8sYXWtC6sAEotn8megD4AQBkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBi6AB6uU4aUCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgHpr4b2AcA8gcEEJSEG9IICQiA4YAQEAEYHYAKAcgLAdgTC9AVAYAXAbIXHgocCAASFHB1Yi03MDM3MzQxMzM1NzQ5MzY0GPDBEw&sigh=GDs6L11r0LI&uach_m=[UACH]&template_id=494
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/ Frame A662 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/abg_lite_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a7d5c1bfe43c8beefab2fa059f4fcaa029fcbbace9a672aae1dfe1ffb7d6976c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:30:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
215
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8002
x-xss-protection
0
server
cafe
etag
5332015062585099865
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:30:14 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame A662 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/window_focus_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:32:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
87
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1359
x-xss-protection
0
server
cafe
etag
1484984001845508991
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:32:22 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame A662 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36950
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1650454428054601"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 26 Apr 2022 00:33:49 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame A662 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:32:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
69
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6409
x-xss-protection
0
server
cafe
etag
15284592792851369840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:32:40 GMT
l
www.google.com/ads/measurement/ Frame A662 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSeGX4HKTMOIlu0zkDW1-CTvvqkpuokwUXp1WMI1sr9wB_3opDQmYPe-mPneSq5-gibnF6FEPSP4Yc0xXHwdimrHB9q8A
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers
3bde1d5944145a46a8b91d920db5ec4d.js
www.gstatic.com/mysidia/ Frame A662 		30 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/3bde1d5944145a46a8b91d920db5ec4d.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f748110cf8280254c6705d7cf18de8b04369c521d9db43e63897e531c283578d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 05:46:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
67646
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12194
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 05:04:18 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="mysidia"
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Sun, 24 Jul 2022 05:46:23 GMT
shopping
encrypted-tbn0.gstatic.com/ Frame A662 		19 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcQSPtPIj65Cgu4WXIZX8X9ntH9fUJ4VonGeiq-W2Ke7MJPPxxuz&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4e8db1932af0e6814282eea5fa648e4b93a624552f0378ded0a9185afc5a8e33
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 06:43:05 GMT
x-content-type-options
nosniff
age
237044
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19548
x-xss-protection
0
last-modified
Sat, 02 Apr 2022 02:23:15 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Sun, 23 Apr 2023 06:43:05 GMT
shopping
encrypted-tbn0.gstatic.com/ Frame A662 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcRC-u-M5FSlVWjb6B1zKp82f4PVL3y0X_Yb-q1Pug-naYbvrcywh8Vt43enWw&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d2db0694e2252c598366268aa659c4d208877fea3c39ca91bb0c2e0256c670e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 16:10:12 GMT
x-content-type-options
nosniff
age
462217
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
25092
x-xss-protection
0
last-modified
Wed, 02 Mar 2022 02:51:16 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Thu, 20 Apr 2023 16:10:12 GMT
shopping
encrypted-tbn1.gstatic.com/ Frame A662 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcSVZ-p0A0iFKSKpmD83rm9Cw7kgMkj6AGJ8LgKy1yQ3t-hNnsMMcFtw6deu4pw&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2acbdd60750bf5186309b359e5dcf4105e53d3769441bce536b609cbc8052f51
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 16:04:55 GMT
x-content-type-options
nosniff
age
462534
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8330
x-xss-protection
0
last-modified
Wed, 02 Mar 2022 02:48:39 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Thu, 20 Apr 2023 16:04:55 GMT
shopping
encrypted-tbn1.gstatic.com/ Frame A662 		32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcQCQvAjMuOwmkjNQJwE0FTLWSe7uIAy5ubJk0Vbj6zIInibdLQxdnjmow1eCNc&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ee01483c763fcc1cee90cde3b33ea8e87be3991511d37534290907c2ff5b2db0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 08:10:09 GMT
x-content-type-options
nosniff
age
231820
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32645
x-xss-protection
0
last-modified
Mon, 04 Apr 2022 02:03:27 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Sun, 23 Apr 2023 08:10:09 GMT
shopping
encrypted-tbn0.gstatic.com/ Frame A662 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcSvjQRWhXLZaVcE8FJlJVmpKA_31w4Ly27WoInzwlalAK05pof2&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f47a1b67dfd6b5ddaaaa0febde7acf2fb9a16f0c3e0d6ba612a82135cb790b80
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sun, 24 Apr 2022 12:50:23 GMT
x-content-type-options
nosniff
age
128606
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12325
x-xss-protection
0
last-modified
Wed, 02 Mar 2022 03:46:40 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Mon, 24 Apr 2023 12:50:23 GMT
shopping
encrypted-tbn0.gstatic.com/ Frame A662 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcRmc46bFO4A3ZHtW5SD0HvCwov3c_D5PUqrLXFahxVF2SKU0u2p&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
72d464ebd30fb3325ecedd2bca4b5565d60c11b8e0737bbb070dcce56874e7ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 16:01:19 GMT
x-content-type-options
nosniff
age
462750
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10019
x-xss-protection
0
last-modified
Wed, 20 Apr 2022 03:57:34 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Thu, 20 Apr 2023 16:01:19 GMT
shopping
encrypted-tbn1.gstatic.com/ Frame A662 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcQyDJVMcrIpou6J2WyCADFGYP11IViUUAPohc3VnpAoldbe6cSbCCS9WZ2EKQ&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6738250294e9e45166c759ac86bd0ae0f45990d418e2cca3beca405a28528089
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sun, 24 Apr 2022 18:12:40 GMT
x-content-type-options
nosniff
age
109269
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19083
x-xss-protection
0
last-modified
Sun, 10 Apr 2022 02:10:51 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Mon, 24 Apr 2023 18:12:40 GMT
shopping
encrypted-tbn3.gstatic.com/ Frame A662 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcQdLXiwt-hDixxw86OHbcryGsr_5aROW7x6qTq6wWETWmEm1XBw-rCDI1eaM0w&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bc2503bbfee2360c71c3305513d389795dd576960d962c78a85cdceef7d03732
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 19:35:39 GMT
x-content-type-options
nosniff
age
17890
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16063
x-xss-protection
0
last-modified
Thu, 24 Mar 2022 03:14:30 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Tue, 25 Apr 2023 19:35:39 GMT
shopping
encrypted-tbn1.gstatic.com/ Frame A662 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcQtjHpn0SPzvGKWdDCnURMarFoaZg77sQ0FB5CMrAbDgKVlsjsb8Gt2YSSdfZ4&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
db4dcb0e61cb376e3875e18c4a2ecd03ddc625f83928b6cda311c7039ea0f7ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Fri, 22 Apr 2022 05:35:00 GMT
x-content-type-options
nosniff
age
327529
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31589
x-xss-protection
0
last-modified
Fri, 08 Apr 2022 01:39:45 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Sat, 22 Apr 2023 05:35:00 GMT
shopping
encrypted-tbn1.gstatic.com/ Frame A662 		42 KB
42 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcQlr1eF5aIY0USTNZ6KBHne9dYQvPBkPshmmBo8u0d5qJmv973oX10R1yyUYQ&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4bf9a1ab87e2efb3f94f90e23b4b6b4ce2ccafd67eca1c0ae48ff2e6e8758b6d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 12:55:49 GMT
x-content-type-options
nosniff
age
41880
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43330
x-xss-protection
0
last-modified
Tue, 01 Mar 2022 02:21:52 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Tue, 25 Apr 2023 12:55:49 GMT
shopping
encrypted-tbn0.gstatic.com/ Frame A662 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcTsKrPEhukq6bD_CURt6qSrZF-CU-QIUY4Ji9Z60NTdVPsrUMg&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7a9a7ca080dfdd54223b6f65bca630e5fa23b5ed2bc32d5e88ec7e86dd4c413a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 19 Apr 2022 18:53:19 GMT
x-content-type-options
nosniff
age
538830
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22272
x-xss-protection
0
last-modified
Wed, 02 Feb 2022 11:14:04 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Wed, 19 Apr 2023 18:53:19 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 0FFB 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
67205
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
gzip
content-length
724
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 25 Apr 2022 05:53:44 GMT
etag
48472445140208031
expires
Tue, 26 Apr 2022 05:53:44 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
container.html
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7F25 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.webtretho.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, immutable, max-age=31536000
content-encoding
gzip
content-length
3108
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 00:33:48 GMT
expires
Wed, 26 Apr 2023 00:33:48 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame A662 		217 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
00f7654133040a87c630e83aa947a799b488aa40bae0fa441e136b10ef7b373e

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/png
dpixel
cms.quantserve.com/ Frame 0FFB 		35 B
464 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDYxgpu_ZQS4A0Z9batlGkE&google_cver=1&google_push=AYg5qPI6m-XEGyQojj7oTtS_PgBsfuD_fgwpad4RXBYW5VKEm9_u6QrONljinohfCKmtd4m6wRr9nBOKyZYezJyaTWe0PyAsfcE
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:36a9:ecb:e518:b308 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 0FFB
Redirect Chain
  • https://d.agkn.com/pixel/2175/?google_gid=CAESEN02drEg6nttjhpYvu4HPTo&google_cver=1&google_push=AYg5qPJFtLxA5ZG82g5Przo-fxeF3-ASmbMEoZ0Yko7Ho0aVf2ecoohcxnOU1-VKtBpDaYffBL6in0KRsYQVebCPgDo6k0KEc6Y
  • https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJFtLxA5ZG82g5Przo-fxeF3-ASmbMEoZ0Yko7Ho0aVf2ecoohcxnOU1-VKtBpDaYffBL6in0KRsYQVebCPgDo6k0KEc6Y&google_hm=Q0FFU0VOMDJkckVnNm50dG...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJFtLxA5ZG82g5Przo-fxeF3-ASmbMEoZ0Yko7Ho0aVf2ecoohcxnOU1-VKtBpDaYffBL6in0KRsYQVebCPgDo6k0KEc6Y&google_hm=Q0FFU0VOMDJkckVnNm50dGpocFl2dTRIUFRv
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 26 Apr 2022 00:33:48 GMT
Server
Apache-Coyote/1.1
P3P
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJFtLxA5ZG82g5Przo-fxeF3-ASmbMEoZ0Yko7Ho0aVf2ecoohcxnOU1-VKtBpDaYffBL6in0KRsYQVebCPgDo6k0KEc6Y&google_hm=Q0FFU0VOMDJkckVnNm50dGpocFl2dTRIUFRv
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Sat, 01 Jan 2000 00:00:00 GMT
dds
rtb.openx.net/sync/ Frame 0FFB 		43 B
351 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.openx.net/sync/dds?google_gid=CAESELJs0yjRhLZ0jtUcLlOtgxw&google_cver=1&google_push=AYg5qPKBxq-nMDze-liyjCkgnavFP-Z8YbmPSxCGyQCysyHOP5DnUFKaoLi1UQGBS1_ZQ_FnqrjfLtnz4Yn35C6tRRW6u-fmtS4
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.253.211 -, , ASN (),
Reverse DNS
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
b6cmjt3u0uskj9abgj60uaapoqp2p1bk
pixel
cm.g.doubleclick.net/ Frame 0FFB
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tondlXX_S-Ch1zMmoCuAPQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tondlXX_S-Ch1zMmoCuAPQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJgdxRHWxgIf9ogCrMDut-DTpMe1MTg4j2v08RaNUaWm_70vK06SwmgJ7CS3Q81rFLrdLiXagEeMsWC_NYQsSGIuTyrwa8
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tondlXX_S-Ch1zMmoCuAPQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJgdxRHWxgIf9ogCrMDut-DTpMe1MTg4j2v08RaNUaWm_70vK06SwmgJ7CS3Q81rFLrdLiXagEeMsWC_NYQsSGIuTyrwa8
date
Tue, 26 Apr 2022 00:33:48 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame 0FFB
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENJ-oklFtMuU6MnmOaEv-qQ&google_cver=1&google_push=AYg5qPIDCsmouvvtDctop9tGNC0aEmzSy6WIu36AxSdfdJE0FXNP_krvsvvwC6Y3ZSyrgA9ULUf...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDJGRjBPVjEtMVMtQ0g0MQ==&google_push=AYg5qPIDCsmouvvtDctop9tGNC0aEmzSy6WIu36AxSdfdJE0FXNP_krvsvvwC6Y3ZSyrgA9ULUfDgNIbo0lmyI-T4-vTsOyKoQc
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDJGRjBPVjEtMVMtQ0g0MQ==&google_push=AYg5qPIDCsmouvvtDctop9tGNC0aEmzSy6WIu36AxSdfdJE0FXNP_krvsvvwC6Y3ZSyrgA9ULUfDgNIbo0lmyI-T4-vTsOyKoQc
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDJGRjBPVjEtMVMtQ0g0MQ==&google_push=AYg5qPIDCsmouvvtDctop9tGNC0aEmzSy6WIu36AxSdfdJE0FXNP_krvsvvwC6Y3ZSyrgA9ULUfDgNIbo0lmyI-T4-vTsOyKoQc
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Expires
0
pixel
cm.g.doubleclick.net/ Frame 0FFB
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAoy78I562__h2XCjmaH0mM&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j...
0
0
googleredir
googlecm.hit.gemius.pl/ Frame 0FFB 		0
0
attr
cm.g.doubleclick.net/pixel/ Frame 0FFB 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JeD1goNlrcknf959HRWYmaIU580Q2S_HtRbp52HMm6Uk9VslNByGf8Zd1-5yOSBbtqPa5gxw
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:49 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
pixel
googleads.g.doubleclick.net/xbbe/ Frame 0268 		624 B
297 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYyeb4xgEwAQ&v=APEucNWCenc2ROjG5Zr6tlSlt6Wy77VcDKqzAdfWCNe_uQ2xMb8Fo-E1UXtxQtIRrjgU66h6Q-CPRxrIzwTPp3Ni2RqXiWULzqh3AgqA3RXcMdgGeyYYH1DshoOtY1nEUHB_RJCOMoY3X8DA9NaxuDPPnObmq4Dy4CMntQ2qux6ZlMUAO29kqZY
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
gzip
content-length
276
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 00:33:49 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
ad
googleads.g.doubleclick.net/dbm/ Frame 7F25 		81 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C6alkHkRT5QbDqvzBLHOhYHVfyBh7CII71NEzAroXlTvWXo5GxEEZYcEkp3c6AWBYGEKWLB7AKGZAqSSmiCkY3zXFBllTe9P3cZpXGp2HTn2lwxT6BtbkX-4ZLygFrNtijg5PhmwDlAKFULbWhZtPhXc3ffA&dbm_d=AKAmf-CZcmBUr0Y-V0TUyLAb3JR_T15ul-pfFTj1zDMNCGLmB7ESNEoZ0ujCMRK_0DzEGU3bTRJlW9GuUMeEhqhvlys_wOwwQHf9HGFX7FuvAt1PpysT1if0mO3Ogk1OeahXhkNq_DZS6vXu-pvcbzoLTaepkui1bugaVgbrIPXNG1vEgOQrVI9sdXEsHaoJD08mKYV8EaTFJuzkZebQuJuUpFzYYyJz078WN9AUFYnhnCqEHxx1Xzjs5MTBYqWiqjGKpCKpiUQ0wEMelDaOOMOadzU9DOmyZxeehpStfFxtRHRoBAHiYkyLeV81BUpT5mjUAZVG5GpYUfz-FmY5yEz1glSVvnzF70WaQ2SfccG5RL8ZWk-ZM_LoDXZrHg9Gw2dk9icbdG-LOtJc8IEsKX6C65LxAqHD7a980zXbBe3hNyaPn_9ateHGH2aMO_CrJ-Pfs16yPpP2sem0rNCLJYsZJfLolmC7GjhFBBzLaKvmYZ-RofxrPofLOCH-zfwqBt-Puxa1K0Wa32aRhJxQXDZ9dB8UHmeArmEqBM5QfGaa9v7dq6j0I5i_KlyZ9JGmxRdXTucLZegDNJzpWgDO6lQQhIgylXeYxyH09A-k6I3cn3mD54HRPaUqe6vEvmYa7dPq3OpxVeIgDwxoNlyHk02zW91U-MjmzA9IaGHfkSsUvGQ0nB7QZhBFsCanEjOS7qvBGQrDoXbCiycV01sMMScYfaZU3lwGGIvocez_EEPibhkWahFLRkaPuAqkdohpBUBZQKDSfzBALk279eN7ilFIoXhWXmIPDMJkUvkD7ux-PbMh3YeQnDQK_L9sCDiWyvYayxDVguta2zTtZ6KFoebt92hokYN2SrggQf8zxX8HS2D7KcR-Za6NT_hIeR3ee1I3Dtw4YoR80ayR6pvyp3emlwyRSfp6qI4XI1YQ0lgYwpX9AlHLMVME2UJnL0tb9eG8NQFiYzUlY8O4zU_3bkAJev46OOaOKG0w6nAqYx73tN5eRU22B0BdKwduVHngrKTCFuJdQeKTsQBVCSK9P7QLi7cEcJ89l0cKoskE4du1x60IJwP5et0n8eVtM2fIBQSAnH4YVGGG1cLKfYj9a_qB60q8rp6KR0IyUtVxVEujkfmdn_s80IyQ5FtnbJTAdw6QOwUBZA4OXpSPL4d7E5fok9bT0mK4YDliecj1JI41DDgiDBhOKII37bBpGGzXooBPQHwbQ6fVl-nKm4w9RCguJac9syWOwlxnIwoNTt0XEERONx2K2aUwGmHz9b_qlOUGIa_yDzGrbREDdhNmFsKDah8oX1ipbyTAbrH5z9vCSCje5PuyYTSO0SPoyXec7Hj2tZ_CAtdid-lpOef1UK_1SqB9JYikms5LKafzSCjhk_thfoTxKOXjerZHuH4u-yFBXlJrtoawpglgqLHh_2PwUZpusxbdzelCeJy-EjX-ZyxP56wyvyRBC5CNlq1BykLBxW0DF_0LMAap7sG07MjZRTr22gLI4MTtDf-biqt1CXgh4tH_sJqb2nIc2go_8a9d37RBCG1iPlXLOlavMqiu51KzvELFImKMlIgoLtjGP_RpQMQ6-i1HgnNn2U1P58XHvLtilmlE-Cui7iHiGyRxL-0RqdtKFzEnes394DHRVUQqgr7irOOGSUFnTEtGhA1XQwUYVj_yD6tcFdGBnEMGZkkDb9YI_DL3AvBXEko2JMHesf0-hHcmubKcmoTzyNHJ_QGuRJK6y-RykLv_D9Bc2hJ3h88TxXU8yMR1jdhZh37RKZS8jKmsGCm2SiBKGINTG-sljDMVOxIF64lTOedTZvLmjvgTsrD-huLR5vwbp6j5gxdQcYJ214fsuntOukw9IqUDdJ1dO99vpRGzMNpC89jtyWrtGAP_ftEgcWjhZ0KrZ5HIv8CRL4E4DayS4sgVx7aiPojeohLny4yh4OTM0Gh8foZGBaTBN4V5bi9tS0iciWNlsS828V7dJtBAhYLU9TBqVtLdiGX9p1-j6Shfr_VfprWBXOH7o0RGKkpVq1-ARcugET6nysVERroQieTkRAR3Q6m0nrvSdAHNKlEyZ8zRN-WP-em35BQ0FrSKdZqjkR0ViZEyYGBXywpclHjST7g86q4ZszH1GvmZtWJj0aD4UTn7wJWvfrh6G3kbWIOpkjTljVmBPJWD-02jCqFDulhEAmRtGoeqElNkrr7fyFMLATZlJaqUKjPTaWNCy-RteOVDvFaalb4oCuRYy8svJ4o87gst9NHfdElMKVo_bJ1emzA1r8VxXen2n1AM1_hMdxx7m_RoFFU8c5l8iIQQTQEFaC5lfmeCuyb5Q3jkoSZ9UP1R9qJBjKCvj3J18Hgtvb-n2-42YmJp6RqwzAvRSqJ-JIXk8tNQ28f9P0ec12f6ope2VKUjAO-aB8mpVtfOqAGrW73t9MD85afVkkeaCRN_gqrXITI0IwBsyfTJzyntTHFguPOpvvr5QurCnFZ_RR1CmgAt3nrkJpPyRcwJZ66rKxZayKVKnJTHlO8pNOMoJMBlRaCRlse6fqzKObeBUa-M3qq0mRIrqXx8j6r28z-3r0FzXxjDzf7I34pYdnIKeHYV8Izaec6azbDtlVHteKFjCO77rqTQAz_EphvjTMgzBlONB7uqgy4-Y_EALtISJKWWq-3oVPOpzY9HUazsDljS7hRBkj_UrP78AvetiEVWbEdVHHX3xhrKsWBucTZtHe4psyQOpxJjVG34PMbK9Paf02qCUWF2ONcePAY6ryj1Kpy5QZIbdtdK2X97SE1gUQYRvNCNCBfZqZC1qJv9HpkO58ENnXFmw0BTdSLtQlrcX70KS2qxQukPiuWEu0dVi0-TnC-RmKCrbh8xWrhyEXTS6ubKle0WsRs3lLlxKWPJVY0gpslxB3mCTjmdNVFAFOgnHtdKd53WrTBoIoVDm2tkwwvo_uCr2SskdFSXs-ZCi-pfA2_G-AIoMvbdNetZbFLqgK2XqgqoFw0BZoLrEWaXO33WCbYYALNp9PHOoK-3hSfgsgwG686dkT09pksbJYJFDY0HxAC4AZd56G8DQw5X-8SHNCmOY7JVS493Ksz90440VOBcJUK4zY8I8Bo8rkYFG9WufCbzEaTSokWj2cIJmc7PAnoDPRdMXdfuzRdF4CCLVDYQ1GyCGYoiNGZyuA9tg4r2zb35zRFGj9o2-E3z6NmBqDdlNhcXulzl-joSB6V9CER_0mzKZ7LfZlHbejXBbn_rz2FVYgUfjUHm3F_7R3k4GtIrl5wAjscqYXzZE6DTaCK212yS1BbgA93_3nctTZ6a49u87Lwb6zTNBrgiKXbWIYwTRWy39JBosu8i-sq7hEH0klRKstLfFAsppqBYa2wEvtmku11KBN367wl2kB0nrs1MQ0Suk0Y2YSA2rQKDWuuqje46I3UFl7SpC_9d6Z8NCaZTytIxxZvIvNtleY-jV7k2XP2eQ9w1lbyOa7bKOA-shTNElk4mzdM7S5UNO5vayFkk-g93SYNq8BET_fJHGKiSfzqpahOk6YF5wTTGHCJ0AmcGLVpU9nF-2SaPw18BS5LP_k0_ZXfyKNYY3jWxyG6_jYTHDBFde_K9xtj7&cid=CAASJeRokDukzsSgMOVkL380IGEbY50kTFoAPgF4svkrlF6924L1s4g&rfl=1%2Chttps%253A%252F%252Fwww.webtretho.com%252F%240
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9ac7c0eac3a8542d01ac01f5bd9d404f426123a014b95fdb3761ef423bc2be70
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33584
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 7F25 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AHabHesT44iAZ6G69jvfuvgwC1nybreGDK_nt1Of48EyZTFIx6R1cp0uNwLhdMvB8dlC4fQfcqy-NSf_3iucUBfMUX3oVGDQe6XCu1r1jYuvStiBc
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame 7F25 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/window_focus_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:32:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
87
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1359
x-xss-protection
0
server
cafe
etag
1484984001845508991
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:32:22 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 7F25 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36950
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1650454428054601"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 26 Apr 2022 00:33:49 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame 7F25 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:32:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
69
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6409
x-xss-protection
0
server
cafe
etag
15284592792851369840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:32:40 GMT
ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v21/ Frame A662 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
acc5497e76f832d950d14fcfa047dc3c864f7a0aae4c7a20521c0c655a53033b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 19 Apr 2022 22:12:48 GMT
x-content-type-options
nosniff
age
526861
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20784
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:21:31 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Apr 2023 22:12:48 GMT
rum
dsum-sec.casalemedia.com/ Frame 0268
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBrYJ8Pfgi12qmXwiWDaiD0&google_cver=1
43 B
894 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBrYJ8Pfgi12qmXwiWDaiD0&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYyeb4xgEwAQ&v=APEucNWCenc2ROjG5Zr6tlSlt6Wy77VcDKqzAdfWCNe_uQ2xMb8Fo-E1UXtxQtIRrjgU66h6Q-CPRxrIzwTPp3Ni2RqXiWULzqh3AgqA3RXcMdgGeyYYH1DshoOtY1nEUHB_RJCOMoY3X8DA9NaxuDPPnObmq4Dy4CMntQ2qux6ZlMUAO29kqZY
Protocol
HTTP/1.1
Server
23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-236-247.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 26 Apr 2022 00:33:49 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 26 Apr 2022 00:33:49 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBrYJ8Pfgi12qmXwiWDaiD0&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 0268
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Ymc97LCLAgfB1LGNpxlCegAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBrYJ8Pfgi12qmXwiWDaiD0&google_cver=1
43 B
894 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBrYJ8Pfgi12qmXwiWDaiD0&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYyeb4xgEwAQ&v=APEucNWCenc2ROjG5Zr6tlSlt6Wy77VcDKqzAdfWCNe_uQ2xMb8Fo-E1UXtxQtIRrjgU66h6Q-CPRxrIzwTPp3Ni2RqXiWULzqh3AgqA3RXcMdgGeyYYH1DshoOtY1nEUHB_RJCOMoY3X8DA9NaxuDPPnObmq4Dy4CMntQ2qux6ZlMUAO29kqZY
Protocol
HTTP/1.1
Server
23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-236-247.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 26 Apr 2022 00:33:49 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 26 Apr 2022 00:33:49 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBrYJ8Pfgi12qmXwiWDaiD0&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
setuid
ib.adnxs.com/ Frame 0268
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEG2uH6XQHhGAX2f_oYlY-r0&google_cver=1
43 B
1020 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/setuid?entity=101&code=CAESEG2uH6XQHhGAX2f_oYlY-r0&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYyeb4xgEwAQ&v=APEucNWCenc2ROjG5Zr6tlSlt6Wy77VcDKqzAdfWCNe_uQ2xMb8Fo-E1UXtxQtIRrjgU66h6Q-CPRxrIzwTPp3Ni2RqXiWULzqh3AgqA3RXcMdgGeyYYH1DshoOtY1nEUHB_RJCOMoY3X8DA9NaxuDPPnObmq4Dy4CMntQ2qux6ZlMUAO29kqZY
Protocol
HTTP/1.1
Server
37.252.173.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 26 Apr 2022 00:33:49 GMT
X-Proxy-Origin
178.162.209.132; 178.162.209.132; 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
c6108fa5-5ceb-4bf1-962d-6fca455b42ae
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ib.adnxs.com/setuid?entity=101&code=CAESEG2uH6XQHhGAX2f_oYlY-r0&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
290
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 0268
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0OTY4ODAzMjEwMDM2OTE1MQ%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0OTY4ODAzMjEwMDM2OTE1MQ%3D%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYyeb4xgEwAQ&v=APEucNWCenc2ROjG5Zr6tlSlt6Wy77VcDKqzAdfWCNe_uQ2xMb8Fo-E1UXtxQtIRrjgU66h6Q-CPRxrIzwTPp3Ni2RqXiWULzqh3AgqA3RXcMdgGeyYYH1DshoOtY1nEUHB_RJCOMoY3X8DA9NaxuDPPnObmq4Dy4CMntQ2qux6ZlMUAO29kqZY
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 26 Apr 2022 00:33:49 GMT
X-Proxy-Origin
178.162.209.132; 178.162.209.132; 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
bb43fe43-bc3b-49c8-b328-9c5a65549b14
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ0OTY4ODAzMjEwMDM2OTE1MQ%3D%3D
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
JAPUMHT_zNnrVfwA4fX3UESFQekER8YYbnBYivkpjVo.js
pagead2.googlesyndication.com/bg/ Frame 6D0F 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/JAPUMHT_zNnrVfwA4fX3UESFQekER8YYbnBYivkpjVo.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2403d43074ffccd9eb55fc00e1f5f750448541e90447c6186e70588af9298d5a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 19:15:30 GMT
content-encoding
br
x-content-type-options
nosniff
age
19099
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13448
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 11:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Apr 2023 19:15:30 GMT
html_inpage_rendering_lib_200_275.js
s0.2mdn.net/879366/ Frame 7F25 		169 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Origin
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 08:05:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
59321
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
60173
x-xss-protection
0
last-modified
Mon, 27 Sep 2021 18:44:51 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 08:05:08 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20220421/r20110914/elements/html/ Frame 7F25 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20220421/r20110914/elements/html/omrhp.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C6alkHkRT5QbDqvzBLHOhYHVfyBh7CII71NEzAroXlTvWXo5GxEEZYcEkp3c6AWBYGEKWLB7AKGZAqSSmiCkY3zXFBllTe9P3cZpXGp2HTn2lwxT6BtbkX-4ZLygFrNtijg5PhmwDlAKFULbWhZtPhXc3ffA&dbm_d=AKAmf-CZcmBUr0Y-V0TUyLAb3JR_T15ul-pfFTj1zDMNCGLmB7ESNEoZ0ujCMRK_0DzEGU3bTRJlW9GuUMeEhqhvlys_wOwwQHf9HGFX7FuvAt1PpysT1if0mO3Ogk1OeahXhkNq_DZS6vXu-pvcbzoLTaepkui1bugaVgbrIPXNG1vEgOQrVI9sdXEsHaoJD08mKYV8EaTFJuzkZebQuJuUpFzYYyJz078WN9AUFYnhnCqEHxx1Xzjs5MTBYqWiqjGKpCKpiUQ0wEMelDaOOMOadzU9DOmyZxeehpStfFxtRHRoBAHiYkyLeV81BUpT5mjUAZVG5GpYUfz-FmY5yEz1glSVvnzF70WaQ2SfccG5RL8ZWk-ZM_LoDXZrHg9Gw2dk9icbdG-LOtJc8IEsKX6C65LxAqHD7a980zXbBe3hNyaPn_9ateHGH2aMO_CrJ-Pfs16yPpP2sem0rNCLJYsZJfLolmC7GjhFBBzLaKvmYZ-RofxrPofLOCH-zfwqBt-Puxa1K0Wa32aRhJxQXDZ9dB8UHmeArmEqBM5QfGaa9v7dq6j0I5i_KlyZ9JGmxRdXTucLZegDNJzpWgDO6lQQhIgylXeYxyH09A-k6I3cn3mD54HRPaUqe6vEvmYa7dPq3OpxVeIgDwxoNlyHk02zW91U-MjmzA9IaGHfkSsUvGQ0nB7QZhBFsCanEjOS7qvBGQrDoXbCiycV01sMMScYfaZU3lwGGIvocez_EEPibhkWahFLRkaPuAqkdohpBUBZQKDSfzBALk279eN7ilFIoXhWXmIPDMJkUvkD7ux-PbMh3YeQnDQK_L9sCDiWyvYayxDVguta2zTtZ6KFoebt92hokYN2SrggQf8zxX8HS2D7KcR-Za6NT_hIeR3ee1I3Dtw4YoR80ayR6pvyp3emlwyRSfp6qI4XI1YQ0lgYwpX9AlHLMVME2UJnL0tb9eG8NQFiYzUlY8O4zU_3bkAJev46OOaOKG0w6nAqYx73tN5eRU22B0BdKwduVHngrKTCFuJdQeKTsQBVCSK9P7QLi7cEcJ89l0cKoskE4du1x60IJwP5et0n8eVtM2fIBQSAnH4YVGGG1cLKfYj9a_qB60q8rp6KR0IyUtVxVEujkfmdn_s80IyQ5FtnbJTAdw6QOwUBZA4OXpSPL4d7E5fok9bT0mK4YDliecj1JI41DDgiDBhOKII37bBpGGzXooBPQHwbQ6fVl-nKm4w9RCguJac9syWOwlxnIwoNTt0XEERONx2K2aUwGmHz9b_qlOUGIa_yDzGrbREDdhNmFsKDah8oX1ipbyTAbrH5z9vCSCje5PuyYTSO0SPoyXec7Hj2tZ_CAtdid-lpOef1UK_1SqB9JYikms5LKafzSCjhk_thfoTxKOXjerZHuH4u-yFBXlJrtoawpglgqLHh_2PwUZpusxbdzelCeJy-EjX-ZyxP56wyvyRBC5CNlq1BykLBxW0DF_0LMAap7sG07MjZRTr22gLI4MTtDf-biqt1CXgh4tH_sJqb2nIc2go_8a9d37RBCG1iPlXLOlavMqiu51KzvELFImKMlIgoLtjGP_RpQMQ6-i1HgnNn2U1P58XHvLtilmlE-Cui7iHiGyRxL-0RqdtKFzEnes394DHRVUQqgr7irOOGSUFnTEtGhA1XQwUYVj_yD6tcFdGBnEMGZkkDb9YI_DL3AvBXEko2JMHesf0-hHcmubKcmoTzyNHJ_QGuRJK6y-RykLv_D9Bc2hJ3h88TxXU8yMR1jdhZh37RKZS8jKmsGCm2SiBKGINTG-sljDMVOxIF64lTOedTZvLmjvgTsrD-huLR5vwbp6j5gxdQcYJ214fsuntOukw9IqUDdJ1dO99vpRGzMNpC89jtyWrtGAP_ftEgcWjhZ0KrZ5HIv8CRL4E4DayS4sgVx7aiPojeohLny4yh4OTM0Gh8foZGBaTBN4V5bi9tS0iciWNlsS828V7dJtBAhYLU9TBqVtLdiGX9p1-j6Shfr_VfprWBXOH7o0RGKkpVq1-ARcugET6nysVERroQieTkRAR3Q6m0nrvSdAHNKlEyZ8zRN-WP-em35BQ0FrSKdZqjkR0ViZEyYGBXywpclHjST7g86q4ZszH1GvmZtWJj0aD4UTn7wJWvfrh6G3kbWIOpkjTljVmBPJWD-02jCqFDulhEAmRtGoeqElNkrr7fyFMLATZlJaqUKjPTaWNCy-RteOVDvFaalb4oCuRYy8svJ4o87gst9NHfdElMKVo_bJ1emzA1r8VxXen2n1AM1_hMdxx7m_RoFFU8c5l8iIQQTQEFaC5lfmeCuyb5Q3jkoSZ9UP1R9qJBjKCvj3J18Hgtvb-n2-42YmJp6RqwzAvRSqJ-JIXk8tNQ28f9P0ec12f6ope2VKUjAO-aB8mpVtfOqAGrW73t9MD85afVkkeaCRN_gqrXITI0IwBsyfTJzyntTHFguPOpvvr5QurCnFZ_RR1CmgAt3nrkJpPyRcwJZ66rKxZayKVKnJTHlO8pNOMoJMBlRaCRlse6fqzKObeBUa-M3qq0mRIrqXx8j6r28z-3r0FzXxjDzf7I34pYdnIKeHYV8Izaec6azbDtlVHteKFjCO77rqTQAz_EphvjTMgzBlONB7uqgy4-Y_EALtISJKWWq-3oVPOpzY9HUazsDljS7hRBkj_UrP78AvetiEVWbEdVHHX3xhrKsWBucTZtHe4psyQOpxJjVG34PMbK9Paf02qCUWF2ONcePAY6ryj1Kpy5QZIbdtdK2X97SE1gUQYRvNCNCBfZqZC1qJv9HpkO58ENnXFmw0BTdSLtQlrcX70KS2qxQukPiuWEu0dVi0-TnC-RmKCrbh8xWrhyEXTS6ubKle0WsRs3lLlxKWPJVY0gpslxB3mCTjmdNVFAFOgnHtdKd53WrTBoIoVDm2tkwwvo_uCr2SskdFSXs-ZCi-pfA2_G-AIoMvbdNetZbFLqgK2XqgqoFw0BZoLrEWaXO33WCbYYALNp9PHOoK-3hSfgsgwG686dkT09pksbJYJFDY0HxAC4AZd56G8DQw5X-8SHNCmOY7JVS493Ksz90440VOBcJUK4zY8I8Bo8rkYFG9WufCbzEaTSokWj2cIJmc7PAnoDPRdMXdfuzRdF4CCLVDYQ1GyCGYoiNGZyuA9tg4r2zb35zRFGj9o2-E3z6NmBqDdlNhcXulzl-joSB6V9CER_0mzKZ7LfZlHbejXBbn_rz2FVYgUfjUHm3F_7R3k4GtIrl5wAjscqYXzZE6DTaCK212yS1BbgA93_3nctTZ6a49u87Lwb6zTNBrgiKXbWIYwTRWy39JBosu8i-sq7hEH0klRKstLfFAsppqBYa2wEvtmku11KBN367wl2kB0nrs1MQ0Suk0Y2YSA2rQKDWuuqje46I3UFl7SpC_9d6Z8NCaZTytIxxZvIvNtleY-jV7k2XP2eQ9w1lbyOa7bKOA-shTNElk4mzdM7S5UNO5vayFkk-g93SYNq8BET_fJHGKiSfzqpahOk6YF5wTTGHCJ0AmcGLVpU9nF-2SaPw18BS5LP_k0_ZXfyKNYY3jWxyG6_jYTHDBFde_K9xtj7&cid=CAASJeRokDukzsSgMOVkL380IGEbY50kTFoAPgF4svkrlF6924L1s4g&rfl=1%2Chttps%253A%252F%252Fwww.webtretho.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:05:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1719
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3159
x-xss-protection
0
server
cafe
etag
1394524276809619753
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:05:10 GMT
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20220421/r20110914/ Frame 7F25 		25 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20220421/r20110914/abg_lite.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C6alkHkRT5QbDqvzBLHOhYHVfyBh7CII71NEzAroXlTvWXo5GxEEZYcEkp3c6AWBYGEKWLB7AKGZAqSSmiCkY3zXFBllTe9P3cZpXGp2HTn2lwxT6BtbkX-4ZLygFrNtijg5PhmwDlAKFULbWhZtPhXc3ffA&dbm_d=AKAmf-CZcmBUr0Y-V0TUyLAb3JR_T15ul-pfFTj1zDMNCGLmB7ESNEoZ0ujCMRK_0DzEGU3bTRJlW9GuUMeEhqhvlys_wOwwQHf9HGFX7FuvAt1PpysT1if0mO3Ogk1OeahXhkNq_DZS6vXu-pvcbzoLTaepkui1bugaVgbrIPXNG1vEgOQrVI9sdXEsHaoJD08mKYV8EaTFJuzkZebQuJuUpFzYYyJz078WN9AUFYnhnCqEHxx1Xzjs5MTBYqWiqjGKpCKpiUQ0wEMelDaOOMOadzU9DOmyZxeehpStfFxtRHRoBAHiYkyLeV81BUpT5mjUAZVG5GpYUfz-FmY5yEz1glSVvnzF70WaQ2SfccG5RL8ZWk-ZM_LoDXZrHg9Gw2dk9icbdG-LOtJc8IEsKX6C65LxAqHD7a980zXbBe3hNyaPn_9ateHGH2aMO_CrJ-Pfs16yPpP2sem0rNCLJYsZJfLolmC7GjhFBBzLaKvmYZ-RofxrPofLOCH-zfwqBt-Puxa1K0Wa32aRhJxQXDZ9dB8UHmeArmEqBM5QfGaa9v7dq6j0I5i_KlyZ9JGmxRdXTucLZegDNJzpWgDO6lQQhIgylXeYxyH09A-k6I3cn3mD54HRPaUqe6vEvmYa7dPq3OpxVeIgDwxoNlyHk02zW91U-MjmzA9IaGHfkSsUvGQ0nB7QZhBFsCanEjOS7qvBGQrDoXbCiycV01sMMScYfaZU3lwGGIvocez_EEPibhkWahFLRkaPuAqkdohpBUBZQKDSfzBALk279eN7ilFIoXhWXmIPDMJkUvkD7ux-PbMh3YeQnDQK_L9sCDiWyvYayxDVguta2zTtZ6KFoebt92hokYN2SrggQf8zxX8HS2D7KcR-Za6NT_hIeR3ee1I3Dtw4YoR80ayR6pvyp3emlwyRSfp6qI4XI1YQ0lgYwpX9AlHLMVME2UJnL0tb9eG8NQFiYzUlY8O4zU_3bkAJev46OOaOKG0w6nAqYx73tN5eRU22B0BdKwduVHngrKTCFuJdQeKTsQBVCSK9P7QLi7cEcJ89l0cKoskE4du1x60IJwP5et0n8eVtM2fIBQSAnH4YVGGG1cLKfYj9a_qB60q8rp6KR0IyUtVxVEujkfmdn_s80IyQ5FtnbJTAdw6QOwUBZA4OXpSPL4d7E5fok9bT0mK4YDliecj1JI41DDgiDBhOKII37bBpGGzXooBPQHwbQ6fVl-nKm4w9RCguJac9syWOwlxnIwoNTt0XEERONx2K2aUwGmHz9b_qlOUGIa_yDzGrbREDdhNmFsKDah8oX1ipbyTAbrH5z9vCSCje5PuyYTSO0SPoyXec7Hj2tZ_CAtdid-lpOef1UK_1SqB9JYikms5LKafzSCjhk_thfoTxKOXjerZHuH4u-yFBXlJrtoawpglgqLHh_2PwUZpusxbdzelCeJy-EjX-ZyxP56wyvyRBC5CNlq1BykLBxW0DF_0LMAap7sG07MjZRTr22gLI4MTtDf-biqt1CXgh4tH_sJqb2nIc2go_8a9d37RBCG1iPlXLOlavMqiu51KzvELFImKMlIgoLtjGP_RpQMQ6-i1HgnNn2U1P58XHvLtilmlE-Cui7iHiGyRxL-0RqdtKFzEnes394DHRVUQqgr7irOOGSUFnTEtGhA1XQwUYVj_yD6tcFdGBnEMGZkkDb9YI_DL3AvBXEko2JMHesf0-hHcmubKcmoTzyNHJ_QGuRJK6y-RykLv_D9Bc2hJ3h88TxXU8yMR1jdhZh37RKZS8jKmsGCm2SiBKGINTG-sljDMVOxIF64lTOedTZvLmjvgTsrD-huLR5vwbp6j5gxdQcYJ214fsuntOukw9IqUDdJ1dO99vpRGzMNpC89jtyWrtGAP_ftEgcWjhZ0KrZ5HIv8CRL4E4DayS4sgVx7aiPojeohLny4yh4OTM0Gh8foZGBaTBN4V5bi9tS0iciWNlsS828V7dJtBAhYLU9TBqVtLdiGX9p1-j6Shfr_VfprWBXOH7o0RGKkpVq1-ARcugET6nysVERroQieTkRAR3Q6m0nrvSdAHNKlEyZ8zRN-WP-em35BQ0FrSKdZqjkR0ViZEyYGBXywpclHjST7g86q4ZszH1GvmZtWJj0aD4UTn7wJWvfrh6G3kbWIOpkjTljVmBPJWD-02jCqFDulhEAmRtGoeqElNkrr7fyFMLATZlJaqUKjPTaWNCy-RteOVDvFaalb4oCuRYy8svJ4o87gst9NHfdElMKVo_bJ1emzA1r8VxXen2n1AM1_hMdxx7m_RoFFU8c5l8iIQQTQEFaC5lfmeCuyb5Q3jkoSZ9UP1R9qJBjKCvj3J18Hgtvb-n2-42YmJp6RqwzAvRSqJ-JIXk8tNQ28f9P0ec12f6ope2VKUjAO-aB8mpVtfOqAGrW73t9MD85afVkkeaCRN_gqrXITI0IwBsyfTJzyntTHFguPOpvvr5QurCnFZ_RR1CmgAt3nrkJpPyRcwJZ66rKxZayKVKnJTHlO8pNOMoJMBlRaCRlse6fqzKObeBUa-M3qq0mRIrqXx8j6r28z-3r0FzXxjDzf7I34pYdnIKeHYV8Izaec6azbDtlVHteKFjCO77rqTQAz_EphvjTMgzBlONB7uqgy4-Y_EALtISJKWWq-3oVPOpzY9HUazsDljS7hRBkj_UrP78AvetiEVWbEdVHHX3xhrKsWBucTZtHe4psyQOpxJjVG34PMbK9Paf02qCUWF2ONcePAY6ryj1Kpy5QZIbdtdK2X97SE1gUQYRvNCNCBfZqZC1qJv9HpkO58ENnXFmw0BTdSLtQlrcX70KS2qxQukPiuWEu0dVi0-TnC-RmKCrbh8xWrhyEXTS6ubKle0WsRs3lLlxKWPJVY0gpslxB3mCTjmdNVFAFOgnHtdKd53WrTBoIoVDm2tkwwvo_uCr2SskdFSXs-ZCi-pfA2_G-AIoMvbdNetZbFLqgK2XqgqoFw0BZoLrEWaXO33WCbYYALNp9PHOoK-3hSfgsgwG686dkT09pksbJYJFDY0HxAC4AZd56G8DQw5X-8SHNCmOY7JVS493Ksz90440VOBcJUK4zY8I8Bo8rkYFG9WufCbzEaTSokWj2cIJmc7PAnoDPRdMXdfuzRdF4CCLVDYQ1GyCGYoiNGZyuA9tg4r2zb35zRFGj9o2-E3z6NmBqDdlNhcXulzl-joSB6V9CER_0mzKZ7LfZlHbejXBbn_rz2FVYgUfjUHm3F_7R3k4GtIrl5wAjscqYXzZE6DTaCK212yS1BbgA93_3nctTZ6a49u87Lwb6zTNBrgiKXbWIYwTRWy39JBosu8i-sq7hEH0klRKstLfFAsppqBYa2wEvtmku11KBN367wl2kB0nrs1MQ0Suk0Y2YSA2rQKDWuuqje46I3UFl7SpC_9d6Z8NCaZTytIxxZvIvNtleY-jV7k2XP2eQ9w1lbyOa7bKOA-shTNElk4mzdM7S5UNO5vayFkk-g93SYNq8BET_fJHGKiSfzqpahOk6YF5wTTGHCJ0AmcGLVpU9nF-2SaPw18BS5LP_k0_ZXfyKNYY3jWxyG6_jYTHDBFde_K9xtj7&cid=CAASJeRokDukzsSgMOVkL380IGEbY50kTFoAPgF4svkrlF6924L1s4g&rfl=1%2Chttps%253A%252F%252Fwww.webtretho.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e66bfceb15a6ee125dff79826be02a07b766843e6c660edf55ec0c22d1a407c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:28:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
307
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9777
x-xss-protection
0
server
cafe
etag
12512753850102923420
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:28:42 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame BD0C 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsssh2h5nIbLppdgroLzEkYdvuJxZDWC-1AytBuEZPpmC3n1xc03IqCuP3qQHrVgpRgwps5-sJVDQTNyfm4PBxkpRkkcBKAFyic18xhqmhbOz3jyPm8J6oMariUzQF0uM4ZTsgZ9Xrn5iAQp74MvLyvlaMqPJfEGaVD3jpgr7ovdzFWftyayjiOxUaODzxNvFKsydXtivaLm4aT-ovrTYHjvQN7z3ChtOrbuEOxQ21jSLfXeqhcBQtJcOvrioS61BZzhf6rfePkVzfRy32AkhY23sI210cC-yf0d6Oias1JZ5sQGRjjByGoRI6CDVsfSB1Yk2vBan-srWuK06yAa1kWVibbWuuax8xgvItF3krYwqRQS&sig=Cg0ArKJSzLQGNsq04XmgEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 26 Apr 2022 00:33:49 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
arf-kgfxp669.min.js
media1.admicro.vn/cms/ Frame BD0C 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://media1.admicro.vn/cms/arf-kgfxp669.min.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2405:f980::1:13 -, , ASN (),
Reverse DNS
Software
ss1 /
Resource Hash
97a09426cf3156fcb0084c28d883b104079f75152a7bac88550e80bc04d9a7da

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
content-encoding
gzip
last-modified
Tue, 26 Apr 2022 00:32:14 GMT
server
ss1
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=600, must-revalidate, proxy-revalidate
expires
Tue, 26 Apr 2022 00:43:50 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame BD0C 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36950
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1650454428054601"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 26 Apr 2022 00:33:49 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 7F25 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 15:03:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
466246
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Apr 2023 15:03:03 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 1450 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
67206
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
gzip
content-length
724
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 25 Apr 2022 05:53:44 GMT
etag
48472445140208031
expires
Tue, 26 Apr 2022 05:53:44 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
index.html
s0.2mdn.net/sadbundle/3743105294731802651/ Frame 0BE5 		12 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/3743105294731802651/index.html?e=69&leftOffset=0&topOffset=0&c=2sRKxn12zM&t=1&renderingType=2
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
485f77b85c450f4bf97d622b9d58fbf347c483e2e4ea83cbf2da4bf377ad7d3e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
1867
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 00:33:50 GMT
expires
Wed, 26 Apr 2023 00:33:50 GMT
last-modified
Tue, 15 Feb 2022 16:17:47 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
truncated
/ Frame 7F25 		217 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a26d7089ef2a9f739f1e256d61474818f18a3e5cdbd79e02ed682aacfbdbab5d

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/png
view
googleads4.g.doubleclick.net/pcs/ Frame 7F25 		0
27 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvmLtJzOfOZLoUta3Gq2tjoK5HHlL-A0El2XVKf8jNwBKs3yVf5CSaj7MoWOCb415TxTUr2FeFQpVYafCqcwVv6744qiFebNz8V4b5KQfdFH_UtIGTB9gQ5eQ4-OexmJQNsf9GIj3E5FwZUzDUFEP-s72Ws_QZ2hkVsLUH8YOB-fOjBGMHZbN01Y-_oPbwEwTIPC-8iU_HXyLT7PRunm4X5EfmWz2NTP-6iZkCwu42Hly9zb9USgg2evFrdl5NqTVJM7dYK1PFV32XKZGp34BPVA3PUAGDwgfw7Silmnk_griNHoIiWsREFrglU9-syQMsbkri5IH6C6l1awTq4w3OYD8qsBVMebdUi2E3MAswFF21sgoYp27QZGwePaA2w9LIITk-br9i22a_q_9n49GaGpkp4B6MQgiGmmojpDLLd8qDYgBF7c9oE6muiujh2lBiZwDi3qcKaKACn3sBShw59SPoQpMhcN-At7Cewhzx9A6qNUr5VecpFEXwYKqAjWJevtJHMPOO4MM3a2NxO7gNSNhNCDA8fjbg-u9vipfDy2Z9aA1tfQ2aJcUVmjZyvuH1o7cky6cfDiw52lrWdYSdYkwBnWXrNM_mXOaepTQlLVOKCTa5Rj-mATFXXwO4s9nM1e5NDfRGY7XS32kMlupseBtPRUAe5jutJpSH8fVcS6Teqtoo52YqWDy_cHaSuTjwiFax_pAl8qf8n8Aq74sxg9i8LN-lObDERMqKTCOkacIJ1pUrtSxkBvq1hIdCtub9bQOzg2zZhALiArGxLZWKj92ovGPYywqri299JtETzlO9gV9pZ7I8jiREPQHiYe1GMOgOMgPVYP71vUOK32Jke-UxTDBvSJxv9i1PA7eFgVHZ6sN0xeSG2VggEcolpuIm4PX-3pqIAw6NBZmz4Ary5ZIWYaoVMPm2rjoiFFJeBDhp21dvaUHMoPmHzqWx2_ZJmQiHKZVcG4oZvxhQmfEuMvvNel8Tt8K4v1yLh5VhTwP6Q3amCg6fZILIAkQQbu9AJBb5dMTBWzOodMEYeiwqN3ivlGlxOuMYmKUi3h9RsH3A7Y76getMNAzNU5CsGthvQ94DLA3DPE_z2UZyp3S4hzWx8fY2GF6ejYuunlGE2D3WmWfj-uNo3shXY-EGNWUE-xps8kFn9d-ydwX40JhKiq7GFO6EiscO29xeVB--IzMUCnlbDUTBex8zLZGRJzxs-Epc&sai=AMfl-YQqzRHgSa8psA4MF_HqyapMyjwQ7LFlJemcYpabEGaPv_OgUv1zGlgiODXd1whobcenPofWrYAjdeVdDpwpX-mDHRM-y_P8LqJOm0GBP2WQIdHrQ_eOsZ63QXPI7hztXu5JN-GH0SUX91aqWcsvh6yikSxpfoQabuY5kUCI9DQWRdhog0yo1R1qaz_F3Y78W9fNLPnRKEDEIFLY8qjpupbB&sig=Cg0ArKJSzBb0UGDpJzprEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=97&cbvp=1&cstd=92&cisv=r20220421.54532&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date
Tue, 26 Apr 2022 00:33:49 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
activeview
pagead2.googlesyndication.com/pcs/ Frame 9375 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstmPugOFBs5t06OHPiviAAUmtZR5iX7DpBtXSpmFi5S9lq44Mb81xMApYASQ9EorJkTszJMAdmlP6lnLUl3litJbsHbAMjyy3PkSGdQ7jN8waYJy_fKSA&sai=AMfl-YSSg-e9fZViPM734wiJAEuzwFF3O4_6E3VgZ4xq1o-8nyhFHQdrneLSC4hMqQWi7rHX7H7WRwcg14Urit238dNNEp_BDZfTyWXYdxkoRIAAKUrHsKSzWbBazrb0&sig=Cg0ArKJSzMC5H-Gao4EMEAE&cid=CAASJeRoFj9EEZJLW0OuxuOWt7TpK2FwDsW3FjBx19dCnFkIMkSvSm4&id=lidar2&mcvt=1008&p=70,256,110,297&mtos=1008,1008,1008,1008,1008&tos=1008,0,0,0,0&v=20220420&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=631769597&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1650933228539&rpt=314&isd=0&lsd=0&met=ie&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 5CEA 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.webtretho.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, immutable, max-age=31536000
content-encoding
gzip
content-length
3108
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 00:33:48 GMT
expires
Wed, 26 Apr 2023 00:33:48 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame D752 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
47131
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 25 Apr 2022 11:28:19 GMT
expires
Tue, 25 Apr 2023 11:28:19 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
1643485919913.css
s0.2mdn.net/sadbundle/3743105294731802651/ Frame 0BE5 		8 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/3743105294731802651/1643485919913.css
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3743105294731802651/index.html?e=69&leftOffset=0&topOffset=0&c=2sRKxn12zM&t=1&renderingType=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4c60f558c03602ddc3357284f7f0ae306397589205f7a3e8488d9cf06f9d78ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/3743105294731802651/index.html?e=69&leftOffset=0&topOffset=0&c=2sRKxn12zM&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Thu, 21 Apr 2022 06:46:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
409638
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2128
x-xss-protection
0
last-modified
Tue, 15 Feb 2022 16:17:47 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 21 Apr 2023 06:46:32 GMT
Enabler_01_247.js
s0.2mdn.net/879366/ Frame 0BE5 		118 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/Enabler_01_247.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3743105294731802651/index.html?e=69&leftOffset=0&topOffset=0&c=2sRKxn12zM&t=1&renderingType=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/3743105294731802651/index.html?e=69&leftOffset=0&topOffset=0&c=2sRKxn12zM&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 08:05:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
59322
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41099
x-xss-protection
0
last-modified
Mon, 27 Sep 2021 18:45:07 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 08:05:08 GMT
1643485919913.js
s0.2mdn.net/sadbundle/3743105294731802651/ Frame 0BE5 		32 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/3743105294731802651/1643485919913.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3743105294731802651/index.html?e=69&leftOffset=0&topOffset=0&c=2sRKxn12zM&t=1&renderingType=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a0163cf949cea5a556b144eb406773e848d3f639848858e5eafa49657b5927f4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/3743105294731802651/index.html?e=69&leftOffset=0&topOffset=0&c=2sRKxn12zM&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Thu, 21 Apr 2022 06:46:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
409638
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11114
x-xss-protection
0
last-modified
Tue, 15 Feb 2022 16:17:47 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 21 Apr 2023 06:46:32 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/ Frame 5CEA 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/abg_lite_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a7d5c1bfe43c8beefab2fa059f4fcaa029fcbbace9a672aae1dfe1ffb7d6976c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:30:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
216
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8002
x-xss-protection
0
server
cafe
etag
5332015062585099865
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:30:14 GMT
css
fonts.googleapis.com/ Frame 5CEA 		8 KB
714 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:700,500,400,300
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 00:12:46 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 26 Apr 2022 00:33:50 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 26 Apr 2022 00:33:50 GMT
outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220418_RC00/ Frame 5CEA 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220418_RC00/outstream.min.css
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a -, , ASN (),
Reverse DNS
Software
sffe /
Resource Hash
48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Fri, 22 Apr 2022 07:48:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
319505
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2798
x-xss-protection
0
last-modified
Mon, 18 Apr 2022 10:38:44 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 22 Apr 2023 07:48:45 GMT
outstream.min.js
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220418_RC00/ Frame 5CEA 		347 KB
119 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220418_RC00/outstream.min.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a -, , ASN (),
Reverse DNS
Software
sffe /
Resource Hash
6ee816398ac59bd1a1fddcb80037e7fd618f481fe467ad65e73afb4daff29095
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Fri, 22 Apr 2022 07:48:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
319505
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
122225
x-xss-protection
0
last-modified
Mon, 18 Apr 2022 10:38:44 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 22 Apr 2023 07:48:45 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame 5CEA 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:32:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
70
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6409
x-xss-protection
0
server
cafe
etag
15284592792851369840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:32:40 GMT
l
www.google.com/ads/measurement/ Frame 5CEA 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSkDhdOHQkljT6xxYKN42A1Za0OU-yeRFH7s5JNioZX3WYRc1SXIEPfL2UXJ9xYia0PwGhGCaMSsXBtTek-kTLyjdXOPw
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers
pixel
cm.g.doubleclick.net/ Frame 1450
Redirect Chain
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEKT5iOb_NRvYYtwB6z84IVg&google_cver=1&google_push=AYg5qPLe30Ntqcs8aK_Gzj5CEyrkyjz_pcXsN5Vw4eMMNtHqDbI4mUfKvY...
  • https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPLe30Ntqcs8aK_Gzj5CEyrkyjz_pcXsN5Vw4eMMNtHqDbI4mUfKvYgwCdXULNwi8Wb00biNw6TYYpO8Tc7ieJpsdJ4na4Q&google_hm=h9vl-hsczVzKP...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPLe30Ntqcs8aK_Gzj5CEyrkyjz_pcXsN5Vw4eMMNtHqDbI4mUfKvYgwCdXULNwi8Wb00biNw6TYYpO8Tc7ieJpsdJ4na4Q&google_hm=h9vl-hsczVzKP6E5IGH6hA
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPLe30Ntqcs8aK_Gzj5CEyrkyjz_pcXsN5Vw4eMMNtHqDbI4mUfKvYgwCdXULNwi8Wb00biNw6TYYpO8Tc7ieJpsdJ4na4Q&google_hm=h9vl-hsczVzKP6E5IGH6hA
pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
strict-transport-security
max-age=86400
expires
Fri, 04 Aug 1978 12:00:00 GMT
cm
a.rfihub.com/ Frame 1450
Redirect Chain
  • https://p.rfihub.com/cm?in=1&pub=445&google_gid=CAESEHbbtkT_YQYVXLj52bwiUW0&google_cver=1&google_push=AYg5qPIxqSzVoq7j2jI8UYulA9VQ_6IiTTRBKjitvF5m-r3QNCLreijqpGkVKs4_Nih-BvqvEVRrVvjt3LI92DIanItKDO5...
  • https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPIxqSzVoq7j2jI8UYulA9VQ_6IiTTRBKjitvF5m-r3QNCLreijqpGkVKs4_Nih-BvqvEVRrVvjt3LI92DIanItKDO5lOO4&google_hm=MzUxNjY1NDU5...
  • https://a.rfihub.com/cm?pub=445&google_error=5
42 B
816 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.rfihub.com/cm?pub=445&google_error=5
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
HTTP/1.1
Server
193.0.160.129 -, , ASN (),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Tue, 26 Apr 2022 00:33:50 GMT
Cache-Control
no-cache
Server
Jetty(9.3.29.v20201019)
Content-Type
image/gif
Content-Length
42
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://a.rfihub.com/cm?pub=445&google_error=5
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
247
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 1450
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESENaAT_5wiMQqsrzEbxz0XIs&google_cver=1&google_push=AYg5qPJ_oX68r0B48ZEakb8szkGpAbKvxpCvX7DpUr0hiy5nO3-7CmH7EDBcwo-SOsf5H4gqB5krH2I9YDpfjMSE8IAv...
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJ_oX68r0B48ZEakb8szkGpAbKvxpCvX7DpUr0hiy5nO3-7CmH7EDBcwo-SOsf5H4gqB5krH2I9YDpfjMSE8IAvQDN62J4&google_hm=c40nf7WTTY-IEXVBzT9CEw==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJ_oX68r0B48ZEakb8szkGpAbKvxpCvX7DpUr0hiy5nO3-7CmH7EDBcwo-SOsf5H4gqB5krH2I9YDpfjMSE8IAvQDN62J4&google_hm=c40nf7WTTY-IEXVBzT9CEw==
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
//cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJ_oX68r0B48ZEakb8szkGpAbKvxpCvX7DpUr0hiy5nO3-7CmH7EDBcwo-SOsf5H4gqB5krH2I9YDpfjMSE8IAvQDN62J4&google_hm=c40nf7WTTY-IEXVBzT9CEw==
Date
Tue, 26 Apr 2022 00:33:50 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
pixel
cm.g.doubleclick.net/ Frame 1450
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zs...
0
0
pixel
cm.g.doubleclick.net/ Frame 1450
Redirect Chain
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEE7kfezuT-go_rfuXGcPLwg&google_cver=1&google_push=AYg5qPJFFOqSsWl2H9FzkSYURSxVvcYNX3zCQbEm0DBgPAahoNrE4RZuiBT_yE7tCm0Gm60i1YkrHkmEb_rz4nnk...
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=6d715d18&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AYg5qPJFFOqSsWl2H9FzkSYURSxVvcYNX3zCQbEm0DBgPAah...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=6d715d18&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AYg5qPJFFOqSsWl2H9FzkSYURSxVvcYNX3zCQbEm0DBgPAahoNrE4RZuiBT_yE7tCm0Gm60i1YkrHkmEb_rz4nnk0C-XGQU5jN4
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Tue, 26 Apr 2022 00:33:50 GMT
via
1.1 bee9d99ac2913ec4167e166e6bdb691e.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
FRA50-C1
x-cache
FunctionGeneratedResponse from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=6d715d18&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AYg5qPJFFOqSsWl2H9FzkSYURSxVvcYNX3zCQbEm0DBgPAahoNrE4RZuiBT_yE7tCm0Gm60i1YkrHkmEb_rz4nnk0C-XGQU5jN4
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
Xdcu1uo3QqbYQ37bD1o_nfDFWxajsShLxmeUX-8ykBgwb9P8SpGv2A==
pixel
cm.g.doubleclick.net/ Frame 1450
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESELQMcFpV_NCR2yEUzHmFEZ4&google_cver=1&google_push=AYg5qPIf7h1jqatbG8tv-EPibCkWjMQXj_pFtvciFyMjlOjfZaSmmqk50x0VMY1BuGVuXLgKDpiDMShvoQ7zWpCNhPsKFCbTS5g
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=AYg5qPIf7h1jqatbG8tv-EPibCkWjMQXj_pFtvciFyMjlOjfZaSmmqk50x0VMY1BuGVuXLgKDpiDMShvoQ7zWpCNhPsKFCbTS5g...
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg3NzQ0NDMzNjI1NzU4MjU0Mzc5MA%3D%3D&google_push=AYg5qPIf7h1jqatbG8tv-EPibCkWjMQXj_pFtvciFyMjlOjfZaSmmqk5...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg3NzQ0NDMzNjI1NzU4MjU0Mzc5MA%3D%3D&google_push=AYg5qPIf7h1jqatbG8tv-EPibCkWjMQXj_pFtvciFyMjlOjfZaSmmqk50x0VMY1BuGVuXLgKDpiDMShvoQ7zWpCNhPsKFCbTS5g
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg3NzQ0NDMzNjI1NzU4MjU0Mzc5MA%3D%3D&google_push=AYg5qPIf7h1jqatbG8tv-EPibCkWjMQXj_pFtvciFyMjlOjfZaSmmqk50x0VMY1BuGVuXLgKDpiDMShvoQ7zWpCNhPsKFCbTS5g
date
Tue, 26 Apr 2022 00:33:50 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
/
onetag-sys.com/sync/i,19/ Frame 1450
Redirect Chain
  • https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEPNQ00KIzLnbIHl_ymi7aRE&google_cver=1&google_push=AYg5qPJZGqcV_OMFSsBlqT4nh_A2gCppljwBJrRcnpPo_O1HavcE8ffWmcA4FWzUwrJuRcE9vD--PM8Ngep...
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AYg5qPJZGqcV_OMFSsBlqT4nh_A2gCppljwBJrRcnpPo_O1HavcE8ffWmcA4FWzUwrJuRcE9vD--PM8Ngepx5FnwMBM5Qx1ToNAg
  • https://onetag-sys.com/sync/i,19/?google_error=5
0
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/sync/i,19/?google_error=5
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Server
51.89.9.253 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-cache, no-transform
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://onetag-sys.com/sync/i,19/?google_error=5
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
245
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
attr
cm.g.doubleclick.net/pixel/ Frame 1450 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JbBdF26Ll1xp-r2s3plwccU5n8RjyG4R794R_0FgYOyfVDxADrdmTiLBF9Wp11bZYi7pZ_Rg
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
LOnNfct_OK6AKwq7GByGz0_K8O7BrCXN6Fs6Py5gnPc.js
pagead2.googlesyndication.com/bg/ Frame D752 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/LOnNfct_OK6AKwq7GByGz0_K8O7BrCXN6Fs6Py5gnPc.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2ce9cd7dcb7f38ae802b0abb181c86cf4fcaf0eec1ac25cde85b3a3f2e609cf7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 09:08:20 GMT
content-encoding
br
x-content-type-options
nosniff
age
55530
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13636
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 11:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Apr 2023 09:08:20 GMT
dt
dt.adsafeprotected.com/ Frame 9375 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=996673&asId=30b785ef-c92a-0ec9-f418-f7500c490bf0&tv=%7Bc:aQyXCD,pingTime:1,time:1218,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:161%7D,%7Bpiv:100,vs:i,r:,t:216%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1002,o:216,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:161,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B64~0%5D,as:%5B64~160.600%5D%7D%7D,%7Bsl:i,t:216,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1002~100%5D,as:%5B1002~160.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:99,fm:t44bA57+11%7C12%7C13%7C141%7C15%7C16*.996673-61756187%7C161%7C162%7C163%7C1641,idMap:16*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf%7D&br=c
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.92.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-203-92-83.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
x-server-name
dt05.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
dt
dt.adsafeprotected.com/ Frame 9375 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=996673&asId=30b785ef-c92a-0ec9-f418-f7500c490bf0&tv=%7Bc:aQyXCD,pingTime:1,time:1218,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:161%7D,%7Bpiv:100,vs:i,r:,t:216%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1002,o:216,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:161,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B64~0%5D,as:%5B64~160.600%5D%7D%7D,%7Bsl:i,t:216,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1002~100%5D,as:%5B1002~160.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:99,fm:t44bA57+11%7C12%7C13%7C141%7C15%7C16*.996673-61756187%7C161%7C162%7C163%7C1641,idMap:16*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf%7D&br=c
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.92.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-203-92-83.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
x-server-name
dt06.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
dt
dt.adsafeprotected.com/ Frame 9375 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=996673&asId=30b785ef-c92a-0ec9-f418-f7500c490bf0&tv=%7Bc:aQyXCD,pingTime:1,time:1218,type:c,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:161%7D,%7Bpiv:100,vs:i,r:,t:216%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1002,o:216,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:161,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B64~0%5D,as:%5B64~160.600%5D%7D%7D,%7Bsl:i,t:216,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1002~100%5D,as:%5B1002~160.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:99,fm:t44bA57+11%7C12%7C13%7C141%7C15%7C16*.996673-61756187%7C161%7C162%7C163%7C1641,idMap:16*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,metricId:publ1,cmr:t%7D&br=c
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.92.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-203-92-83.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
x-server-name
dt07.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
logo.png
s0.2mdn.net/sadbundle/3743105294731802651/ Frame 0BE5 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/3743105294731802651/logo.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3743105294731802651/1643485919913.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8e7db196f52cd053d40a1777734ad97db6b60f69cc485e8c51371a57eba06bee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/3743105294731802651/1643485919913.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Thu, 21 Apr 2022 06:46:32 GMT
x-content-type-options
nosniff
age
409638
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1954
x-xss-protection
0
last-modified
Tue, 15 Feb 2022 16:17:47 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 21 Apr 2023 06:46:32 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 7F25 		0
26 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvmLtJzOfOZLoUta3Gq2tjoK5HHlL-A0El2XVKf8jNwBKs3yVf5CSaj7MoWOCb415TxTUr2FeFQpVYafCqcwVv6744qiFebNz8V4b5KQfdFH_UtIGTB9gQ5eQ4-OexmJQNsf9GIj3E5FwZUzDUFEP-s72Ws_QZ2hkVsLUH8YOB-fOjBGMHZbN01Y-_oPbwEwTIPC-8iU_HXyLT7PRunm4X5EfmWz2NTP-6iZkCwu42Hly9zb9USgg2evFrdl5NqTVJM7dYK1PFV32XKZGp34BPVA3PUAGDwgfw7Silmnk_griNHoIiWsREFrglU9-syQMsbkri5IH6C6l1awTq4w3OYD8qsBVMebdUi2E3MAswFF21sgoYp27QZGwePaA2w9LIITk-br9i22a_q_9n49GaGpkp4B6MQgiGmmojpDLLd8qDYgBF7c9oE6muiujh2lBiZwDi3qcKaKACn3sBShw59SPoQpMhcN-At7Cewhzx9A6qNUr5VecpFEXwYKqAjWJevtJHMPOO4MM3a2NxO7gNSNhNCDA8fjbg-u9vipfDy2Z9aA1tfQ2aJcUVmjZyvuH1o7cky6cfDiw52lrWdYSdYkwBnWXrNM_mXOaepTQlLVOKCTa5Rj-mATFXXwO4s9nM1e5NDfRGY7XS32kMlupseBtPRUAe5jutJpSH8fVcS6Teqtoo52YqWDy_cHaSuTjwiFax_pAl8qf8n8Aq74sxg9i8LN-lObDERMqKTCOkacIJ1pUrtSxkBvq1hIdCtub9bQOzg2zZhALiArGxLZWKj92ovGPYywqri299JtETzlO9gV9pZ7I8jiREPQHiYe1GMOgOMgPVYP71vUOK32Jke-UxTDBvSJxv9i1PA7eFgVHZ6sN0xeSG2VggEcolpuIm4PX-3pqIAw6NBZmz4Ary5ZIWYaoVMPm2rjoiFFJeBDhp21dvaUHMoPmHzqWx2_ZJmQiHKZVcG4oZvxhQmfEuMvvNel8Tt8K4v1yLh5VhTwP6Q3amCg6fZILIAkQQbu9AJBb5dMTBWzOodMEYeiwqN3ivlGlxOuMYmKUi3h9RsH3A7Y76getMNAzNU5CsGthvQ94DLA3DPE_z2UZyp3S4hzWx8fY2GF6ejYuunlGE2D3WmWfj-uNo3shXY-EGNWUE-xps8kFn9d-ydwX40JhKiq7GFO6EiscO29xeVB--IzMUCnlbDUTBex8zLZGRJzxs-Epc&sai=AMfl-YQqzRHgSa8psA4MF_HqyapMyjwQ7LFlJemcYpabEGaPv_OgUv1zGlgiODXd1whobcenPofWrYAjdeVdDpwpX-mDHRM-y_P8LqJOm0GBP2WQIdHrQ_eOsZ63QXPI7hztXu5JN-GH0SUX91aqWcsvh6yikSxpfoQabuY5kUCI9DQWRdhog0yo1R1qaz_F3Y78W9fNLPnRKEDEIFLY8qjpupbB&sig=Cg0ArKJSzBb0UGDpJzprEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=427&vt=11&dtpt=330&dett=3&cstd=92&cisv=r20220421.54532&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 26 Apr 2022 00:33:50 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
webfont.js
ajax.googleapis.com/ajax/libs/webfont/1/ Frame 0BE5 		13 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3743105294731802651/1643485919913.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a -, , ASN (),
Reverse DNS
Software
sffe /
Resource Hash
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 13:02:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
214308
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5437
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 23 Apr 2023 13:02:02 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 0BE5 		7 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f4b8e846e1436e318306ff6394bc05b4367a700f6156c67a1cbc5ed594b9a1bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 26 Apr 2022 00:33:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5581
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 0BE5 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 26 Apr 2022 00:33:50 GMT
csi
csi.gstatic.com/ Frame 5CEA 		0
327 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~l2ff0p7k&c=5293576886604&slotId=2646788443302&qqid=CPaq18W9sPcCFQG7dwodI4UDmA&fb=outstream-lima&sei=44729911%2C44730425%2C44730426%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220418_RC00/outstream.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4009:824::2003 -, , ASN (),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:51 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 5CEA 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 17:56:19 GMT
x-content-type-options
nosniff
age
455851
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15828
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:28 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 20 Apr 2023 17:56:19 GMT
KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 5CEA 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
336bb30461d407ee72236de87aca4fe68d611e1bee0030326778c858a4685b1c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 21:18:23 GMT
x-content-type-options
nosniff
age
11727
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11836
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:22 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Tue, 25 Apr 2023 21:18:23 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 5CEA 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Fri, 22 Apr 2022 01:46:21 GMT
x-content-type-options
nosniff
age
341249
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15688
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:19 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 22 Apr 2023 01:46:21 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 5CEA 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CEpS17T1nYraAMYH23gOjio7ACef9yrtp4NKkmsUPz-aivcABEAEg0K_XKmCVuviBlAegAZf-m_ACyAEFqQKs2kxmNPexPqgDAcgDmwSqBKECT9BAKGuydt3snrtxMZC971C6ahkQgE9B7jdj91b8zchVU2mWvErEuGU8bdi3OQ11DWhaa5G0VmX4RJgToenyfUak9jvzgt3LtXuB4mXR5XgVp2egCURcTGzS3_PNORFQlonWdqlEbUOb7H3Mi69fRxj1ixo2uBmPWuMnS2Mjkvg1xNMqQHZaQ59VJFzM9SO_3EiK_DOm-k6OIh4QtPpoKIUIDJiZASAJDc2w-s2BQclc_YpLJnG07dSfNj20JgiChtbmvlBsHfKNzcF3RuqYIsldSpiJu5lcNT7k1iEyr1-T1opoZ-3egiLdn19HWzmQ-aCjyyAz2vcVp0ANvo4u02ylgpnZT4V4EMQuUsNZtZFA3wWqfApUivIG1idOOAO56MAE3_6y1vID4AQDkAYBoAZ2gAfRgeSPAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHYAKA8gLAeALAYAMAbATgf_6DsgT9fji3wPYEwqIFALYFAHQFQH4FgGAFwE&eventType=clickstring&clientTime=1650933230250&ai=CEpS17T1nYraAMYH23gOjio7ACef9yrtp4NKkmsUPz-aivcABEAEg0K_XKmCVuviBlAegAZf-m_ACyAEFqQKs2kxmNPexPqgDAcgDmwSqBKECT9BAKGuydt3snrtxMZC971C6ahkQgE9B7jdj91b8zchVU2mWvErEuGU8bdi3OQ11DWhaa5G0VmX4RJgToenyfUak9jvzgt3LtXuB4mXR5XgVp2egCURcTGzS3_PNORFQlonWdqlEbUOb7H3Mi69fRxj1ixo2uBmPWuMnS2Mjkvg1xNMqQHZaQ59VJFzM9SO_3EiK_DOm-k6OIh4QtPpoKIUIDJiZASAJDc2w-s2BQclc_YpLJnG07dSfNj20JgiChtbmvlBsHfKNzcF3RuqYIsldSpiJu5lcNT7k1iEyr1-T1opoZ-3egiLdn19HWzmQ-aCjyyAz2vcVp0ANvo4u02ylgpnZT4V4EMQuUsNZtZFA3wWqfApUivIG1idOOAO56MAE3_6y1vID4AQDkAYBoAZ2gAfRgeSPAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHYAKA8gLAeALAYAMAbATgf_6DsgT9fji3wPYEwqIFALYFAHQFQH4FgGAFwE
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
vast
bid.g.doubleclick.net/dbm/ Frame 5CEA 		29 KB
16 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-AkgmH9GJedU7FXG_Oywclj9rpjbEO_vrmqTvP6E8HkAbajAyRudL5Kyc__RvbULwKWMQpx6Eqpto92AL1DWnQ3DpbZhA&cry=1&dbm_d=AKAmf-BCfo8wukQuLnAhljylHnywNKwtBX9L7Bmzg-qZEyvpibU_p6liNmIPjOjiXrQWCdSBEeof85OORKCYXrWQjyzdHS3W-v1sfoKXTtjTnNWwCiiePe8AH6OY-AWcCpd8oq15RVcx6igVGLo1LEwIMf7AhUWmI63wWGSeTiiTezlz9SxHny7sRRW34iSgOb4A21tMNvyQG0Afzown-jCCL4bJJ5OQHP0Drg3bQ1CJFZHdmVPNEhWZe5CjbRlyE_XqWD2zd5g3Tad5LMyXhspB3caTZG7HoiMAbACgyDgXJmHvo47w11Lv1tTQhg7GL1TAak47MGydohJoIah5WophLzP7LPfMGUAUUbmygo8-ceB9bCZCGQmYSYprdm0a4ny42v5r_ZHtaWVavuIerYh2xirj6cWPj45Hnl_IRCpYpZTFXFu7N-0U0uIaqFkXUgzTB9vjZujqd2ZPLw2IzS3wWqR9Q-GJ0mi7BP6MMJFlpag_3KpysfTcmik_pgfrCXTMofBDTdSLoW-IMSxYN7OAHD6QODu19XEFTXcreACOrWt7S3AHSOH3D2kN1Y7p_mEm7y4svXE9dD5LY2MP_SeY_p3iRJ55WagoxvrtIrFY_G4hXG0MIKwcEtgiuQ6_8_BVpOcv7q8fb4wEBlD1qF6q2RF7lg9vxDHe9SnsTb0PyyRETj51qmRq61LJR7D3zMUK0VX5nTPm_3yRHQeHWniAsbiCoYImRv8wSm787Fe6NFFrRLQ51RwSV8lvIkiBv430_GGu_F-qdD58Z5qgfCOl66vCKi5qsdnJOuSknz3_gjEg8yummp1C2BbfeOh_sZ3z3pr37ug2AVu833fW0K5NeeImatUM2sRIpbPXdoS1YoBHZKsN0wnata1UMtbSMK-9nqY4PrLQJ1nrS63nxURdqFj4FaYUTxX52-4VR75zTYALCBut9NqDC9Rkps6J-d_yU2zsE5GFaWi1O1pO8m4fyvc19KWZ-QRbzM1qb3UncrCRCTnA2lHjR82vcFEEtqiA_qFjWKklLI7Ao0Cr9t1-5F28C9xzGe1ETb3X6NCGD5D6XAD2RVkAkOPE0AXinQndss10u_p8SMga92pDHPRJJghiSK7mJ0x8gzyzDB4yf0JXkkZfbrsUwL5ynDorY0ayoO8-Cd6japhobS_vrv3349_5kU3iR2u6WtyzgppcXWSRjmvGnMWOP5ZZkbt4sEYOhB--C1Mxw5KOiai6emnFo6Cs_d_2bBBXuvOsV47fBst486WP-BDJQJIq9aX9Zz77Jjo1YfjJiuicxdW0w0gU7ZAsEN4B3aTcyIHV2rUwoLH53aJRSKPzg_EqNmJuCyVkgnFwVW3gfqMHEZh1sAihuof5WcUph1ONUtqkxkvzhWQCgYr5E6yye9G-1ce6nzMRyZwLzgiTcFshkRg_7y2UhUrSv0FM_I95Rq--xZVYQd1IR4UuqsDtilKZnc05kcm8AsiVVkprptRBjAalLLo7uwAcunVxSDapx3ZBnpdGWg7svYle8wM2NTpFvMtwarPqhTr0HehLgHprzLROjkdDLYc7akVhVavkm-cxP5sXfZqiqLtkyYdaCtMvNMUTPaDJv_06yi9wPDT-lZA1b7wlrhWwBc-0TM2d5auQ8carPkEQaeOaECNYkvX2zhmhOZQ9mFkJi_6f_SIWag9OZ124xvmyJ3M5_RLZAuHa7sMvJga-B068up9ybvmGH-VqssISNaQ-2vV7Ys8YWtWSOiZToRQevav48SN8qUjUaWLgWjJ7lStxlTJ4_uQC4CGyOHkjweP_2hQLDgHycslv4r8c7qcty5mn6_ROs2MsIfHMdBnbODsJXMJ3G4KlMsT_3wUu13UlvR1ssy-g_s1KhCiMQITvNqh4rA18Hl3V7IM303vgcU9NlW8F1TFXin6IyFXENProT-QaeR-L4Xln-Nw5zLzXZswvULnF7P992YNyQ4GrzCbyop4Y866SbQwuej39gH-amzw6Ew_SJjCurvA7Bk_LYFvmyH5LloZdrevZTtWdWWH1UQXsv-XU37hBRQhm10GRy16un920aVxr3xz2YoZlXhgH_OM4NSs5XoUnH3rZ7CyATLsdhcw8mDgcnMol6qpgG5WLg65C8BRJ3G8QRVZ61WlHJEqbm7QRtHXPJ3UAJDoW9zPqsgQAPX08wGf2vrZc2BWjoH8qwaz_EPWBrnAM97QADxOe9R-gaAlhV0hDI6dqpau9c1F1EHJaBUkDOh_hUnT7QSxCfz9wv0RHiqkb0mSaMB4fLlPkKMwn0QGJ_WVB4AyysgPdbC1uOZdM6zK6apq1Xd6FQssDQQ8FML3hGlMmTtuCh75LBUsjLdSls-kEqDPg1dytZYy1ChNp9ehzBULly_lzB6TjCDQtJX5sVOVreiOAG7ndBaK6pul9IejEeWMLwAhY2pYf60pTYL5bcpM_ggw6uvPWIfCRKcR_kpTVuTSPAp7gYsIF5St2-rj-zM9SZZYK2dye_JwMLEMnjZ4PQ8N36QxLGds7CrYapmkPlkI1-ARhyXpkWNQacVS133B0Lffjl6IS7bKJIx54cvtLD7h1SUUSmTdUq6DTLLTIu5QwR-vcABoqtUUIG5k6_fXqvrOCrgJ3RT7lsCOwpLHpSRE_WS9i0Vom_fSIW-Ky59X-udMxXQoR-fPtpGoabglrKstj3F7n4_02Dc1evfYIl2HFDBpKSxp6DWb4Mm5TBjXcORj3FbxdsKlF8nbEwRDNeUj_r5T4S1P2BzckKmkan2VDC-A1hm-rxbQWJ_UtpAbRxcknnlMFDrxYkJYTFs5xZHlbV857LBez22E1hB4uhNercYvv9Q_10xVwBGlA3tTnVs4FS8P6LWrmFkHjCoK33pyz2tK1K9JJHMQPHg3EkgG4ed1Beptkf5W07_07JaVLMrXv2oCWg45qWFUvVthkeAdNHXYHzuRy0ULR3tJBDU6-6Ieg8ayvAIur22rWOji6hQWPde1G497Z9g25elmuPlvuYRJT1_8iLToFOzKZUdJNqvW-0fMPM-ukIFHU-GxXEjWOCJHgNQzJrWJDGqOyKKTAY3ZKP5YQq-3yBMEYilojBL6OOdgx9ORePFzuvKwfOx7jWjFl61ADifVHc7Woj_A8606pO0n85zd5az9RJvgnOQylSwCCEFdERTiW5iVvSoMcaOqn627Gossdb27A54s7-EAg6AQIH7IdVh-2yyd5laR4jkOBo02ICBjMNczVj46zriERgnQTEO4LNrrtE9zTuYrSHH1tLdcMSe-3d-sfTF2WQ-_QRzVdZit6VBMnnSosqdmBe9-8ig2A6MARFIPjkHRFEXef7Hb_PbuOP0DHNG5fNhnogzMBKHeGZdFUUnMhpJzeJnMTtpk5cl6wlgAeQ4f3Q5oR5A1oFd4i3oczOsVvwyPIFEXgipFEdkB2HDsXR6cZjJ2_TG2wMxQ-ltMIWzjjt8tXXMEva39LexmoXBJojr9H1-qR2LO3gOrikmMJ9JCPbBxOOlVSFB4-JoUAHyqmVCmroKwjkb0jmubKS2hN9AfbY70364_23-EkM8aHBKWvdbj0cenC1LEuQrojHrU4XGg78KxK4FifMfadshemCv6XtWe-zeT_MPGw5YsgST7QugFkG-O6bHvV5K4VnSkiXXHZzaoVxT66dPd3xxyLG-FE5IN6ccea_naDHIJpNyyGn0YvevpCOp0gtqn6w2xz3YRtPzP4ov3anXmfDSKYYgJ336A8OatmZ1OHlVa3_qtE7WRviKGNFP-uHvhK78VpUtB6uS29WP6F6xP5NJpuyQ9L58B-yggRq90lJyj2fZ-ujA6tgi_aR7L9bpOCVtxV3P_o6b-NWcpkhvXzP5iRwPEjKrqFrT1rDtnnmheDrb384lJ5ALlBpMU_OmKBrja33Un5IkpgvB6pVTIHHxRKfHqWI05yrYNursjTBbX36QYFVNQrJyt1sUhCivCxRoMC2wnxRMrJdIC6H4AxgcKgi3VdIaLDa76mLevGtXOdrpjUc-ZQ-4jrJLadzGHBRg7yG42uhJ64XkkSOfiJjZb_1_yaKVzQULZkJNeQnm2EQ6AhUurGW_i1iNIS1Ud9ZP0Vhwb4GJhZImr0kFCt6tJlj-G45vX9sCZ7N2CzAoiK7VNZ0WRQRG46UwxAqxHIfX4CPN_MAPjUHTigNXe4_m852Fx-PopRY6ZTm-Y8sw9jgyeo13MuO5hmu6VTIC3o5hr9zOIH-m4Upb4S&cid=CAASJeRosWt4eXn3Px6yXLBCS5QG_ho5l1HTOf5_zaH8roi6I_mlrTU&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220418_RC00/outstream.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.125.133.155 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
87a9d514b5623bbc5e9287ba10c5ef7d3aea2bc480fe2b01a01ab9b856fa6917
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15833
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
text/xml; charset=UTF-8
access-control-allow-origin
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 5CEA 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=C7_Uu7T1nYraAMYH23gOjio7ACef9yrtp4NKkmsUPz-aivcABEAEg0K_XKmCVuviBlAegAZf-m_ACyAEFqQKs2kxmNPexPqgDAaoEogJP0EAoa7J23eyeu3ExkL3vULpqGRCAT0HuN2P3VvzNyFVTaZa8SsS4ZTxt2Lc5DXUNaFprkbRWZfhEmBOh6fJ9RqT2O_OC3cuVe1Uv39UhuvMUSE_sGbgZbNLfsM85EWiclNa1qLEutpBk_TyI0pxCGHlf7zU-QQXZ6avL49aR8jbE099Dg1lDn6Akqc_1IErfvYn9M1P5h4oj7N2Aywpj9z-U1ssFAIkEszNGrMNq9PPDgkspfaTtgpwOPT-FqYODMNgOUYcx_41t0kp4Cp45LD_cArM-p-tRM4do0TgcaD_e9tfuROIfuU2nZZsWd-VIu1-rR3564biuRXN3sBTjTqWJimxGgAbZ8AxSz01R8SeSpZ5eClqcNkuYUv-jmAdXS8AE3_6y1vID4AQDiAXvy6i-PpIFBggDEAEYAZIFBggbEAIYAZIFDQgiEAMYAUiN0rcBUAGSBQYIHRAEGAGSBQYIHRABGAGSBQYIHhABGAGQBgGgBnaAB9GB5I8BqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwoQyM5bGIvv7cgB0ggJCIDhgBAQARgdgAoDyAsBsBOB__oOyBP1-OLfA9gTCogUAtgUAdAVAYAXAbIXHgocCAASFHB1Yi0yNjMwNTk2OTIyMTc3MDA2GPDBEw&sigh=3MFJF3WN7Ww&uach_m=[UACH]&cid=CAQSPACNIrLMOHcfQxzZRucW208D30iKLCP3hClAqVP0iOpecIA53kf7LrkJy530dr4B3zbxQfbNWBGRgQd5Tw&vt=10
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 0613 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
67206
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
gzip
content-length
724
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 25 Apr 2022 05:53:44 GMT
etag
48472445140208031
expires
Tue, 26 Apr 2022 05:53:44 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 5CEA 		212 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
efbe27a9115d94a2318d9435fbfed07c45d0194d76fce89f4b60501914a0a3b9

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/png
KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 5CEA 		5 KB
5 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6ac62ad133b177d67c52cfd6b1fa821b3566637b15c3637335036aae03cf972a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 17:53:22 GMT
x-content-type-options
nosniff
age
24028
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5524
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:23 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Tue, 25 Apr 2023 17:53:22 GMT
LOnNfct_OK6AKwq7GByGz0_K8O7BrCXN6Fs6Py5gnPc.js
pagead2.googlesyndication.com/bg/ Frame B6CE 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/LOnNfct_OK6AKwq7GByGz0_K8O7BrCXN6Fs6Py5gnPc.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2ce9cd7dcb7f38ae802b0abb181c86cf4fcaf0eec1ac25cde85b3a3f2e609cf7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 09:08:20 GMT
content-encoding
br
x-content-type-options
nosniff
age
55530
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13636
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 11:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Apr 2023 09:08:20 GMT
congstarfont.woff2
s0.2mdn.net/creatives/assets/4234010/ Frame 0BE5 		98 KB
98 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/creatives/assets/4234010/congstarfont.woff2
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3743105294731802651/1643485919913.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1d019867c120344469403527c7d958861b81d0fc873813c97ee135f707d74122
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/3743105294731802651/1643485919913.css
Origin
https://s0.2mdn.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:26:20 GMT
x-content-type-options
nosniff
age
450
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100772
x-xss-protection
0
last-modified
Thu, 05 Aug 2021 09:13:07 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=900
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 00:41:20 GMT
86bef0b5-fa75-4ca3-8394-cb7b5a474a45-3.woff
s0.2mdn.net/creatives/assets/1881029/ Frame 0BE5 		57 KB
57 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/creatives/assets/1881029/86bef0b5-fa75-4ca3-8394-cb7b5a474a45-3.woff
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3743105294731802651/1643485919913.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
853a8c7e34be5549a44fc541e13876f5c2838123142f527dab2265950feaeefb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/3743105294731802651/1643485919913.css
Origin
https://s0.2mdn.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:25:19 GMT
x-content-type-options
nosniff
age
511
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
58447
x-xss-protection
0
last-modified
Wed, 15 Feb 2017 10:23:50 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=900
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 00:40:19 GMT
/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 0613
Redirect Chain
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESEB_XIXM7O6cO2jIu3JrNYZs&google_cver=1&google_push=AYg5qPJntLKgq5848U7A5xEaVYiljrYSt_ItyVJl_-puaJjhNx_kRJekIXion7qmlt_xGnGh5qNOuU60DVTpjRTfLpdkqjh_VWFV
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjQ4Mjc5NzY1MTk5NDE0NDQ4Nw==&gdpr=&gdpr_consent=
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESECgF-jhC7TuftvmPkoKY16g&google_cver=1
43 B
398 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESECgF-jhC7TuftvmPkoKY16g&google_cver=1
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Server
2001:678:cb4:bbbb::11 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type
image/gif
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESECgF-jhC7TuftvmPkoKY16g&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
329
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 0613
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEHubu3zFKRkXu6BsglPlTZI&google_cver=1&google_push=AYg5qPKLCHQfldgkQo7U0cABHOTh32bUYWR3oW4p1pK9uvECFxvddU27n1DM-nDU6pbnKCuHByFKLjyy5DcUJGc-...
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPKLCHQfldgkQo7U0cABHOTh32bUYWR3oW4p1pK9uvECFxvddU27n1DM-nDU6pbnKCuHByFKLjyy5DcUJGc-EpykS0MQoewr
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPKLCHQfldgkQo7U0cABHOTh32bUYWR3oW4p1pK9uvECFxvddU27n1DM-nDU6pbnKCuHByFKLjyy5DcUJGc-EpykS0MQoewr
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Tue, 26 Apr 2022 00:33:50 GMT
Server
MT3 4335 2c68c00 master ord-pixel-x54 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPKLCHQfldgkQo7U0cABHOTh32bUYWR3oW4p1pK9uvECFxvddU27n1DM-nDU6pbnKCuHByFKLjyy5DcUJGc-EpykS0MQoewr
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 26 Apr 2022 00:33:49 GMT
i.match
s.tribalfusion.com/z/ Frame 0613
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b6&u=CAESEB6GGRQbbx8U32XvZNvK_og&google_cver=1&google_push=AYg5qPL557z5Aj3puJeOIfqluppiPJWCRgH4bhJetyEcz5gX7Jug8vX_jhiywXG7Gybt6qH8KJEY6FtKcmaEc9ZwJspwhZTgQHEk&...
  • https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEB6GGRQbbx8U32XvZNvK_og&google_cver=1&google_push=AYg5qPL557z5Aj3puJeOIfqluppiPJWCRgH4bhJetyEcz5gX7Jug8vX_jhiywXG7Gybt6qH8KJEY6FtKcmaEc9ZwJspwhZTgQHE...
43 B
413 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEB6GGRQbbx8U32XvZNvK_og&google_cver=1&google_push=AYg5qPL557z5Aj3puJeOIfqluppiPJWCRgH4bhJetyEcz5gX7Jug8vX_jhiywXG7Gybt6qH8KJEY6FtKcmaEc9ZwJspwhZTgQHEk&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPL557z5Aj3puJeOIfqluppiPJWCRgH4bhJetyEcz5gX7Jug8vX_jhiywXG7Gybt6qH8KJEY6FtKcmaEc9ZwJspwhZTgQHEk%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Server
2606:4700:4400::ac40:98f5 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
701b3ab30df25c80-FRA
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
content-type
image/gif; charset=utf-8
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
cf-cache-status
DYNAMIC
x-function
206
server
cloudflare
x-reuse-index
16995
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
701b3ab1dcc75c80-FRA
p3p
CP="NOI DEVo TAIa OUR BUS"
location
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEB6GGRQbbx8U32XvZNvK_og&google_cver=1&google_push=AYg5qPL557z5Aj3puJeOIfqluppiPJWCRgH4bhJetyEcz5gX7Jug8vX_jhiywXG7Gybt6qH8KJEY6FtKcmaEc9ZwJspwhZTgQHEk&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPL557z5Aj3puJeOIfqluppiPJWCRgH4bhJetyEcz5gX7Jug8vX_jhiywXG7Gybt6qH8KJEY6FtKcmaEc9ZwJspwhZTgQHEk%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control
no-cache, private
content-type
text/html
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 0613
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEFrI-Q6nJovhy7Pk5DTpOCw&google_cver=1&google_push=AYg5qPJu8udNlxZpOclHGtwU06WRbhEgy9EVeodLfnIrDODk1rD0LiR8bN_kNi7G6K3L621s1L3dC6ik4tndOIt_p17-...
  • https://r.scoota.co/sync?ssp=bidswitch&bidswitch_ssp_id=google
  • https://r.scoota.co/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google
  • https://x.bidswitch.net/sync?dsp_id=29&expires=30&user_id=6ee336c8-5dcc-4515-aeb3-11a1cb5edc56&ssp=google
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJu8udNlxZpOclHGtwU06WRbhEgy9EVeodLfnIrDODk1rD0LiR8bN_kNi7G6K3L621s1L3dC6ik4tndOIt_p17-1BmjbVFd&google_hm=c40nf7WTTY-IEXVBzT9CEw==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJu8udNlxZpOclHGtwU06WRbhEgy9EVeodLfnIrDODk1rD0LiR8bN_kNi7G6K3L621s1L3dC6ik4tndOIt_p17-1BmjbVFd&google_hm=c40nf7WTTY-IEXVBzT9CEw==
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
//cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJu8udNlxZpOclHGtwU06WRbhEgy9EVeodLfnIrDODk1rD0LiR8bN_kNi7G6K3L621s1L3dC6ik4tndOIt_p17-1BmjbVFd&google_hm=c40nf7WTTY-IEXVBzT9CEw==
Date
Tue, 26 Apr 2022 00:33:50 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
dds
rtb.openx.net/sync/ Frame 0613 		43 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.openx.net/sync/dds?google_gid=CAESEFD6XZwrwHbjcG3bGEa5I4w&google_cver=1&google_push=AYg5qPKMl-i4Khe-hESd1_9PJJfk491JsCtvjgF2ID5BDO4jll9pjTzIM-piUyJaTfvLni6-dLR8VzkVxgPk39brs_ZjdKGvBtQ
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.186.253.211 -, , ASN (),
Reverse DNS
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
fu0n113gg3l7m5biop2vs815p93ithkh
pixel
cm.g.doubleclick.net/ Frame 0613
Redirect Chain
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEL9N2wpUCL7CenEXi7dRnI0&google_cver=1&google_push=AYg5qPK0KFq5kMT95KKPrtisdoCmoOAqdeAF1V_bW2H1Z3bScDErHzs6K7kR5hmlCUckOOzq0rIo8yIjoBmdxLtL3...
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEL9N2wpUCL7CenEXi7dRnI0&google_cver=1&google_push=AYg5qPK0KFq5kMT95KKPrtisdoCmoOAqdeAF1V_bW2H1Z3bScDErHzs6K7kR5hmlCUckOOzq0rIo8yIjoBmdxLtL3...
  • https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPK0KFq5kMT95KKPrtisdoCmoOAqdeAF1V_bW2H1Z3bScDErHzs6K7kR5hmlCUckOOzq0rIo8yIjoBmdxLtL3qGlaunndk2d&google_hm=bd18803b56f2c90a44e17957
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPK0KFq5kMT95KKPrtisdoCmoOAqdeAF1V_bW2H1Z3bScDErHzs6K7kR5hmlCUckOOzq0rIo8yIjoBmdxLtL3qGlaunndk2d&google_hm=bd18803b56f2c90a44e17957
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Tue, 26 Apr 2022 00:33:50 GMT
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Location
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPK0KFq5kMT95KKPrtisdoCmoOAqdeAF1V_bW2H1Z3bScDErHzs6K7kR5hmlCUckOOzq0rIo8yIjoBmdxLtL3qGlaunndk2d&google_hm=bd18803b56f2c90a44e17957
Access-Control-Allow-Credentials
true
Connection
close
X-Sovrn-Pod
ad_ap3ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
pixel
cm.g.doubleclick.net/ Frame 0613
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEEo9SCvmkV7TYi5hbZqxEp4&google_cver=1&google_push=AYg5qPL7Dxr83Y9AICVK-RCHZbFJR2mKHLiuaAKM8BaMhKz9R1gtKVQohJQ15vhf1EezC1iFamEkqNjBFqjxBF2e5Nv1mzcXOG4
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg3NzQ0NDMzNjI1NzU4MjU0Mzc5MA%3D%3D&google_push=AYg5qPL7Dxr83Y9AICVK-RCHZbFJR2mKHLiuaAKM8BaMhKz9R1gtKVQo...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg3NzQ0NDMzNjI1NzU4MjU0Mzc5MA%3D%3D&google_push=AYg5qPL7Dxr83Y9AICVK-RCHZbFJR2mKHLiuaAKM8BaMhKz9R1gtKVQohJQ15vhf1EezC1iFamEkqNjBFqjxBF2e5Nv1mzcXOG4
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg3NzQ0NDMzNjI1NzU4MjU0Mzc5MA%3D%3D&google_push=AYg5qPL7Dxr83Y9AICVK-RCHZbFJR2mKHLiuaAKM8BaMhKz9R1gtKVQohJQ15vhf1EezC1iFamEkqNjBFqjxBF2e5Nv1mzcXOG4
date
Tue, 26 Apr 2022 00:33:50 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
attr
cm.g.doubleclick.net/pixel/ Frame 0613 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IOJs9lWFCnRJwqdup3qCFwyV4cwax7hBiqSvEE4aTddCK1xAXRCslO9rmwpy71qpc133Kx
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
HdsydzJK.js
tpc.googlesyndication.com/sodar/ Frame 5CEA 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/HdsydzJK.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220418_RC00/outstream.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 08:37:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
489389
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15407
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Apr 2023 08:37:21 GMT
file.mp4
r2---sn-5hnekn76.c.2mdn.net/videoplayback/id/d4755f6162d05106/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682469230/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 5CEA
Redirect Chain
  • https://gcdn.2mdn.net/videoplayback/id/d4755f6162d05106/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682469230/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
  • https://r5---sn-5hnekn76.c.2mdn.net/videoplayback/id/d4755f6162d05106/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682469230/sparams/acao,ctier,expire,id,ip,ipbits,ita...
  • https://r2---sn-5hnekn76.c.2mdn.net/videoplayback/id/d4755f6162d05106/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682469230/sparams/acao,ctier,expire,id,ip,ipbits,ita...
0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://r2---sn-5hnekn76.c.2mdn.net/videoplayback/id/d4755f6162d05106/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682469230/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/1CCDE96F375FD95724F314C6CC9042C0E06B8B96.0A7A08D85922A1D0DDD353E73CBFADBD93D48D6D/key/cms1/cms_redirect/yes/mh/Mi/mip/2a00:c98:2050:a007:2::3/mm/42/mn/sn-5hnekn76/ms/onc/mt/1650932828/mv/u/mvi/5/pl/56/ir/1/rr/12/file/file.mp4
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
HTTP/1.1
Server
2a00:1450:400e::7 -, , ASN (),
Reverse DNS
Software
gvs 1.0 /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Tue, 26 Apr 2022 00:33:50 GMT
X-Content-Type-Options
nosniff
Connection
close
Alt-Svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length
2415663
Last-Modified
Mon, 25 Apr 2022 11:02:00 GMT
Server
gvs 1.0
Vary
Origin
Content-Type
video/mp4
Access-Control-Allow-Origin
null
Access-Control-Expose-Headers
Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control
private, max-age=86400
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Timing-Allow-Origin
null
Expires
Tue, 26 Apr 2022 00:33:50 GMT

Redirect headers

Date
Tue, 26 Apr 2022 00:33:50 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 02 May 2007 10:26:10 GMT
Server
gvs 1.0
Location
https://r2---sn-5hnekn76.c.2mdn.net/videoplayback/id/d4755f6162d05106/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682469230/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/1CCDE96F375FD95724F314C6CC9042C0E06B8B96.0A7A08D85922A1D0DDD353E73CBFADBD93D48D6D/key/cms1/cms_redirect/yes/mh/Mi/mip/2a00:c98:2050:a007:2::3/mm/42/mn/sn-5hnekn76/ms/onc/mt/1650932828/mv/u/mvi/5/pl/56/ir/1/rr/12/file/file.mp4
Vary
Origin
Content-Type
text/html
Access-Control-Allow-Origin
null
Access-Control-Expose-Headers
Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control
private, max-age=900
Access-Control-Allow-Credentials
true
Connection
close
Timing-Allow-Origin
null
Content-Length
0
Expires
Tue, 26 Apr 2022 00:33:50 GMT
csi
csi.gstatic.com/ Frame 5CEA 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~l2ff0p7v&c=5293576886604&slotId=2646788443302&qqid=CPaq18W9sPcCFQG7dwodI4UDmA&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=1000&br=769&mt=video%2Fmp4&vs=720x720&ulv=1&cll=0&vmfc=11&vhc=0&msm=1&aits=0%2C18%2C22%2C692%2C59%2C342%2C343%2C344%2C345%2C346%2C347&webm=0&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=346&vsrc=web_video_ads&ape=1&met.4=videopreviewvisible.1pv
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220418_RC00/outstream.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4009:824::2003 -, , ASN (),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:51 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame D752 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bow2w7T1nYq_ZKoui9u8Pg9242AoAAAAAOAHgBAI&bg=!z8ylzIjNAAYXWUUuN1k7ACkAdvg8WjGTCAad-h1viHU1WOym-hyobOSCT6NJqyDR7Hts70jhPVv4kwIAAAC_UgAAAAFoAQeZAvKGok-F7Eled71ubIvWWtfJrq8CnL3QZ7aJMVwdBgn7iycHAXMY00VD9-JiOPHFIQNbXK9xLS7hKdAWoBWJPksaCeBMRhM2iPCz7vOyPAwwEK2XhO3zKeAkImJdgRfoIqxoNZGc6k15FxIqX4JnKLd7MjoP0L_4NhJuYMM_r24EEJKdfgKfFk3IgkgX-JRRaObB1nKYrQWXJ5n1JwRkx77yBzqmz9TaIckrAXYjTCtfvPBd4-wuPzGN75cd4wJ8Rp_CMsaeYxe6w8IYIx9e6WlQQJDIrmbn4rlCzqy6E5WP2A1udPEmb_w1oqqZW8tp-O3aW3PIgsv9Arjul5WuD1Ff18wEDY34zITPF-Eg644UkFUQ_b5tP_i1MqPdaJk_EWgxZdGd8W6yw63L8rjwj4nuVNr35a5rSLicFKJR68pxhPIaBJfERe9ObtHMLNwXFMBAtmSKF2bHsviPaNuKSKGar0x2RA2oo4ipRvYd_1AmfkUSGHX5QwshHPcJ-ogg5ozmrd86GDy2tnKjfSkEy6rWTLmCYgGfIOkRsWI1JB9XiEGlrvBhNKe2gbV0CW43F1MG0P1mktAv3REUyihfQDduT6zMC7cOQU1P7H4XmJyjoW4GkdL-fwMhbq09ExNwHOJ0EY_bWr9UZGyODbtIUmdT_JWNTMrS3st1YL8EJH-sEjjqzNt4F_p_0r_yxb66F0LKxwr898ixoS-edY0leDMGhjqTSRTEeb65698GG0QtBnx2RZNekAvaPJkNtN8q76d4WYdYmKQtgN-blW5x5GcN22eTzotkDFO3sfmGX8lczlXH16A6uhUUI27XCYRwNFh-I4oD9ih5g6qdlEyZMchXCOirrOuLGbb3WyzVjQMabvTjSDTukp9vrhIZimWqJb3P3WxtOD37qpC_8I6SVtEwR5VV2moCRgZGUMhICNjuMdZvYRKpTAH-Lv1O6iNlBKybS9hD1FLnLetEGe8-TKcUmFaXZoARlm3bj7O6Po7wjEop
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
m18gb-tacho_fairflat9991d849-ba8e-45c7-82a1-eaa84a1b997b.png
s0.2mdn.net/4528404/ Frame 0BE5 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/4528404/m18gb-tacho_fairflat9991d849-ba8e-45c7-82a1-eaa84a1b997b.png
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
36c13e7d4ca5f849cc56ca5f3bfec462d21e7726759ed48ae54975a2a4f8c8a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/3743105294731802651/index.html?e=69&leftOffset=0&topOffset=0&c=2sRKxn12zM&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 12:39:39 GMT
x-content-type-options
nosniff
age
42851
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12529
x-xss-protection
0
last-modified
Fri, 30 Jul 2021 07:14:10 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 12:39:39 GMT
m5gb-tacho_fairflat97069ca6-ba9a-458d-b518-e9e966091518.png
s0.2mdn.net/4528404/ Frame 0BE5 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/4528404/m5gb-tacho_fairflat97069ca6-ba9a-458d-b518-e9e966091518.png
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4450ea25a2cd96ef28f12b921b645248e76d4fc7389dbed6c183cc91cadef186
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/3743105294731802651/index.html?e=69&leftOffset=0&topOffset=0&c=2sRKxn12zM&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 12:04:20 GMT
x-content-type-options
nosniff
age
44970
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10927
x-xss-protection
0
last-modified
Fri, 30 Jul 2021 07:14:09 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 12:04:20 GMT
container.html
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6EE7 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.webtretho.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, immutable, max-age=31536000
content-encoding
gzip
content-length
3108
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 00:33:48 GMT
expires
Wed, 26 Apr 2023 00:33:48 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
m18gb-tacho_fairflat9991d849-ba8e-45c7-82a1-eaa84a1b997b.png
s0.2mdn.net/4528404/ Frame 0BE5 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/4528404/m18gb-tacho_fairflat9991d849-ba8e-45c7-82a1-eaa84a1b997b.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3743105294731802651/1643485919913.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
36c13e7d4ca5f849cc56ca5f3bfec462d21e7726759ed48ae54975a2a4f8c8a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/3743105294731802651/index.html?e=69&leftOffset=0&topOffset=0&c=2sRKxn12zM&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 12:39:39 GMT
x-content-type-options
nosniff
age
42851
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12529
x-xss-protection
0
last-modified
Fri, 30 Jul 2021 07:14:10 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Apr 2022 12:39:39 GMT
H0ZEmIz7.html
tpc.googlesyndication.com/sodar/ Frame 725A 		23 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
489379
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8727
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 20 Apr 2022 08:37:31 GMT
expires
Thu, 20 Apr 2023 08:37:31 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
css
fonts.googleapis.com/ Frame 6EE7 		2 KB
532 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e88adda18aa09bcb1b6747436882f40a0074574df0ca4bc130779bb440e19d9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 00:17:18 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 26 Apr 2022 00:33:50 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 26 Apr 2022 00:33:50 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame 6EE7 		2 KB
904 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:18:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
944
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
877
x-xss-protection
0
server
cafe
etag
13035868154101442325
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:18:06 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 6EE7 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CYFu67j1nYpWoAfeQjuwPis60iAvM-LDoadug07j0D__Q3_-NMBABINCv1ypglbr4gZQHoAGMoYnxAsgBCakCcU2TVm8qcj7gAgCoAwHIA8sEqgTaAk_QRn0DflFxcNYBt6Q_sYKnPTzG9gCms9Grg4y9sHr_kTYZgTJK4-nH7cmMkXR-LMwShNyTbjc9bdUaRegnw-SktUULqexPIWiBM15mGL8Fj4gsn_XPe_rbVCh4E6qjCmATp8Y0BI1YFwS-h7Ekjikfu7zTTwwbbXG4l9KvBLwUSgQNmR8Vynu18zjB1quWcptUsUGrrjPpsRIbHDsYr-MskV8ScuTSuCadCcPQ4OFDfy3vu6Jd9BBWbwxaxC7kPs60O6-giXMvdXm1YMYdaYTD3Atpiv_hLgBImu0_3JjBChEskv5D58r3xBzbRqlxdg4vWPjc5zJbO_yPnnJnL7QJ6DHsEyR-s0143LyNpb0oSJFHbeHMKpvSCn14DNosET39BDOuJqSYpaVgKYkoM6W57a2Lf5wvNUhZkSnDeI0HzDdE-pSd54WoDEKfEtlOn5JvKHzSMVGhRgjABKLZ_JnoA-AEAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAerlOGlAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB6a-G9gHAPIHBBDfrSPSCAkIgOGAEBABGB2ACgPICwHYEwvQFQGAFwGyFx4KHAgAEhRwdWItMjYzMDU5NjkyMjE3NzAwNhjwwRM&sigh=AFDIZp-_Tgo&uach_m=[UACH]&template_id=494
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/ Frame 6EE7 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/abg_lite_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a7d5c1bfe43c8beefab2fa059f4fcaa029fcbbace9a672aae1dfe1ffb7d6976c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:30:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
216
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8002
x-xss-protection
0
server
cafe
etag
5332015062585099865
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:30:14 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame 6EE7 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/window_focus_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:32:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
88
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1359
x-xss-protection
0
server
cafe
etag
1484984001845508991
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:32:22 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 6EE7 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36950
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1650454428054601"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 26 Apr 2022 00:33:50 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame 6EE7 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:32:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
70
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6409
x-xss-protection
0
server
cafe
etag
15284592792851369840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:32:40 GMT
l
www.google.com/ads/measurement/ Frame 6EE7 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQttzUfKdIgqmp95gHNf0L3ADcRtdo1fx-pi_MoqCZ1tdBK7Y7wpIWm2v8wEVPub-F534dIP89GguMFa4cMxpsWcrePVA
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers
3bde1d5944145a46a8b91d920db5ec4d.js
www.gstatic.com/mysidia/ Frame 6EE7 		30 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/3bde1d5944145a46a8b91d920db5ec4d.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f748110cf8280254c6705d7cf18de8b04369c521d9db43e63897e531c283578d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 05:46:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
67647
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12194
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 05:04:18 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="mysidia"
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Sun, 24 Jul 2022 05:46:23 GMT
shopping
encrypted-tbn0.gstatic.com/ Frame 6EE7 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcQt0KHPVedFhmamhAhXbaNkBd2Uwp51sO0S9bXYYDH7G8WTC_KlxUZGRg_paA&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a82cfc0898db1cd7583fca737233cf33e59df6244bffe7d187ca9ad17f63366c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 19 Apr 2022 09:15:33 GMT
x-content-type-options
nosniff
age
573497
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7330
x-xss-protection
0
last-modified
Mon, 07 Feb 2022 21:16:36 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Wed, 19 Apr 2023 09:15:33 GMT
shopping
encrypted-tbn0.gstatic.com/ Frame 6EE7 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcRj7qFApB71PzjD3h51dcHoYhNdqsYVhsB7n8sm_R2fTUYf6P15uXAX670iEw&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
24d89bc712c365bc98cded7d5b7a28996c96cfaf7671361f1416495d7b1ae935
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Thu, 21 Apr 2022 04:00:09 GMT
x-content-type-options
nosniff
age
419621
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37501
x-xss-protection
0
last-modified
Fri, 04 Jun 2021 01:19:22 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Fri, 21 Apr 2023 04:00:09 GMT
shopping
encrypted-tbn1.gstatic.com/ Frame 6EE7 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcQtjHpn0SPzvGKWdDCnURMarFoaZg77sQ0FB5CMrAbDgKVlsjsb8Gt2YSSdfZ4&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
db4dcb0e61cb376e3875e18c4a2ecd03ddc625f83928b6cda311c7039ea0f7ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Fri, 22 Apr 2022 05:35:00 GMT
x-content-type-options
nosniff
age
327530
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31589
x-xss-protection
0
last-modified
Fri, 08 Apr 2022 01:39:45 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Sat, 22 Apr 2023 05:35:00 GMT
shopping
encrypted-tbn1.gstatic.com/ Frame 6EE7 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcQyDJVMcrIpou6J2WyCADFGYP11IViUUAPohc3VnpAoldbe6cSbCCS9WZ2EKQ&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6738250294e9e45166c759ac86bd0ae0f45990d418e2cca3beca405a28528089
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sun, 24 Apr 2022 18:12:40 GMT
x-content-type-options
nosniff
age
109270
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19083
x-xss-protection
0
last-modified
Sun, 10 Apr 2022 02:10:51 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Mon, 24 Apr 2023 18:12:40 GMT
shopping
encrypted-tbn3.gstatic.com/ Frame 6EE7 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcQZjY35Hj4dmpFuth0v_-stiWY-cYt7bhWr5hFfWmgxBc99yE3YGSRpf9qk9A&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7490d60f3417f4542fd4ca238107b42b487694de022ee46549fde0ad73bc07d9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sun, 24 Apr 2022 12:19:16 GMT
x-content-type-options
nosniff
age
130474
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28552
x-xss-protection
0
last-modified
Sun, 24 Apr 2022 01:56:19 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Mon, 24 Apr 2023 12:19:16 GMT
shopping
encrypted-tbn0.gstatic.com/ Frame 6EE7 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcTsKrPEhukq6bD_CURt6qSrZF-CU-QIUY4Ji9Z60NTdVPsrUMg&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7a9a7ca080dfdd54223b6f65bca630e5fa23b5ed2bc32d5e88ec7e86dd4c413a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 19 Apr 2022 18:53:19 GMT
x-content-type-options
nosniff
age
538831
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22272
x-xss-protection
0
last-modified
Wed, 02 Feb 2022 11:14:04 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Wed, 19 Apr 2023 18:53:19 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame F2ED 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
67206
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
gzip
content-length
724
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 25 Apr 2022 05:53:44 GMT
etag
48472445140208031
expires
Tue, 26 Apr 2022 05:53:44 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 6EE7 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ff28c2ecaab0c068fb5c2db084aaad89f02a14132f13d8606e7f3a66aa7bfc2d

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/png
JAPUMHT_zNnrVfwA4fX3UESFQekER8YYbnBYivkpjVo.js
pagead2.googlesyndication.com/bg/ Frame 725A 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/JAPUMHT_zNnrVfwA4fX3UESFQekER8YYbnBYivkpjVo.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2403d43074ffccd9eb55fc00e1f5f750448541e90447c6186e70588af9298d5a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 19:15:30 GMT
content-encoding
br
x-content-type-options
nosniff
age
19100
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13448
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 11:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Apr 2023 19:15:30 GMT
ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v21/ Frame 6EE7 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
acc5497e76f832d950d14fcfa047dc3c864f7a0aae4c7a20521c0c655a53033b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 19 Apr 2022 22:12:48 GMT
x-content-type-options
nosniff
age
526862
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20784
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:21:31 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Apr 2023 22:12:48 GMT
cm
a.rfihub.com/ Frame F2ED
Redirect Chain
  • https://p.rfihub.com/cm?in=1&pub=445&google_gid=CAESEM8Ttt5mHHOeWk57D3h35Lo&google_cver=1&google_push=AYg5qPIJ1Pca7Gv99g_bT7DtW0WJ5SXXEF6GL-wRrFXlTtdz52bjRyXRbL3uVFvSEtOOXDIbeaRGZdFKvDPvHGNELxJ2reV...
  • https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPIJ1Pca7Gv99g_bT7DtW0WJ5SXXEF6GL-wRrFXlTtdz52bjRyXRbL3uVFvSEtOOXDIbeaRGZdFKvDPvHGNELxJ2reV2h-oa&google_hm=MzUxNjY1NDU...
  • https://a.rfihub.com/cm?pub=445&google_error=5
42 B
816 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.rfihub.com/cm?pub=445&google_error=5
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
HTTP/1.1
Server
193.0.160.129 -, , ASN (),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Tue, 26 Apr 2022 00:33:50 GMT
Cache-Control
no-cache
Server
Jetty(9.3.29.v20201019)
Content-Type
image/gif
Content-Length
42
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://a.rfihub.com/cm?pub=445&google_error=5
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
247
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame F2ED
Redirect Chain
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEHHIX-uT-fFM7iD8ACJ_MDQ&google_cver=1&google_push=AYg5qPK5IQ3VT83gCzLOVPYBH_rtumPrr1IfEzDLh7mjeW8VE0xDpYSTcHr-SESEr1PLQfEnN-lAnbb2DPC...
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPK5IQ3VT83gCzLOVPYBH_rtumPrr1IfEzDLh7mjeW8VE0xDpYSTcHr-SESEr1PLQfEnN-lAnbb2DPCuefIzYiGMWL4ZsSX5&google_hm=uzpNLx0eRcGoO_7pgeVdG4Q
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPK5IQ3VT83gCzLOVPYBH_rtumPrr1IfEzDLh7mjeW8VE0xDpYSTcHr-SESEr1PLQfEnN-lAnbb2DPCuefIzYiGMWL4ZsSX5&google_hm=uzpNLx0eRcGoO_7pgeVdG4Q
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
via
1.1 google
server
Apache-Coyote/1.1
status
302
p3p
CP="NOI DSP COR NID CUR OUR NOR"
location
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPK5IQ3VT83gCzLOVPYBH_rtumPrr1IfEzDLh7mjeW8VE0xDpYSTcHr-SESEr1PLQfEnN-lAnbb2DPCuefIzYiGMWL4ZsSX5&google_hm=uzpNLx0eRcGoO_7pgeVdG4Q
cache-control
no-cache, must-revalidate
content-type
text/html;charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
gg_pixel
sync.adaptv.advertising.com/ Frame F2ED 		0
0
pixel
cm.g.doubleclick.net/ Frame F2ED
Redirect Chain
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEK-udkh6GYvCsFDpGJBuVow&google_cver=1&google_push=AYg5qPLTIlHUk7I_EzKD_KA70p7jfVuqm_ZSVCiiN6yURVk2iRsb05FDIU2Z0X6BWEZCYd76uSO3YD_9...
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEK-udkh6GYvCsFDpGJBuVow&google_cver=1&google_push=AYg5qPLTIlHUk7I_EzKD_KA70p7jfVuqm_ZSVCiiN6yURVk2iRsb05FDIU2Z0X6BWEZCYd76uSO...
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzk5NDgyMjMxODY1MTY2MDEyMQ&google_push=AYg5qPLTIlHUk7I_EzKD_KA70p7jfVuqm_ZSVCiiN6yURVk2iRsb05FDIU2Z0X6BWEZCYd76uSO3YD...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzk5NDgyMjMxODY1MTY2MDEyMQ&google_push=AYg5qPLTIlHUk7I_EzKD_KA70p7jfVuqm_ZSVCiiN6yURVk2iRsb05FDIU2Z0X6BWEZCYd76uSO3YD_995uIxieMvY78aEeo3c2n
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
nginx
location
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzk5NDgyMjMxODY1MTY2MDEyMQ&google_push=AYg5qPLTIlHUk7I_EzKD_KA70p7jfVuqm_ZSVCiiN6yURVk2iRsb05FDIU2Z0X6BWEZCYd76uSO3YD_995uIxieMvY78aEeo3c2n
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
dds
rtb.openx.net/sync/ Frame F2ED 		43 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.openx.net/sync/dds?google_gid=CAESED-kSBSmJGEWbUPLJUK7KcA&google_cver=1&google_push=AYg5qPJWaKzfQPdZJDk8VsATbrKmPyKiDAVLGKaSkSvOdvAElk_Q_hLlkhEcuq2zKwFPGKdl6RH45_YGmsPASb7QsKBY02OfWI8
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.186.253.211 -, , ASN (),
Reverse DNS
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:49 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
vlnppjahgjvr2irfiu8md3tej9kqsfi0
pixel
cm.g.doubleclick.net/ Frame F2ED
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESELasfuegd4wTTNeWwHLwK4o&google_cver=1&google_push=AYg5qPINp56IYwuaPI4wHK1Hu-_eG3a5RX_zOK8DJiipMtXscyP25a77GO8Yt1FoFJLqPpX9rU1vQQGrV2owbO5ZcP-CxDZY3CjO
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg3NzQ0NDMzNjI1NzU4MjU0Mzc5MA%3D%3D&google_push=AYg5qPINp56IYwuaPI4wHK1Hu-_eG3a5RX_zOK8DJiipMtXscyP25a77...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg3NzQ0NDMzNjI1NzU4MjU0Mzc5MA%3D%3D&google_push=AYg5qPINp56IYwuaPI4wHK1Hu-_eG3a5RX_zOK8DJiipMtXscyP25a77GO8Yt1FoFJLqPpX9rU1vQQGrV2owbO5ZcP-CxDZY3CjO
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg3NzQ0NDMzNjI1NzU4MjU0Mzc5MA%3D%3D&google_push=AYg5qPINp56IYwuaPI4wHK1Hu-_eG3a5RX_zOK8DJiipMtXscyP25a77GO8Yt1FoFJLqPpX9rU1vQQGrV2owbO5ZcP-CxDZY3CjO
date
Tue, 26 Apr 2022 00:33:50 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
pixel
cm.g.doubleclick.net/ Frame F2ED
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEN0aZXRF-wzdUnzHMq73Mx8&google_cver=1&google_push=AYg5qPIqS6lDkpnIQBUgU_fRL93X1CjjKCztej85UrsZXxrfu33ZOifWyPsmrHwo8jXkWMRi1j...
  • https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1jSGRWNlVwRTJ1SFFWc2p2VVBmeWVkTUNLdWRsMVhoNX5B&google_push=AYg5qPIqS6lDkpnIQBUgU_fRL93X1CjjKCztej85UrsZXxrfu33ZOifWy...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1jSGRWNlVwRTJ1SFFWc2p2VVBmeWVkTUNLdWRsMVhoNX5B&google_push=AYg5qPIqS6lDkpnIQBUgU_fRL93X1CjjKCztej85UrsZXxrfu33ZOifWyPsmrHwo8jXkWMRi1j72DJyZshq8gFBNP7IJotRsxbRLVw
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1jSGRWNlVwRTJ1SFFWc2p2VVBmeWVkTUNLdWRsMVhoNX5B&google_push=AYg5qPIqS6lDkpnIQBUgU_fRL93X1CjjKCztej85UrsZXxrfu33ZOifWyPsmrHwo8jXkWMRi1j72DJyZshq8gFBNP7IJotRsxbRLVw
date
Tue, 26 Apr 2022 00:33:50 GMT
server
ATS/9.1.0.46
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
attr
cm.g.doubleclick.net/pixel/ Frame F2ED 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KGtXI7SDjAPzcGizFU0HZkuEy6zINt8No32y-LBKEY0pJUgzfveyx3uRMnmwOGYBavdhEqMQ
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
JAPUMHT_zNnrVfwA4fX3UESFQekER8YYbnBYivkpjVo.js
pagead2.googlesyndication.com/bg/ Frame 67B2 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/JAPUMHT_zNnrVfwA4fX3UESFQekER8YYbnBYivkpjVo.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2403d43074ffccd9eb55fc00e1f5f750448541e90447c6186e70588af9298d5a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 19:15:30 GMT
content-encoding
br
x-content-type-options
nosniff
age
19100
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13448
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 11:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Apr 2023 19:15:30 GMT
file.mp4
r2---sn-5hnekn76.c.2mdn.net/videoplayback/id/d4755f6162d05106/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682469230/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 5CEA 		2 MB
2 MB 		Media
General
Check archive.org
Download Go to
Full URL
https://r2---sn-5hnekn76.c.2mdn.net/videoplayback/id/d4755f6162d05106/itag/346/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682469230/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/1CCDE96F375FD95724F314C6CC9042C0E06B8B96.0A7A08D85922A1D0DDD353E73CBFADBD93D48D6D/key/cms1/cms_redirect/yes/mh/Mi/mip/2a00:c98:2050:a007:2::3/mm/42/mn/sn-5hnekn76/ms/onc/mt/1650932828/mv/u/mvi/5/pl/56/ir/1/rr/12/file/file.mp4
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400e::7 -, , ASN (),
Reverse DNS
Software
gvs 1.0 /
Resource Hash
e5c7f035a8ef5c8af9e2ddbc483d4492000ecc92cb08a35c21294c33a23503b6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Range
bytes=0-

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
x-content-type-options
nosniff
Content-Range
bytes 0-2415662/2415663
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length
2415663
expires
Tue, 26 Apr 2022 00:33:50 GMT
last-modified
Mon, 25 Apr 2022 11:02:00 GMT
server
gvs 1.0
vary
Origin
content-type
video/mp4
access-control-allow-origin
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
access-control-expose-headers
Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control
private, max-age=86400
access-control-allow-credentials
true
accept-ranges
bytes
timing-allow-origin
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
client-protocol
quic
csi
csi.gstatic.com/ Frame 5CEA 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=3~l2ff0pbo&c=5293576886604&slotId=2646788443302&qqid=CPaq18W9sPcCFQG7dwodI4UDmA&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=1000&br=769&mt=video%2Fmp4&vs=720x720&ple=1&umsem=0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fgcdn.2mdn.net%252Fvideoplayback%252Fid%252Fd4755f6162d05106%252Fitag%252F346%252Fsource%252Fweb_video_ads%252Fctier%252FL%252Facao%252Fyes%252Fip%252F0.0.0.0%252Fipbits%252F0%252Fexpire%252F1682469230%252Fsparams%252Fip%252Cipbits%252Cexpire%252Cid%252Citag%252Csource%252Cctier%252Cacao%252Fsignature%252F5EECCE1040866738B931CE1BE2A05C305D9AB0D4.77E709DCBD0F5F66704C9F19D480D3588BA5307A%252Fkey%252Fck2%252Ffile%252Ffile.mp4&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220418_RC00/outstream.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4009:824::2003 -, , ASN (),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:51 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E815 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.webtretho.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, immutable, max-age=31536000
content-encoding
gzip
content-length
3108
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 00:33:48 GMT
expires
Wed, 26 Apr 2023 00:33:48 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
css
fonts.googleapis.com/ Frame E815 		2 KB
532 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e88adda18aa09bcb1b6747436882f40a0074574df0ca4bc130779bb440e19d9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 00:13:35 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 26 Apr 2022 00:33:50 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 26 Apr 2022 00:33:50 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame E815 		2 KB
904 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:18:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
944
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
877
x-xss-protection
0
server
cafe
etag
13035868154101442325
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:18:06 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame E815 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=C9Id07j1nYpe3FIGX3gPoh4yoBMaFhOdptLHchJYPh_uB2ZISEAEg0K_XKmCVuviBlAegAePAq8cDyAEJqQKs2kxmNPexPuACAKgDAcgDy4SAAqoE0QJP0Dxx8iWRtrAl4nfcSWBqtem5XUt2P2VVS-iCnjc5Vjg9VGQkfNncbdaRTrx4y_p-4RsHw6bIEnloDGVaNbiGZhN_Z5s00xo2LHf6DciZww_2-BFmIr2VQB0d_Q0ypw5EaWJref4dUuqK-kKRSpYUnFyWtrDmUEKaF-vy6Xm3PNO3d2EGCgBULCMhiQOun7CkMJ7ArO4qiv4SS98T7uLR_JtYdC6eSfen7LUrmUh2Y91AQ3Nws7W6RCTUKExXNsGrLcvTU0Ze-hQTjHdZ7ljQf64DIDYgsc7ghK3ogINH85T-ex-MsvdphBskV7PmDJiXD4IhdWGwIg0B1_qtB1fgs7wbJte-nIUTtKz5rNu44C_jcLd1lSsL338cMCsDKp9EAAIIqLhkC794tL3H9UhjONWgPVKkrSrE6f_5RlCq7690VKt0hnt2tC9LGfs-F_DxwAT6t4W6gALgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH0f-MJqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB6a-G9gHAPIHBBDm7hPSCAkIgOGAEBABGB2ACgPICwHYEwvQFQGAFwGyFx4KHAgAEhRwdWItMjYzMDU5NjkyMjE3NzAwNhjwwRM&sigh=jPzqs5n6DdM&uach_m=[UACH]&cid=CAQSPACNIrLMGxbNbigJUAaVohcMF7aOhU-B4FqAtZtCprlXcAxL6vJR8gzOsXPILZcCTriIBLPhxF4QujSELxgB&template_id=494
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/ Frame E815 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/abg_lite_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a7d5c1bfe43c8beefab2fa059f4fcaa029fcbbace9a672aae1dfe1ffb7d6976c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:30:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
216
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8002
x-xss-protection
0
server
cafe
etag
5332015062585099865
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:30:14 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame E815 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/window_focus_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:32:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
88
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1359
x-xss-protection
0
server
cafe
etag
1484984001845508991
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:32:22 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame E815 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36950
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1650454428054601"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 26 Apr 2022 00:33:50 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/ Frame E815 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220421/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:32:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
70
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6409
x-xss-protection
0
server
cafe
etag
15284592792851369840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 10 May 2022 00:32:40 GMT
l
www.google.com/ads/measurement/ Frame E815 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRgqfkYVOLYIw1Sk408_Z6LVvdFi56CQLrW5jFLS9QiOTGgekAh314N0My63BKkoXkhF3usBTnUWCCnSl3-L9c5dew3GA
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers
3bde1d5944145a46a8b91d920db5ec4d.js
www.gstatic.com/mysidia/ Frame E815 		30 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/3bde1d5944145a46a8b91d920db5ec4d.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f748110cf8280254c6705d7cf18de8b04369c521d9db43e63897e531c283578d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 05:46:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
67647
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12194
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 05:04:18 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="mysidia"
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Sun, 24 Jul 2022 05:46:23 GMT
shopping
encrypted-tbn2.gstatic.com/ Frame E815 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcQHiS59YC2OoJ1elz-FgyJ43rJgHjf1nu_uCDbnklHUddquGhQ&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e -, , ASN (),
Reverse DNS
Software
sffe /
Resource Hash
7fdd701f4c76d3899a7853e38fc05ceb4364b6dd082aba974fe2828cf0900fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sun, 24 Apr 2022 14:01:51 GMT
x-content-type-options
nosniff
age
124319
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11507
x-xss-protection
0
last-modified
Fri, 20 Aug 2021 01:27:32 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Mon, 24 Apr 2023 14:01:51 GMT
shopping
encrypted-tbn3.gstatic.com/ Frame E815 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcS3ToWIeve-bZiBfIRVajbTH_h91PeuSsGLP6hhO_UrUI-wVBvf&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1c62b6b676f29cd0815755615a821f059061d167b41f0209a67b8570848f80ed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sun, 24 Apr 2022 12:04:59 GMT
x-content-type-options
nosniff
age
131331
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17025
x-xss-protection
0
last-modified
Sun, 20 Feb 2022 01:15:52 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Mon, 24 Apr 2023 12:04:59 GMT
shopping
encrypted-tbn3.gstatic.com/ Frame E815 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcS9RFLLplJsHrc934QNhgruBjzCRIuQoOApYNHAZIFeIoqEZoE&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a3127ac204e6d6439f2edd47894bd5f9ab709b2fc0b75066c8e8ffa2b8397085
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 06:11:09 GMT
x-content-type-options
nosniff
age
66161
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18748
x-xss-protection
0
last-modified
Fri, 12 Nov 2021 01:46:21 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Tue, 25 Apr 2023 06:11:09 GMT
shopping
encrypted-tbn0.gstatic.com/ Frame E815 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcRn4QDW6yo53H10KmKnvXwwnRGoZ5zB35wMeoGweKAmMeEiSC8&usqp=CAI
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3d295d53df418908ac2940f344e33b4d459774e7ef5023813687b4baa5ffe8e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sun, 24 Apr 2022 05:35:13 GMT
x-content-type-options
nosniff
age
154717
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9685
x-xss-protection
0
last-modified
Fri, 11 Feb 2022 03:07:26 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Mon, 24 Apr 2023 05:35:13 GMT
7103612115487317334
tpc.googlesyndication.com/simgad/ Frame E815
Redirect Chain
  • https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKCL57XsHBCABBiAATIIgoSA_Oqki0U
  • https://tpc.googlesyndication.com/simgad/7103612115487317334
5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/7103612115487317334
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
24fe63307e2903b2a4b2d80c28383d91861dc9ade1b28feac920e9f5f7b7dddd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 19 Apr 2022 19:00:08 GMT
x-content-type-options
nosniff
age
538422
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5156
x-xss-protection
0
last-modified
Mon, 18 Nov 2019 11:07:29 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Wed, 19 Apr 2023 19:00:08 GMT

Redirect headers

date
Mon, 25 Apr 2022 23:37:15 GMT
x-content-type-options
nosniff
server
cafe
age
3395
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/html; charset=UTF-8
location
https://tpc.googlesyndication.com/simgad/7103612115487317334
cache-control
public, max-age=2592000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Wed, 25 May 2022 23:37:15 GMT
Arf.min.js
media1.admicro.vn/cms/ Frame BD0C 		277 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://media1.admicro.vn/cms/Arf.min.js
Requested by
Host: media1.admicro.vn
URL: https://media1.admicro.vn/cms/arf-kgfxp669.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2405:f980::1:13 -, , ASN (),
Reverse DNS
Software
ss1 /
Resource Hash
8e78e7a2479d97e612c260bec313bd27413fe5c3fdcae29c5fb2b93e18089455

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
content-encoding
gzip
last-modified
Wed, 30 Mar 2022 03:57:16 GMT
server
ss1
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=600, must-revalidate, proxy-revalidate
expires
Tue, 26 Apr 2022 00:43:50 GMT
truncated
/ Frame BD0C 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b43bdddaed119873e24d06f2ce6eac2257c3fd1a177498a98a2bac49d1e3b924

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/png
gen_204
pagead2.googlesyndication.com/pagead/ Frame 725A 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=B31gC7j1nYq-2FLWunsEPyfap0A8AAAAAOAHgBAI&bg=!iIuli8_NAAYXWUUuN1k7ACkAdvg8WoeURH3FhL4BBpiky4IkGwHgD-EX5AZYd-BmwUhagYNg349REgIAAADCUgAAAAJoAQeZAuDnYqJA0-xxMLIi0VSeVPEUmeTRSHGmKAZcGYtbTIIQwAlGUHbf0eQNv3-3f_fnn7zHl2Q-J5mI1BWyZ7ymyK0MImCAgQBH4fxRu4SYx_p99IesS2trhEL0Jv1lmWfXyyAPhGa2rbyp7NKL6PfVS8CkyAB-OWLGEzDmG-RGJDVtmTwd3bVXQ2G2JvJ4ob47EpGr-Ei0mcTKTDVUswAWyegaPhHkB48zs7yV3dvZN5ccS2X4DJZ7bjtfslmXL1UOD3HQcRUqKSWlHu9tyZF11SZZri64OTuPWvAD6DIHpyNotzQdWvSk7AWTArAyxCR_AJTNHJDCyG536ipNAsrxgNwok1jdRyUASFJFZMfJoPgu3r2ZSpVcya6ds-Y8TXXqIw7qc6tGZMZzXrk_roba5-iZGJh4glfSt6Oxa2wWipPox-MxSFyK3Yw1dALHFRSEjaiTvXIChZE_fyXqrTrWb1Be6sSaalyyBFdcOtfmeWTi19CYcNxNTWLCwFH3oWfLSyd_3l20wNsV6lQfZyYINWGF2pQpjC5jjDWT1hNWGL5Q1ODn064sSch5dzxS_Qv3E8ePASiZN-XvrAc_JQrdaOYaHdtElNLHpPwyylLrVrt4ktFihnkkrlRj4oIS-cy0Nle2tI6o6uavxMbYALKrvorL4JyvjQjv-kMwIh9y78wSXHTEP9-sutDjaJUVu4xtoniW-gSBzVwWtU7MbQCFpoTx--x5pU6-MNdaJla8IqPgNEvrC7gpVr04KUP0SjaONET78TDx17OIKG-e5oZMEVEjsZkAXgUyfAP8nv8ui4p2CP67k5An8oaoDSv5XaFCR5dVehruIvTVdwHEaqsheCgh3X3bzAvl166nF2AVHo4jrFwFEvAWJk3o7Ya1SJ21ywB41DgfIzzvd3hf8b4lFoEFidDey2JNG7xh27GjglTOvGOfUwGjkTN0UBEMzr5yxrTsWBB9ucSXqa6en-zuGjOJ
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 898A 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
67206
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
gzip
content-length
724
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 25 Apr 2022 05:53:44 GMT
etag
48472445140208031
expires
Tue, 26 Apr 2022 05:53:44 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
dc_oe=ChMIr-X3xb2w9wIVNZcnAh1Jewr6EAAYACDE4JhROhoIm9qCkAEQ3_6y1vIDGPX44t8DIODSpJrFD0ITCPaq18W9sPcCFQG7dwodI4UDmA;dc_rmcid=CAASJeRosWt4eXn3Px6yXLBCS5QG_ho5l1HTOf5_zaH8roi6I_mlrTU;eps=CIDhgBAQARgd;me...
ade.googlesyndication.com/ddm/activity/ Frame 5CEA 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIr-X3xb2w9wIVNZcnAh1Jewr6EAAYACDE4JhROhoIm9qCkAEQ3_6y1vIDGPX44t8DIODSpJrFD0ITCPaq18W9sPcCFQG7dwodI4UDmA;dc_rmcid=CAASJeRosWt4eXn3Px6yXLBCS5QG_ho5l1HTOf5_zaH8roi6I_mlrTU;eps=CIDhgBAQARgd;met=1;acvw=sv%3D925%26v%3D20220418%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D20010%26vmtime%3D16%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D180147295%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1650933230817;dc_rfl=[URL_SIGNALS];ecn1=1;etm1=0;eid1=11;
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.66 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/interaction/ Frame 5CEA 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://googleads.g.doubleclick.net/pagead/interaction/?ai=CEpS17T1nYraAMYH23gOjio7ACef9yrtp4NKkmsUPz-aivcABEAEg0K_XKmCVuviBlAegAZf-m_ACyAEFqQKs2kxmNPexPqgDAcgDmwSqBKECT9BAKGuydt3snrtxMZC971C6ahkQgE9B7jdj91b8zchVU2mWvErEuGU8bdi3OQ11DWhaa5G0VmX4RJgToenyfUak9jvzgt3LtXuB4mXR5XgVp2egCURcTGzS3_PNORFQlonWdqlEbUOb7H3Mi69fRxj1ixo2uBmPWuMnS2Mjkvg1xNMqQHZaQ59VJFzM9SO_3EiK_DOm-k6OIh4QtPpoKIUIDJiZASAJDc2w-s2BQclc_YpLJnG07dSfNj20JgiChtbmvlBsHfKNzcF3RuqYIsldSpiJu5lcNT7k1iEyr1-T1opoZ-3egiLdn19HWzmQ-aCjyyAz2vcVp0ANvo4u02ylgpnZT4V4EMQuUsNZtZFA3wWqfApUivIG1idOOAO56MAE3_6y1vID4AQDkAYBoAZ2gAfRgeSPAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHYAKA8gLAeALAYAMAbATgf_6DsgT9fji3wPYEwqIFALYFAHQFQH4FgGAFwE&sigh=XSSVZwmA3bs&label=part2viewed&ad_mt=16&acvw=sv%3D925%26v%3D20220418%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D20010%26vmtime%3D16%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D180147295%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1650933230817
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 5CEA 		0
27 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvv-KDpBif2snmJGCzVX0DwYzOVczrrg91JQStFG59Bf2WfTc3JeIOcoBrVsNdQOffRdBIgC188duAnCeCUV4rtYv7VtRO_f6bIKjVd0zBliusl2zFT40XyGG-JlqYFVXQc6SLGnwEmPn_Uyew7sWYHzVrzJLg7sXhTu_2m6zJVxC8Lgf8abwDJDu4HFew94h7evrAs6iZLrh4Ja_Ba2npuztiL5F5bQAEVrASi2mEn_C3KM-xteHtZCoklqbo8J_r8qpIahDZMrpObWuBYFPYjY4fvdoN8s6pZE1DfGjTf08mjdYoWMdNw3yF7rlvw-64P7jYZVeP2CEdCrZiocTlfyK6GF7MaRk57l59Cg2JxPuRrwV0l90jSxslfGeUsfuojcfBO62RY1m02FpyEh3ofBHFj3RQ7tau9Axr1-Q3p8RiYCt4E2ayNu3vDq8u1SAe7eE_mf8qdQK43voZm7JTdrqSxRT-9LA_iZh4OLhAWN8UY1GsvR-fLLVD46pSXPRFHEAHPSOImCN8Exp8wRJYQ8cHJ7lemtSgLHSK6y_EMyUvcaSa0z-IxqusGypDKpjdCDrTIWjUKoYOAicU-xMBL7h6cA4IIjk3J7EEgPmrkv0nPTylglPZjJK5BzaAH3THJB2H4duqfpk9O0JwRK7HkW4PdeBKiHvi42Om8Aa3SaU7r3431DPZHRHAlaqYTtV5macfQ06gUbfM_okeIwHrTKmEQm-iHHl3R72gMSo74pJcVqB-4CIPGblp63TXEd4SdXYMgoJU8IU6Rb9Iz0dYSXLi-ztWnctUI32oNZT8HSmEkzyLs7vDzzqnvO_woRHnupPJuYjxgmbtmvORwu0Osr8aLCOSP7AdX-WjZeKuzF13OCFuGI4oGi7IgQrHhCfeAWHVuuGAexTc_A0lD2suRB3EEq9hXF05N7BFQOXseL42lmYt2GvwRKm-HpBTkt_cZ-ccs8otl7zjWYRoiiG0f1zPgJcNZFXg-ISrXgGV-lyowm1TbRPQAzsBq-Xk5zNNJUlNNqtCJW11nF1QckatkWEx0TMl3uovFmwX4mftNKP8QjWaXzCBxZz5FRxONyDSCUaj5LN1VXLxAvE7C8qceSI2GyGofFhEW7Ax5xLM-0bQTUimJuCGZFt_KngufUSpN-E2H9StU60KOBD2pUl69mNS7moeIINUIiz21IXvUUkbS1l8GhDOrqkNJK-W390Mhi0mRuKE9oGTtfg6pubL_EsnjXrsAVsCj-EHjVU6Wig-rm2HRyUm8d2byTZdnVHRxSoTTXy75uz7RtloUKw&sai=AMfl-YRoP0WHZi0udHuAjh1k5GU0_vqyHDbCgpY15nE9G9MBdbY4fr17Xc6Ljgc0aIzbT80FHyNT9NusxNPtDCYtTcN92pJT-he-ALrEBovNf8VgiLtUrNr64enpMqQA13U_AD2REMRKuDg4BVHjyUTiBT039b6zJ4bOMnkXdWkXjIHriRSBg8kf_VdmLHTTo6RWewZIO7Hf-O2kMuNbWibzss1H&sig=Cg0ArKJSzI18sUU8TdPUEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date
Tue, 26 Apr 2022 00:33:50 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
rum
dsum-sec.casalemedia.com/ Frame 5CEA
Redirect Chain
  • https://googleads.g.doubleclick.net/xbbe/pixel?d=CM6y0QEQpvfjARiL7-3IASABMAE&v=APEucNUOa3P0aHYxH7aMBW896mI2QN2N_Lc0LYnVeY2Cpdd7vCuhxtLO_zgWuKwVW9PP_L9NEbOMpzT5mGkAQT4Vdrc6f-Tcew
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA6b7AydI7UBv14F9K2UOGw&google_cver=1
43 B
894 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA6b7AydI7UBv14F9K2UOGw&google_cver=1
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
HTTP/1.1
Server
23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-236-247.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 26 Apr 2022 00:33:50 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 26 Apr 2022 00:33:50 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA6b7AydI7UBv14F9K2UOGw&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 5CEA 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=video_impression_ping
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dc_oe=ChMIr-X3xb2w9wIVNZcnAh1Jewr6EAAYACDE4JhROhoIm9qCkAEQ3_6y1vIDGPX44t8DIODSpJrFD0ITCPaq18W9sPcCFQG7dwodI4UDmA;dc_rmcid=CAASJeRosWt4eXn3Px6yXLBCS5QG_ho5l1HTOf5_zaH8roi6I_mlrTU;eps=CIDhgBAQARgd;me...
ade.googlesyndication.com/ddm/activity/ Frame 5CEA 		42 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIr-X3xb2w9wIVNZcnAh1Jewr6EAAYACDE4JhROhoIm9qCkAEQ3_6y1vIDGPX44t8DIODSpJrFD0ITCPaq18W9sPcCFQG7dwodI4UDmA;dc_rmcid=CAASJeRosWt4eXn3Px6yXLBCS5QG_ho5l1HTOf5_zaH8roi6I_mlrTU;eps=CIDhgBAQARgd;met=1;acvw=sv%3D925%26v%3D20220418%26cb%3Dout%26e%3D15%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D20010%26vmtime%3D16%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D180147295%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1650933230817;ecn1=1;etm1=0;eid1=200101;
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.66 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 5CEA 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstXBqixd0FHeCpsgIKvNy068NioNkDVJiCn7ssSK-BFDtCS9Iex53QlQX2oSYYy7Mj4p-Petqd7_eues-QPpr2QVPAwcULIVKz-hYywigtIbMVGrCnxKg&sai=AMfl-YQmoKyr7JVc7oIjeSqtSPYHERbMSI_n6Snp8YvvW-nkzLW9wOFM9nU--Xn-3RqHvXf5YIyGMFrVjAr7CQuxZlJMAyr2YvbuuDOuxtxrppSPyGgKkNWXYG4uqLzJ&sig=Cg0ArKJSzNe89NSATWR3EAE&cid=CAASJeRosWt4eXn3Px6yXLBCS5QG_ho5l1HTOf5_zaH8roi6I_mlrTU&id=lidarv&acvw=sv%3D925%26v%3D20220418%26cb%3Dout%26e%3D15%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D20010%26vmtime%3D16%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D180147295%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1650933230817&avm=1
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/interaction/ Frame 5CEA 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://googleads.g.doubleclick.net/pagead/interaction/?ai=CEpS17T1nYraAMYH23gOjio7ACef9yrtp4NKkmsUPz-aivcABEAEg0K_XKmCVuviBlAegAZf-m_ACyAEFqQKs2kxmNPexPqgDAcgDmwSqBKECT9BAKGuydt3snrtxMZC971C6ahkQgE9B7jdj91b8zchVU2mWvErEuGU8bdi3OQ11DWhaa5G0VmX4RJgToenyfUak9jvzgt3LtXuB4mXR5XgVp2egCURcTGzS3_PNORFQlonWdqlEbUOb7H3Mi69fRxj1ixo2uBmPWuMnS2Mjkvg1xNMqQHZaQ59VJFzM9SO_3EiK_DOm-k6OIh4QtPpoKIUIDJiZASAJDc2w-s2BQclc_YpLJnG07dSfNj20JgiChtbmvlBsHfKNzcF3RuqYIsldSpiJu5lcNT7k1iEyr1-T1opoZ-3egiLdn19HWzmQ-aCjyyAz2vcVp0ANvo4u02ylgpnZT4V4EMQuUsNZtZFA3wWqfApUivIG1idOOAO56MAE3_6y1vID4AQDkAYBoAZ2gAfRgeSPAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHYAKA8gLAeALAYAMAbATgf_6DsgT9fji3wPYEwqIFALYFAHQFQH4FgGAFwE&sigh=XSSVZwmA3bs&label=vast_creativeview&ad_mt=16&acvw=sv%3D925%26v%3D20220418%26cb%3Dout%26e%3D19%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26at%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D20010%26vmtime%3D16%26is%3D18%26i0%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D180147295%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26ss%3D0%26t%3D1650933230817
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame 5CEA 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=4~l2ff0pkh&c=5293576886604&slotId=2646788443302&qqid=CPaq18W9sPcCFQG7dwodI4UDmA&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=1000&br=769&mt=video%2Fmp4&vs=720x720&dm=20000&event_name=first_play&asset_bytes=233587&video_bytes=0&cached_data_bytes=0&js_cached=false&css_cached=false&num_assets=14&num_assets_cached=0&num_assets_cache_validated=0&num_assets_unmeasurable=1&video_played_seconds=0.00&video_muted=true&video_seconds_loaded=0.00&met.4=ff.220~videopreviewstarted.222
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220418_RC00/outstream.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4009:824::2003 -, , ASN (),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:51 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
api
www.webtretho.com/ 		28 B
627 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.webtretho.com/api
Requested by
Host: st.webtretho.com
URL: https://st.webtretho.com/_next/static/chunks/6b24190e2c9ef5d5f952995a31be664d76b7d6c4.99172823599bc28c9749.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.30.128.200 , Viet Nam, ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN),
Reverse DNS
static.vnpt.vn
Software
nginx /
Resource Hash
f8375bf4214fa9f41b23879a739807b97204ad583ef53b3125b755870a022496
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

Accept
application/json
Referer
https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Access-Control-Allow-Credentials
true
accept-language
de-DE,de;q=0.9
Access-Control-Allow-Headers
Accept, X-Requested-With, Content-Type, Authorization, Access-Control-Allow-Headers
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 26 Apr 2022 00:31:31 GMT
content-encoding
gzip
x-content-type-options
nosniff, nosniff
vary
Accept-Encoding, Origin, Accept-Encoding
x-xss-protection
1; mode=block, 1; mode=block
x-request-id
9da4eb7a-a049-4086-b65d-31c5d6a52c8f
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"1c-lA4YgRBQB/lOes2uOd7Uw2FRG2g"
x-download-options
noopen
strict-transport-security
max-age=300; includeSubDomains; preload, max-age=31536000; includeSubDomains
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.webtretho.com
cache-control
max-age=3600
access-control-allow-credentials
true
expires
Tue, 26 Apr 2022 01:31:31 GMT
truncated
/ Frame E815 		217 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b24b7c9620c9f87df6a87ccbe3d1bca12946f5b36e51ae8b93c54cf017e11de7

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/png
i.match
a.tribalfusion.com/ Frame 898A 		43 B
702 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.tribalfusion.com/i.match?p=b6&u=CAESEItJMorvPWvFKUYapaihApM&google_cver=1&google_push=AYg5qPLp2ZHKrX2StYpYth6Q0BxFr8nZzLhlp8Q3XToAA2IXDUhi6f7Hth9tl2MvJBoNKdgZze0Iv8IsiCWi-ZjSN08Zd8Z-F-AF&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPLp2ZHKrX2StYpYth6Q0BxFr8nZzLhlp8Q3XToAA2IXDUhi6f7Hth9tl2MvJBoNKdgZze0Iv8IsiCWi-ZjSN08Zd8Z-F-AF%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:4400::ac40:98f5 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:51 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
701b3ab50e9e9bcb-FRA
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
content-type
image/gif; charset=utf-8
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 898A
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEILssvYX37rDFHMsc9A9Z_k&google_cver=1&google_push=AYg5qPKD2FD8AJ7iDUWU766Bij-DlWawTAausO1_DAl6G0Scx4xfJeiFYNkHb4QwBNcvgpgFd8WPxDpXO0Qcmq...
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzA5MDcwNDIzMDc0Mjk0Nzk4Ng%3D%3D&google_push=AYg5qPKD2FD8AJ7iDUWU766Bij-DlWawTAausO1_DAl6G0Scx4xfJeiFYNkHb4QwBNcvgpgFd8WPxDpXO0QcmqeTX6...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzA5MDcwNDIzMDc0Mjk0Nzk4Ng%3D%3D&google_push=AYg5qPKD2FD8AJ7iDUWU766Bij-DlWawTAausO1_DAl6G0Scx4xfJeiFYNkHb4QwBNcvgpgFd8WPxDpXO0QcmqeTX6iM-6ITGxXs
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzA5MDcwNDIzMDc0Mjk0Nzk4Ng%3D%3D&google_push=AYg5qPKD2FD8AJ7iDUWU766Bij-DlWawTAausO1_DAl6G0Scx4xfJeiFYNkHb4QwBNcvgpgFd8WPxDpXO0QcmqeTX6iM-6ITGxXs
Date
Tue, 26 Apr 2022 00:33:50 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
pixel
cm.g.doubleclick.net/ Frame 898A
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEG1mRYA5xKDQfbNxFz8ZeaU&google_cver=1&google_push=AYg5qPKFbmjM5Iuh8P_D2-yJF1pnxXGfWOlNDRJ7GgNC-Cd-_XZaZFKTq6wOk7ErKv4_KZlbLC_odTk_XKs3jymbL73d...
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=google
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=3516654594259581833&expires=30&ssp=google
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKFbmjM5Iuh8P_D2-yJF1pnxXGfWOlNDRJ7GgNC-Cd-_XZaZFKTq6wOk7ErKv4_KZlbLC_odTk_XKs3jymbL73dvhUd2pe7&google_hm=c40nf7WTTY-IEXVBzT9CEw==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKFbmjM5Iuh8P_D2-yJF1pnxXGfWOlNDRJ7GgNC-Cd-_XZaZFKTq6wOk7ErKv4_KZlbLC_odTk_XKs3jymbL73dvhUd2pe7&google_hm=c40nf7WTTY-IEXVBzT9CEw==
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
//cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKFbmjM5Iuh8P_D2-yJF1pnxXGfWOlNDRJ7GgNC-Cd-_XZaZFKTq6wOk7ErKv4_KZlbLC_odTk_XKs3jymbL73dvhUd2pe7&google_hm=c40nf7WTTY-IEXVBzT9CEw==
Date
Tue, 26 Apr 2022 00:33:50 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
pixel
cm.g.doubleclick.net/ Frame 898A
Redirect Chain
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMq0c6zkqnSmrfhIZuSF1wo&google_cver=1&google_push=AYg5qPLZsqc9rbhqcAo-rtFe2twdJI6wsCthwRGNidXQL_0SPAxdJbqVOdEWvisYxFtmGp3osT4eEWe2...
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzk5NDgyMjMxODY1MTY2MDEyMQ&google_push=AYg5qPLZsqc9rbhqcAo-rtFe2twdJI6wsCthwRGNidXQL_0SPAxdJbqVOdEWvisYxFtmGp3osT4eEW...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzk5NDgyMjMxODY1MTY2MDEyMQ&google_push=AYg5qPLZsqc9rbhqcAo-rtFe2twdJI6wsCthwRGNidXQL_0SPAxdJbqVOdEWvisYxFtmGp3osT4eEWe2gaRoKqkFC_YzKi07AKQ
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
nginx
location
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzk5NDgyMjMxODY1MTY2MDEyMQ&google_push=AYg5qPLZsqc9rbhqcAo-rtFe2twdJI6wsCthwRGNidXQL_0SPAxdJbqVOdEWvisYxFtmGp3osT4eEWe2gaRoKqkFC_YzKi07AKQ
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
pixel
cm.g.doubleclick.net/ Frame 898A
Redirect Chain
  • https://onetag-sys.com/sync/i,19/?google_gid=CAESEGEx4QLlCE-JIGhixCxQ8Wc&google_cver=1&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
0
0
pixel
cm.g.doubleclick.net/ Frame 898A
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEAYjtzc8D8g0jha1oqKgDrA&google_cver=1&google_push=AYg5qPJItJwwWjTS77t5VpkOJ6e6oe-1Us_W7tUQlXNx-faDHH4Ci1g_hzk8RJuw__Vkriuqy8...
  • https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1jSGRWNlVwRTJ1SFFWc2p2VVBmeWVkTUNLdWRsMVhoNX5B&google_push=AYg5qPJItJwwWjTS77t5VpkOJ6e6oe-1Us_W7tUQlXNx-faDHH4Ci1g_h...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1jSGRWNlVwRTJ1SFFWc2p2VVBmeWVkTUNLdWRsMVhoNX5B&google_push=AYg5qPJItJwwWjTS77t5VpkOJ6e6oe-1Us_W7tUQlXNx-faDHH4Ci1g_hzk8RJuw__Vkriuqy8ZXOQz7vke2PrNVcDaDjDWItt2zvQ
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1jSGRWNlVwRTJ1SFFWc2p2VVBmeWVkTUNLdWRsMVhoNX5B&google_push=AYg5qPJItJwwWjTS77t5VpkOJ6e6oe-1Us_W7tUQlXNx-faDHH4Ci1g_hzk8RJuw__Vkriuqy8ZXOQz7vke2PrNVcDaDjDWItt2zvQ
date
Tue, 26 Apr 2022 00:33:50 GMT
server
ATS/9.1.0.46
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
dot.gif
s0.2mdn.net/ Frame 898A 		43 B
72 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/dot.gif?google_gid=CAESEEOTN3zotOxqzvZC-S34exg&google_cver=1&google_push=AYg5qPKQzJfE-8B_bD9LmCKFXAQNdAjXE16jQZ4lEiClf_aJDz68PIRteeR8ZQUaw9saC4_MEN3NU-1YVR3yzsU0b_FoYMkv8YoB
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
x-content-type-options
nosniff
last-modified
Sun, 01 Feb 2009 08:00:00 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 27 Apr 2022 00:33:50 GMT
attr
cm.g.doubleclick.net/pixel/ Frame 898A 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JbIb4pZNcD04NdO1OphF5jacBNWK-SRe7-1RDccCFWyoRC6y4Wq7GNU9jSX9YAZ_bhLTbqXeQ
Requested by
Host: 2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
URL: https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:50 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v21/ Frame E815 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
acc5497e76f832d950d14fcfa047dc3c864f7a0aae4c7a20521c0c655a53033b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 19 Apr 2022 22:12:48 GMT
x-content-type-options
nosniff
age
526862
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20784
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:21:31 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Apr 2023 22:12:48 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 7F25 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsusRfy_GNKIU_t3fknAHWVtosXriacqZJX0tsEFD0ViN8OFtHm95wAjvoNd96zy-RUaRa2gOBvwwN2nxDxx48ZSbUtHvXMsFJW0XmYJQUPQ-n7qRig89w&sai=AMfl-YRWs1nxnFyhkHYcSjkTZ285Ex5QX05iHzB6vxfr4eAiOM5cBYAh50nVn2bJrzyFwMTD0UMT6KjvkeAgF-lzgaNOI3PbPsplAzISib5KJFqtygFpltJX5NdtW6OM&sig=Cg0ArKJSzDdqKtA2SOvzEAE&cid=CAASJeRokDukzsSgMOVkL380IGEbY50kTFoAPgF4svkrlF6924L1s4g&id=lidar2&mcvt=1008&p=70,315,160,1285&mtos=1008,1008,1008,1008,1008&tos=1008,0,0,0,0&v=20220420&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2496478511&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1650933229629&rpt=221&isd=0&lsd=0&met=ce&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
JAPUMHT_zNnrVfwA4fX3UESFQekER8YYbnBYivkpjVo.js
pagead2.googlesyndication.com/bg/ Frame B4F2 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/JAPUMHT_zNnrVfwA4fX3UESFQekER8YYbnBYivkpjVo.js
Requested by
Host: www.webtretho.com
URL: https://www.webtretho.com/f/hong-showbiz/matt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi?utm_content=buffer0db84&utm_medium=social&utm_source=facebook.com&utm_campaign=WebtrethoPage&fbclid=IwAR3TDXSrYYY0ISGGC4UWLEh7x8l0Q1pyCYPnlDHyKPV3LzexEfBRrqEMi0w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2403d43074ffccd9eb55fc00e1f5f750448541e90447c6186e70588af9298d5a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 19:15:30 GMT
content-encoding
br
x-content-type-options
nosniff
age
19100
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13448
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 11:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Apr 2023 19:15:30 GMT
collect
d.clarity.ms/ 		0
48 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.clarity.ms/collect
Requested by
Host: d.clarity.ms
URL: https://d.clarity.ms/s/0.6.34/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.76.174.66 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.webtretho.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

access-control-allow-origin
https://www.webtretho.com
date
Tue, 26 Apr 2022 00:33:51 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
view
securepubads.g.doubleclick.net/pcs/ Frame BD0C 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvRcWaN_denCoO5J_MUYpHckUUgHhRLiGuvBlBqBJoaurLx7l-_zqGuvL7UNnLw2jcBJI3A66QJ1KHXpttyD5FlOuumkzmA9r_m4vnMgznQUwjX_1c7L2Ckp7EpF_Nh_NkDkHfAdrQkbxyDXQ8hTcVELuNzBf5pTE1mE8rWZ907vNICYepg2Tv5Sr-gBiIdLq8vS_a6yd2sk4wj1TWtxQLS46PvaEUrgvLCHJEcTu2h72tSk3vhXXByaf7V5gdTzePeVEfxK69iiZZLco8tBHQXCEuN1fIkx9gOXpsk69bIhWLBtfLNzYE6Wn8h4mVjb8iGMvZYfBpMs3bvNCpsRg0Q2RvfKCl5&sig=Cg0ArKJSzJMHo8_sje5dEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 26 Apr 2022 00:33:51 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Tue, 26 Apr 2022 00:33:51 GMT
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?CtsSyncId=79D265CFBA344D21B2E42331A1C906DF&RedC=c.clarity.ms&MXFR=1D2AE661325F600C26CBF7F3365F6E50
  • https://c.clarity.ms/c.gif?CtsSyncId=79D265CFBA344D21B2E42331A1C906DF&MUID=3283EED520EE6BB30029FF47213C6A44
42 B
392 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.clarity.ms/c.gif?CtsSyncId=79D265CFBA344D21B2E42331A1C906DF&MUID=3283EED520EE6BB30029FF47213C6A44
Protocol
H2
Server
52.142.114.2 -, , ASN (),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:51 GMT
last-modified
Fri, 18 Mar 2022 19:39:54 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
etag
"8120eaf0ff3ad81:0"
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42

Redirect headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:50 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: C80F6F4E062549FEBF3A520E615C68A5 Ref B: FRAEDGE1311 Ref C: 2022-04-26T00:33:51Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?CtsSyncId=79D265CFBA344D21B2E42331A1C906DF&MUID=3283EED520EE6BB30029FF47213C6A44
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
sodar
pagead2.googlesyndication.com/getconfig/ 		14 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022042101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d6ae8dc04843c25e2e0b981199286ec076b69efcf9ec698825cecdd2392ba458
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 26 Apr 2022 00:33:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10574
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 26 Apr 2022 00:33:51 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 93FD 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.webtretho.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
13364
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 25 Apr 2022 20:51:07 GMT
expires
Tue, 25 Apr 2023 20:51:07 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 38A5 		783 B
535 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
8b4ff97db4a786442f06eb444e02f71247ef9f28ffd2faa3988e370ef9fed1c1
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-BaBHZ5aE+eWnbhjln4aPAQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.webtretho.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=300
content-encoding
gzip
content-length
513
content-security-policy
script-src 'report-sample' 'nonce-BaBHZ5aE+eWnbhjln4aPAQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 00:33:51 GMT
expires
Tue, 26 Apr 2022 00:33:51 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
sodar
pagead2.googlesyndication.com/pagead/ Frame 38A5 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022042101&jk=3350176106606403&rc=null
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers
LOnNfct_OK6AKwq7GByGz0_K8O7BrCXN6Fs6Py5gnPc.js
pagead2.googlesyndication.com/bg/ Frame 93FD 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/LOnNfct_OK6AKwq7GByGz0_K8O7BrCXN6Fs6Py5gnPc.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2ce9cd7dcb7f38ae802b0abb181c86cf4fcaf0eec1ac25cde85b3a3f2e609cf7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 09:08:20 GMT
content-encoding
br
x-content-type-options
nosniff
age
55531
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13636
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 11:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Apr 2023 09:08:20 GMT
admcorearf.js
media1.admicro.vn/core/ Frame BD0C 		230 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://media1.admicro.vn/core/admcorearf.js
Requested by
Host: media1.admicro.vn
URL: https://media1.admicro.vn/cms/Arf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2405:f980::1:13 -, , ASN (),
Reverse DNS
Software
ss1 /
Resource Hash
e306f5e11b4ff708da66fa62630a739750ccf45b00857b576e5cbe366d778f26

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.webtretho.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:51 GMT
content-encoding
gzip
last-modified
Sun, 17 Apr 2022 11:37:56 GMT
server
ss1
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=600, must-revalidate, proxy-revalidate
expires
Tue, 26 Apr 2022 00:43:51 GMT
advbcms
lg1.logging.admicro.vn/ Frame BD0C 		0
0
activeview
pagead2.googlesyndication.com/pcs/ Frame E815 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuUAzHGwRBB8VbgahBOJDjF1IEhOKuPsubkX2Whq7kkr0H2qDsxmXaRkdoYZgv0ErA6UHyb7wJrFn5LY6zHuvBVCTtHU9IsBsvDQfiEdaexLNpsUmnWbQ&sai=AMfl-YS9jQa4LGJ9zekb4o5_eY_6jbQQY5Bh4dJYj4AjWSun0EdV05zR6P6l29CZS3p7RgxlJJQJzu8XPkCoRi5p0d_UQKn3W7BGuls20ngsuXyaVpPYupWa_ml7r6J0&sig=Cg0ArKJSzPLD1coLH3SQEAE&cid=CAQSPACNIrLMGxbNbigJUAaVohcMF7aOhU-B4FqAtZtCprlXcAxL6vJR8gzOsXPILZcCTriIBLPhxF4QujSELxgB&id=lidar2&mcvt=1008&p=70,1303,670,1463&mtos=1008,1008,1008,1008,1008&tos=1008,0,0,0,0&v=20220420&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1067135881&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1650933230717&rpt=180&isd=0&lsd=0&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Apr 2022 00:33:51 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
generate_204
tpc.googlesyndication.com/ Frame 93FD 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?20QF7w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:33:51 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
admcoreext.js
media1.admicro.vn/core/ Frame BD0C 		0
0
genjs_ht26032019.js
adi.admicro.vn/adt/cpc/tvcads/tracking/ Frame BD0C 		0
0
playerInitScript.js
adminplayer.sohatv.vn/resource/init-script/ Frame BD0C 		0
0
ssppage.js
media1.admicro.vn/core/ Frame BD0C 		0
0
cpx_cms
lg1.logging.admicro.vn/ Frame BD0C 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
google2waycm.netmng.com
URL
https://google2waycm.netmng.com/cm/?google_gid=CAESEOvmC2bM_T50pAt6RyDphrU&google_cver=1&google_push=AYg5qPI2xeGqUTDJaCOjiZ1Rs5jTdSXKf5jY1aoLDs-HkM4XALPPIhzx15HQa2mPxSE8jB9xks951rtBtKVF1rUGfLsqWFX1elY
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM
Domain
googlecm.hit.gemius.pl
URL
https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEHv40si-sL5NAOvmCkeeJLc&google_cver=1&google_push=AYg5qPIuXEDR_qeQ-LJ6b31TpFF2P0yViHmqS49WejprSKvRtfIX-LfyRiCoWeOJcEjx5Qb43JVeU48_n7jkbgLgGxylgZ81lAE
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ
Domain
sync.adaptv.advertising.com
URL
https://sync.adaptv.advertising.com/gg_pixel?google_gid=CAESEDg-snARyckYwuqRWwJBhfg&google_cver=1&google_push=AYg5qPLmdPzXLHtbjeEuZ2aA8nV9nYc69Gp_Za95rPwIlze0DGBXPFJAMnt_1nXadS4RcHrQNG3yNlnS_22yEql38TJ548_Gyx1c
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
Domain
lg1.logging.admicro.vn
URL
https://lg1.logging.admicro.vn/advbcms?dmn=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3Dwebtrethopage%26fbclid%3Diwar3tdxsryyy0isggc4uwleh7x8l0q1pycypnldhykpv3lzexefbrrqemi0w&zid=kgfxp669&pgid=1650933231692489212&uid=1650933231692489212
Domain
media1.admicro.vn
URL
https://media1.admicro.vn/core/admcoreext.js
Domain
adi.admicro.vn
URL
https://adi.admicro.vn/adt/cpc/tvcads/tracking/genjs_ht26032019.js?v=0.4630387067955257
Domain
adminplayer.sohatv.vn
URL
https://adminplayer.sohatv.vn/resource/init-script/playerInitScript.js
Domain
media1.admicro.vn
URL
https://media1.admicro.vn/core/ssppage.js
Domain
lg1.logging.admicro.vn
URL
https://lg1.logging.admicro.vn/cpx_cms?dmn=https%3A%2F%2Fwww.webtretho.com%2Ff%2Fhong-showbiz%2Fmatt-liu-be-huong-giang-tu-xe-xuong-nang-hau-nung-niu-om-chat-nguoi-yeu-truoc-hang-tram-nguoi%3Futm_content%3Dbuffer0db84%26utm_medium%3Dsocial%26utm_source%3Dfacebook.com%26utm_campaign%3Dwebtrethopage%26fbclid%3Diwar3tdxsryyy0isggc4uwleh7x8l0q1pycypnldhykpv3lzexefbrrqemi0w&zid=kgfxp669&pli=kgfzy4yy&cmpg=ke3y4rrv&items=kgfzy4ze&cat=null&cov=0&pgid=1650933231692489212&uid=1650933231692489212

Verdicts & Comments Add Verdict or Comment

74 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData function| postscribe object| google_tag_manager_external string| url object| headScript function| hj object| _hjSettings object| xDown object| yDown function| handleTouchStart function| handleTouchMove function| clarity object| AiactivSDK function| onYouTubeIframeAPIReady object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| webpackJsonp object| JSON3 function| setImmediate function| clearImmediate object| __BUILD_MANIFEST object| __core-js_shared__ object| regeneratorRuntime object| __NEXT_DATA__ object| __NEXT_P object| next function| normalize function| __NEXT_PRELOADREADY object| lazySizes function| filterCSS function| filterXSS object| __NEXT_REDUX_STORE__ function| _JSXStyle object| googletag object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| ggeac object| google_js_reporting_queue undefined| google_measure_js_timing object| googleToken object| googleIMState function| processGoogleToken number| google_unique_id object| recaptcha object| closure_lm_984427 object| ampInaboxIframes object| ampInaboxPendingMessages

40 Cookies

Domain/Path Name / Value
.webtretho.com/ Name: _gid
Value: GA1.2.565082439.1650933223
.webtretho.com/ Name: _gat_gtag_UA_43173086_1
Value: 1
.webtretho.com/ Name: _gcl_au
Value: 1.1.1687743279.1650933223
.webtretho.com/ Name: _gat_UA-43173086-14
Value: 1
.webtretho.com/ Name: _ga_QP5Y1Q9C46
Value: GS1.1.1650933223.1.0.1650933223.0
.webtretho.com/ Name: _ga
Value: GA1.1.1873700710.1650933223
www.clarity.ms/ Name: CLID
Value: 63f960c2334046778c4b71deb515b99e.20220426.20230426
.webtretho.com/ Name: _hjSessionUser_1881467
Value: eyJpZCI6IjljM2E1YmZmLTlhY2MtNTY1Yi05NGU3LWY2NWMyNzZhZGU4YiIsImNyZWF0ZWQiOjE2NTA5MzMyMjM0OTksImV4aXN0aW5nIjpmYWxzZX0=
.webtretho.com/ Name: _hjFirstSeen
Value: 1
www.webtretho.com/ Name: _hjIncludedInSessionSample
Value: 1
.webtretho.com/ Name: _hjSession_1881467
Value: eyJpZCI6IjQwYTA1N2Q3LWVlMmYtNDc4Zi1hMTQ3LTlhYzdkOTdmYjVlZiIsImNyZWF0ZWQiOjE2NTA5MzMyMjM1MTksImluU2FtcGxlIjp0cnVlfQ==
.webtretho.com/ Name: _hjAbsoluteSessionInProgress
Value: 1
.webtretho.com/ Name: _clck
Value: 1czlj3v|1|f0y|0
.webtretho.com/ Name: _clsk
Value: 1kgafdz|1650933224335|1|1|d.clarity.ms/collect
.aicactus.io/ Name: aid
Value: f97cd7a9-4442-4dc8-94d5-011bc1623526
.webtretho.com/ Name: aiactiv_v1.0.1_ajs_anonymous_id
Value: %22f97cd7a9-4442-4dc8-94d5-011bc1623526%22
.casalemedia.com/ Name: CMID
Value: Ymc97LCLAgfB1LGNpxlCegAA
.casalemedia.com/ Name: CMPS
Value: 5237
.casalemedia.com/ Name: CMPRO
Value: 1170
.adnxs.com/ Name: uuid2
Value: 8449688032100369151
.casalemedia.com/ Name: CMRUM3
Value: 2d62673dec2760CAESEJP7Ro96lEOjLXRnVC4syPY
.adnxs.com/ Name: anj
Value: dTM7k!M41.D>6NRF']wIg2E?`vu(g<!]tbPl1M>e)ZlrFUfJ+tGXxo]bVU6QBF%X`Z1%6+NW5=.P4yr:_.zoiJ!j7g3If)y3KL9D3I?+`ldX8Z
.w55c.net/ Name: wfivefivec
Value: TrxQFEhg1NJ99i5
.smaato.net/ Name: SCM
Value: 6d715d18
.smaato.net/ Name: SCMg
Value: 6d715d18
.w55c.net/ Name: matchgoogle
Value: 5
.bidswitch.net/ Name: tuuid
Value: 738d277f-b593-4d8f-8811-7541cd3f4213
.bidswitch.net/ Name: c
Value: 1650933228
.yahoo.com/ Name: A3
Value: d=AQABBOw9Z2ICEK7sXCUGo6dLkTNMV20Z6-kFEgEBAQGPaGJxYgAAAAAA_eMAAA&S=AQAAApZC0oH8rzS9wzX8Y7RSY1c
.bidswitch.net/ Name: tuuid_lu
Value: 1650933229
.pubmatic.com/ Name: KTPCACOOKIE
Value: YES
.pubmatic.com/ Name: KADUSERCOOKIE
Value: B689DD95-75FF-4BE0-A1D7-3326A02B803D
ads.avct.cloud/ Name: uuid
Value: fb6ddc5b-98d9-4dad-be63-827057d69950
.doubleclick.net/ Name: IDE
Value: AHWqTUmVXJIi388f3lYfxKwlDF1QopdBZ7Fjt9SwofjK63bEZzjxT-ujxp2uF8CtC1Q
.webtretho.com/ Name: __gads
Value: ID=ced784f09b9c1db4:T=1650933228:S=ALNI_MaMrUJa7qohL0xMMM15PmMLe4wGJA
.casalemedia.com/ Name: CMST
Value: Ymc97GJnPe0A
.quantserve.com/ Name: d
Value: EEIBCQH_JYEA
.quantserve.com/ Name: mc
Value: 62673ded-ae15b-780bc-2371d
.agkn.com/ Name: ab
Value: 0001%3AWhBES1%2BfbyUgy73jtpCeAH2laiefpNNH
.agkn.com/ Name: u
Value: C|0CEAp-fptKfn6bQAAAAAAAQ13AQCAAQpAAAAAAA

5 Console Messages

Source Level URL
Text
network error URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEHv40si-sL5NAOvmCkeeJLc&google_cver=1&google_push=AYg5qPIuXEDR_qeQ-LJ6b31TpFF2P0yViHmqS49WejprSKvRtfIX-LfyRiCoWeOJcEjx5Qb43JVeU48_n7jkbgLgGxylgZ81lAE
Message:
Failed to load resource: net::ERR_ADDRESS_UNREACHABLE
network error URL: https://sync.adaptv.advertising.com/gg_pixel?google_gid=CAESEDg-snARyckYwuqRWwJBhfg&google_cver=1&google_push=AYg5qPLmdPzXLHtbjeEuZ2aA8nV9nYc69Gp_Za95rPwIlze0DGBXPFJAMnt_1nXadS4RcHrQNG3yNlnS_22yEql38TJ548_Gyx1c
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_cver=1&google_push=AYg5qPLz7UxyZ08fpWTCYLDlaLO3CtOJcGnePPaJbVCef2Y0NrnXLudvAodGstYzfbBW7mRWiH2j-R7rbNxbtdU27_9NOq3b8Q&google_gid=CAESEAoy78I562__h2XCjmaH0mM
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Ymc97LCLAgfB1LGNpxlCegAABJIAAAAB&google_gid=CAESEO8tTifbiU02b9DYnkdn6zM&google_cver=1&google_push=AYg5qPKiTCcmcApbwkTJTDFfbO78IkNwAN9zsgDQv59E8ReoC2T6fJQK25mssaQ1Ey3CzNP9TYMFALBlsowWKyBUp_znSOpwRRQ
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKsU8d7WvwaFLV-lZdJyGK9hi2b5VWB2fX1mfYyfLoXZjL-Xlzvk98j8arQ6x-sjCNx-m2duvnX-r4eoxSlRRTDlstwijo
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2993e30136c7b1ed79535b87078eae94.safeframe.googlesyndication.com
a.rfihub.com
a.tribalfusion.com
ad.turn.com
ade.googlesyndication.com
adi.admicro.vn
adminplayer.sohatv.vn
ads.avct.cloud
adservice.google.com
adservice.google.de
ajax.googleapis.com
ap.lijit.com
bid.g.doubleclick.net
c.bing.com
c.clarity.ms
c1.adform.net
cdnjs.cloudflare.com
cm.g.doubleclick.net
cms.quantserve.com
csi.gstatic.com
d.agkn.com
d.clarity.ms
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
dt.adsafeprotected.com
eb2.3lift.com
encrypted-tbn0.gstatic.com
encrypted-tbn1.gstatic.com
encrypted-tbn2.gstatic.com
encrypted-tbn3.gstatic.com
fonts.googleapis.com
fonts.gstatic.com
fw.adsafeprotected.com
gcdn.2mdn.net
gcm.ctnsnet.com
google2waycm.netmng.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
googlecm.hit.gemius.pl
ib.adnxs.com
identify.aicactus.io
image6.pubmatic.com
imasdk.googleapis.com
lg1.logging.admicro.vn
lh3.googleusercontent.com
media1.admicro.vn
onetag-sys.com
p.rfihub.com
pagead2.googlesyndication.com
pixel.rubiconproject.com
pm.w55c.net
pr-bh.ybp.yahoo.com
r.scoota.co
r.turn.com
r2---sn-5hnekn76.c.2mdn.net
r5---sn-5hnekn76.c.2mdn.net
rtb.openx.net
s.ad.smaato.net
s.tribalfusion.com
s0.2mdn.net
script.hotjar.com
sdk-cdn.aiactiv.io
securepubads.g.doubleclick.net
st.webtretho.com
static.adsafeprotected.com
static.hotjar.com
stats.g.doubleclick.net
sync.1rx.io
sync.adaptv.advertising.com
sync.mathtag.com
tag-cdn.aiactiv.io
tags.aiactiv.io
tpc.googlesyndication.com
ups.analytics.yahoo.com
vars.hotjar.com
vc.hotjar.io
www.clarity.ms
www.cloudflare.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.webtretho.com
x.bidswitch.net
adi.admicro.vn
adminplayer.sohatv.vn
cm.g.doubleclick.net
google2waycm.netmng.com
googlecm.hit.gemius.pl
lg1.logging.admicro.vn
media1.admicro.vn
sync.adaptv.advertising.com
103.90.220.252
123.30.128.200
13.248.245.213
142.250.185.194
142.250.185.66
142.250.185.98
142.250.186.162
143.204.98.123
143.204.98.39
143.204.98.62
143.204.98.76
171.244.201.56
171.244.201.57
172.217.23.98
18.195.2.126
18.197.164.96
18.198.193.48
185.64.190.78
193.0.160.129
2001:678:cb4:bbbb::11
213.19.147.45
216.200.232.249
23.35.236.247
2404:6800:4009:824::2003
2405:f980::1:13
2600:9000:2156:3600:1b:5138:8a40:93a1
2600:9000:2156:5a00:8:48e:53c0:93a1
2606:4700:4400::ac40:98f5
2606:4700::6810:7c60
2606:4700::6811:180e
2620:116:800d:21:36a9:ecb:e518:b308
2620:1ec:27::cafe:1799
2620:1ec:c11::200
27.71.231.241
2a00:1450:4001:800::2002
2a00:1450:4001:801::2008
2a00:1450:4001:801::200e
2a00:1450:4001:803::2001
2a00:1450:4001:803::2003
2a00:1450:4001:80e::2001
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::200a
2a00:1450:4001:80f::200e
2a00:1450:4001:810::2006
2a00:1450:4001:811::2001
2a00:1450:4001:811::2003
2a00:1450:4001:813::2002
2a00:1450:4001:813::200a
2a00:1450:4001:827::200e
2a00:1450:4001:828::200a
2a00:1450:4001:828::200e
2a00:1450:4001:829::2004
2a00:1450:4001:829::200e
2a00:1450:4001:82f::2002
2a00:1450:400c:c06::9b
2a00:1450:400e::7
2a00:1450:400e::a
2a05:d018:d29:3601:4961:8131:bfe8:dd3a
3.126.56.137
34.203.92.83
35.186.193.173
35.186.253.211
37.157.4.29
37.252.173.38
40.76.174.66
51.89.9.253
52.142.114.2
52.208.22.113
52.211.64.143
54.229.65.185
69.173.144.138
72.251.249.9
74.125.133.155
85.114.159.93
00f7654133040a87c630e83aa947a799b488aa40bae0fa441e136b10ef7b373e
017f39343c970a03a4f9b13faebbecd2099d12b87ba6e7f6507e0dc91bc6885d
020a8141a77e53d2c15f2f15a95459e673dafdfd4333958e3702a55b5800556c
02763466fbfa88b12dc9a69e0a8c0e51ab61a894ed4196907df03604592b85fc
060a31999a2299dc18cc6b8e9975e6aae0871169fad062cd317952d071b3e06a
062262c00b3ac517127f7c9cb58e148f4ac087e93034ae9319accde18f7f3b7b
09c53a0198a7e6749bd7822a78e537a722d6bcff91e2f0284028aa0faa25479c
0a1e6533d8962343d07b73603ccc21c8707b555f349afc9a9d674e4bd9358ca7
0aa05ed4daa7f2b61776026cc4b613ef7ee7adce95b9e2ce8c7175b1eeb520d3
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0f26c9b081df69f4e24dd632d150201820e81050f6b989fc2dd931aaed2f311b
100bf767c3990184a6c3e7803f7a39a5d721c967e57a59730d33bb52990775a9
10c1f8bcb6814056212a233201f2b5196c26c5b04b8e06cdab14a523ccd8363b
115b2754daa5eead85949ded7f518b0c371fe94f9cc85744bd06552146bca9d2
115fb965db1c8b7bcd3e5329673beebe79ed5dced4884188e51b6a7ddf2a3d86
11f025532b48b1e62a42674bfdbb8630a57a1b2ea9881753b4ebd0f2769e04f1
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1549fa220c480885fdd21bc35c9c543b5270941e6b84dd5e8cfa8349d74451af
160aa772761d237b0a086ed84ec204c340e6bb4dafe26d51dd606ee1fc35b7af
175b7bf18f98fae8f11666d22da87b6e5b9903f8cf4e12a012074c6915e8f54b
1af700b8f2b1ad10fb501c1bf1558493a5b5a7df68c90d9ad7cd235ebb49b47e
1b19f49ee34291d6d48919b75a6aa68fe4df1d6222f064818bd7ea37b447c000
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1c38e9b063a82e3556dd7f33fec29e444b00046582e2bbc50a9989ad4f3d4cea
1c62b6b676f29cd0815755615a821f059061d167b41f0209a67b8570848f80ed
1d019867c120344469403527c7d958861b81d0fc873813c97ee135f707d74122
1d17b1204229892a289a9810b5bf713865bd65903e910fcd74cf5f243dbdc008
1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306
1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954
1f9350ef410262714893a88b5ed357895441970506511398c43568c4c505143e
1ff35261c90e2ea6b8398208bae2acf53e20f215b1829ec7b47d7e45560c9173
20032ba845a4bd9983854ff7d36e5c197523b1eefd65c66879e9e0549865ee3a
20b97f4764680efdd44b021cb57bfb2b93850d0aaf8af024986393b0cb80f2d0
2186ed68a17f866f4d1884432650e03b1de65a96afa834e41a8ae9f5ba88cbe5
233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285
23d58779970abea74af6685f86a98f6acc1223a16944b54f6ebdc1fb71dfda1c
23f56d65c05a72a3b098aabc6ceff98ffba32c1c6f15ef1e2e5216cddf330b33
2403d43074ffccd9eb55fc00e1f5f750448541e90447c6186e70588af9298d5a
24d89bc712c365bc98cded7d5b7a28996c96cfaf7671361f1416495d7b1ae935
24e04dca645998f6060d40ab77cdf9b69de7cf5519a518aae6049d7faa7211f6
24fe63307e2903b2a4b2d80c28383d91861dc9ade1b28feac920e9f5f7b7dddd
28b2dab05b3a894d406fbb24453e5b4a079501190f6fb8c14b8b02cb09987a95
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
2938a62358444ec26cc0c3693366763a68b9bdac85b2701cc2ca7fa80aab1524
2acbdd60750bf5186309b359e5dcf4105e53d3769441bce536b609cbc8052f51
2c871ab8c9ed9463c466fa43d69aaa96481cd6852176f3ddfe1271d726d812c7
2c94b9287c0a915401efbdf4bb07e8a44a62edbb2fd9da16762a5ed43309ce91
2ce9cd7dcb7f38ae802b0abb181c86cf4fcaf0eec1ac25cde85b3a3f2e609cf7
2d8f7afecf5c533608cc76d0b6f56fa13f886c2bc3cf5e3977138fb384c39b73
3014731674382c35ed587acceca666543e438a17403ae7900e2a071dc5fbb4ac
30d68b50373410e7d6789c03bf85fdba67afb6c864860dfaaf1458b0d534c222
318d64d9523ae836addeb466ce5ab80610204d5910d5bb0071097e702a0e45b1
329b195932ba7ff45a2997e878e32279b48a0660c67b812defaa3a7b45127af9
32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7
336bb30461d407ee72236de87aca4fe68d611e1bee0030326778c858a4685b1c
343d97f1f8322a9d39361c45cc5c9cf6ee401c76ae688e010918656048316df2
34e6e09e027956a5440e0bfc21bc73f466a168b6b40f46749c7dfd72cba68b4f
35c673a2e779698643e5188a6dc2fec476f4cba673c48b1f6d4679b74226563c
36a6e46245a09bf885bd9d8cc497955e169b691f9add690cdfe06c9ac8b9ad22
36c13e7d4ca5f849cc56ca5f3bfec462d21e7726759ed48ae54975a2a4f8c8a2
36f1b68b30489df4ce3ab5885e898575f72f9e887ab7b9e89b6dc4532b22a845
37c479b0d9618fa643a88b14654e5b8280d6ad07f52888778ac16b6fe299a62e
3d295d53df418908ac2940f344e33b4d459774e7ef5023813687b4baa5ffe8e4
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3f79f9b094f6c293ae7ebf9ea570a1adea9ef7a3325ec0ba361d453a9c344564
3f7f6a3c412122cc784df3b9e13581632f8a5e53c2105009320c94d886f378e0
40e64eebf1c6e2933410a8cdb8d9aebff09d5bde0a0e40c2d9f57fc21922a991
428989cd2a66793e2cde0728cee9a01c148cd1d1ee517336069c60590886e2f3
4450ea25a2cd96ef28f12b921b645248e76d4fc7389dbed6c183cc91cadef186
4495ad8ac78e2df206dd48bbe441e08e9c807d5c42ee4817afd2e31684a621a1
44cd3b3a80fa71818d0a3624031904bbf87324274110a17a7d2a70024a11a5c6
459b7b25fc143ae6cd3aa6e1b280c66a55b6ec0b61356665adab96bd3d6c6164
465177c8672c67eccf0552d2563e6205f217cde232aa792330519b8bbf6b9f55
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
485f77b85c450f4bf97d622b9d58fbf347c483e2e4ea83cbf2da4bf377ad7d3e
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7
49141ee85a330a46cb4a6f2bf8013939f0b563cdfa8a0b728392cc45f5cdbbb9
4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98
4a30059985c4efb4325853db9b5c726150b378d566ce7135c8583453779c3a99
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4ba1b9960f6bcc2d49080931ddd405a8fda579f905c7094d567d2b5823ae7970
4bf9a1ab87e2efb3f94f90e23b4b6b4ce2ccafd67eca1c0ae48ff2e6e8758b6d
4bffe3f1aedc52461c3863d557b25f666f7a4b8fa98574fb9398e498e3f5ff93
4c60f558c03602ddc3357284f7f0ae306397589205f7a3e8488d9cf06f9d78ef
4c84ebf01080daa5f382d183dbd7b5dfc1b6a71834c155ffba7770d5f038f96d
4d4776b63e7039b0e93625a4ab29def9f2ce710d5685b6b61e704d69a6fc8a8f
4d67a80e24c2b1a12976ca31eab486a2bb8ff6498189888126870502a3d5050a
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e8db1932af0e6814282eea5fa648e4b93a624552f0378ded0a9185afc5a8e33
4ee0e14dc6bfdcd52ada1be260f77ac32abf0efcf15a23f474ecfa4e62d73cd3
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
5539bbe3dfff73a6703e349f1b0b346a07db00cd21383666122abe6247d22a54
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56643d9fd91e911106879f82432144e1e8fca40bc3e783b7b1d3085a16f844bc
56e164fda5558c116b09caa15adde21bfd3b75e7987035a1f79638eb7994dcbe
583dac8694c20e5149d74befb127ed1f69feda69dc2e6b1ed4a9d710305cdc3b
5876aa208449c3a4e139d6a17fc83e36642057a75ca557bbf0a204b0e5cbb6ac
598ce94f8c2b8d5deacdb62254051a1d9f95897ffb1fa6d7a73ec10ef995f84c
5a46500fc330c3cb0f2ff3e4c77bfc67c85f1caf81d6e6904e87da6b51b288cc
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5e723549bc90d89491e97d8fa080d1028a716730cf5552f2051bb9a169f947f7
60e0c32dbf5eab01ae0752be4d8e1cbece0fad2d0ff0cad14f9ac7a465beaa93
60f9494209a87a0f6ee00ec8fcfbc973bb2b8074dae2e00c2ce82964066f3d49
6122d435ed5dcf3bab4bf1c496f235953110d2ebc8afe241a3f502df91789e29
612b88bd6f51637617b7d4b2ceba1b8fceabe16a7b40bc9eaddafa8db86f0741
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
61fae2c3593c2ee7150e5b64502de43e394eeda2a036407310c110cac539fd70
620b6cdd6a7d56e566a8af1511297622478d3d346af5ce7b2fcc11763ef0590e
6357d0585407b92bcde642e269c884655cf6d4820df3cc0ff6d8b4307c9ad0e0
639155024ca9ad9275c5af7599376a19379d441883552dd548a71fb475a51c31
64cafe249e9d812908ddb760e41d094b2c8de11c98408ecae3d5bf51d271ee49
653d3e6118b356b87f052d776f8899eaa758f2bf6bb0cbf2529a658215f6e14e
6738250294e9e45166c759ac86bd0ae0f45990d418e2cca3beca405a28528089
67f8c7fd7353ad063da1f3115924c458c494cb134f4d87de4407a132842c9bc9
6ac62ad133b177d67c52cfd6b1fa821b3566637b15c3637335036aae03cf972a
6b730d238f23c90046d04b9f83f3562e2fefc9dd52f246a2c3a25a26a2c5df25
6ee816398ac59bd1a1fddcb80037e7fd618f481fe467ad65e73afb4daff29095
70d4b41fde62741a53e831c8a1cd97653a33834cca37017f6dc8e89d3579ee59
72d464ebd30fb3325ecedd2bca4b5565d60c11b8e0737bbb070dcce56874e7ce
7490d60f3417f4542fd4ca238107b42b487694de022ee46549fde0ad73bc07d9
7493588675677e6140e36a8383fbf3022b516af674bab22f1135c5408c164f9a
757600e815b9ad3a942248d793becdf185f82abd8082097f90f96c9bc2579889
7a3321061bf3a48a5649e0ea1a8e264ae5aa08d2da0bd8f62ba2fa34c8e0487a
7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb
7a91ecfa97f9e1ea7dd849541522c0a7caa2c59780c8aa7939b4624302dca688
7a9a7ca080dfdd54223b6f65bca630e5fa23b5ed2bc32d5e88ec7e86dd4c413a
7bfd19845d91b69d293846e050b9f41efbc02106594ab7b867eaad88e7414500
7c2a7142846ad99b18413f75319e4794420db4f9bbc30bf2d3f20c64a034959a
7d8fcb2740286e4a067eedcbc86c5a2cc7c486442325f7d7f5aac956f41891d6
7f21ad2825687a445b113c44093b82e20b88aa7d5ee04a660c286656b38f2461
7fdd701f4c76d3899a7853e38fc05ceb4364b6dd082aba974fe2828cf0900fab
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
83241f77efac1754623e5fb56e69a1b38ebff87cb3b6593b9709f0a8ed572af1
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83fe367392b2bf7feffe2df33ba7a9fa11c77e3ec554a70c6c1c5fcfe7066654
843e620cd5540dfe694bd860e0dd8e895074c59785b9843d550fb35f9f3ea9db
846bd2506ff67e6fb04c1b886fa912d325ecc49f6a5045e71e2bec59bc843341
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
853a8c7e34be5549a44fc541e13876f5c2838123142f527dab2265950feaeefb
8647f0ff2d3928b0dc28fce6b5f772165749bfec8ead2c88c661d785cea35ddc
8709b6dd40c3e036b2a786e68bd32bf809fe53b461c31f8aad0e0a65834c86e4
87a9d514b5623bbc5e9287ba10c5ef7d3aea2bc480fe2b01a01ab9b856fa6917
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8b4ff97db4a786442f06eb444e02f71247ef9f28ffd2faa3988e370ef9fed1c1
8cac28b7e48477a843c2c62c296e785e263d09bb7e61c07aacb874f210bd4d8e
8d8abeda3163e5da9b652b5369ce86fbc45fd975b552255bdf2e60b17cc1e54e
8e78e7a2479d97e612c260bec313bd27413fe5c3fdcae29c5fb2b93e18089455
8e7db196f52cd053d40a1777734ad97db6b60f69cc485e8c51371a57eba06bee
8ece892dd9f6f9422486965af38d8523ab24df3e5076f8d08bc0d5a00ce3a5af
90c5abafaf023dc970d5cb9b7ce906ee99a4126933c0507c15cf8a8de472dc05
91daae3b41b364005bf78fb77beb12c6f1298c76e6474f87478eb70240274b23
936ba8bf496ed6bd6c128d1fdd550f09a39fa364bc7f8d94292cbd6bf21a685f
97a09426cf3156fcb0084c28d883b104079f75152a7bac88550e80bc04d9a7da
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9ac7c0eac3a8542d01ac01f5bd9d404f426123a014b95fdb3761ef423bc2be70
9caea4887df78b4db82317ce9ea1b48f0992efdeaf84b5855b83d16f70c62cd3
9ee24378d463b62bed1f56ccb1a5a15ad397dd3202a6fd9230920a1b7536763f
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a0163cf949cea5a556b144eb406773e848d3f639848858e5eafa49657b5927f4
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73
a26d7089ef2a9f739f1e256d61474818f18a3e5cdbd79e02ed682aacfbdbab5d
a3127ac204e6d6439f2edd47894bd5f9ab709b2fc0b75066c8e8ffa2b8397085
a408c6b95435cdda63eb60270c3166015182938f9a9c4a65f8dfb0eb29976848
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4d47dd6793fe24c23ab3c34f630ce5d0f42ef12a9e19eabd2fba286296647e9
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a777ac5900a1c203090b369241723bd00a254fd1823b58cad36608a082f381f3
a7d5c1bfe43c8beefab2fa059f4fcaa029fcbbace9a672aae1dfe1ffb7d6976c
a82cfc0898db1cd7583fca737233cf33e59df6244bffe7d187ca9ad17f63366c
ac17b249663d7eb30946ee224b9687e9962ab7a6167b431fb0ee38820d77d63c
ac91b1dd5fc366aa22165d23f77d780bfa9189da1eb13c4709f3b1a0486c79aa
ac95bff637a5b50b2465783a7028df6b3588f59af4f1e0923c32d658620dedde
acc5497e76f832d950d14fcfa047dc3c864f7a0aae4c7a20521c0c655a53033b
ae829f91c5894fabf92675d9ccf31d618cd5e4d9a518274c532a727d71e8b3ef
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b24b7c9620c9f87df6a87ccbe3d1bca12946f5b36e51ae8b93c54cf017e11de7
b43bdddaed119873e24d06f2ce6eac2257c3fd1a177498a98a2bac49d1e3b924
b63db586c1504ae1e53d9e31befcc458d8df5dfac8a4f6f7d31537ad514c59fa
b921f4059f021611472748433f0312372844505cacc69b33d72f43ef78be8740
b9dff679ff9931afbbb8019d522a7d03d7787a7d7818037d48f3a502c652e2b6
baa7346a51ac22b01b0f63ef8be8a7b0946a67fbe68ccf2c8a783a769bad8870
bad0b93d7fba2cfc878063b90eb88bcf9e3afb6f589d054d644f64200bea1598
bc2503bbfee2360c71c3305513d389795dd576960d962c78a85cdceef7d03732
bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05
bfca0b6f1dc25757d76491238330c153e79b2fa83a34e22cc12165ec01887b8e
c043149c1afda53688ff4e4414a8f5131c9893b949a72391b951fbd6febdef65
c2a3115077a95647a42f0c264e3a04d19ce7e8dee6bc3a8dab639c77d0b19bf8
c2dde2535b501f44c9dade0e3406f0274c539c3c32c385ef1ad5c21b6a159f22
c42cae75913ec96ba31fccf326428b94dd67b74811da10d337f9504eee0e4561
c4ab1a513e585c36df0f2e90505d9beeb4944b4d1a051be8296e07d110c62dd1
c6927f0880b87203aac8ddd54fdb83f0c810f2af855b79929bd68daa06c07ad0
c7b42a53653a228805775badb1251d03f4848ffd6282f7590716a0f8d42eac18
c8cadeafda893da177470421700da9ee30a722fe9c265461260ba862fc850f98
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa
cbcd7d6a74606267bc1991f924c9ec57b9e8c060e71265504eccbb50209274e6
cc2555ef0f701357d4119e8e995cc210be61d19b11df6616fe43e31076cc1168
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d1dd6ac18492d83589132251f09bae39e805ca06ba01b87648d345c9ff38a448
d2db0694e2252c598366268aa659c4d208877fea3c39ca91bb0c2e0256c670e8
d303cf1d13d699f41e2520b8281efbdca20b84f9f1a623b52d1f060508fa3950
d4692b534405e7bfa214d6f0be637cb40e30b3ea901ef4de38ed154c69cc059b
d6008724234574a34faf904692233f76652f1140c12d7ec0318791d66ccb4bed
d6ae8dc04843c25e2e0b981199286ec076b69efcf9ec698825cecdd2392ba458
d7ec9536f20060341782af0fecc91836bfce059060086533938f52b8119e184d
d964a9a6737e9a29da6730b1e5ed27ea31b53d3c32cf3af4dac9d2991f803741
db467521165cbab260e2e5bdcaea4bb3fe26be327bf3ab24ddd4c0bb4426315a
db4bdf692ad81c7068c4443eaafbce183a24e03439f49665d0fc7154414c3af5
db4dcb0e61cb376e3875e18c4a2ecd03ddc625f83928b6cda311c7039ea0f7ae
dc6fe4e32f9012ff9d6f82bfb9e1d2624992d39eeaa1cbb73f733f2c0cfc0d90
dd70df7f293f7fdd881a28ae7e80ef7dad74e9a6058e8c1b768c761e4e71da44
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e0e44c153e6969ff112250bc468dd4615e5f48f2b2db3e3ffabc11be9d9b6313
e1251bbf5e3a03f563e3de8690f29d1c4bda783bd8e9b4e8e2b928c57031b844
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
e306f5e11b4ff708da66fa62630a739750ccf45b00857b576e5cbe366d778f26
e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a
e33985eef36bc4b35d37840939db9248170e09a216ea7a1c38ccd51831b96774
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5395e0a9a868114182016356850e98a9175a99b9bcc681ab3690b644f407989
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e5c7f035a8ef5c8af9e2ddbc483d4492000ecc92cb08a35c21294c33a23503b6
e5d16e9f8bfad5c20d9dbd54a6ba433c540f31e4d84f667f49042e4eb8640269
e66bfceb15a6ee125dff79826be02a07b766843e6c660edf55ec0c22d1a407c1
e68a542d16ab26d7748e1af28667863081c5c0ea294ae83a7db96253d3939a9f
e73cb29d06e940b29c9e76ca982683ed9bf180197cb21e3ef95d455f7b3a9f2f
e88adda18aa09bcb1b6747436882f40a0074574df0ca4bc130779bb440e19d9d
e8d1498ca22f44cb3f8bf74df6565cded6c69f73957b46909240163db6603585
e9407263ab4fca6728410696370e790de6f6116cd122e81c30f2603d6a8b0566
e97bad6981037caddef88cee2e08d28aa0fd8ab727fd7d502009e17999a26239
ea242062642c9fbfed60a788520406ba0498c6579e9a94500ef52ecfe413330a
ea243e27076943a5861ac8d64689741faa79d0b5fb4b51913e58928f2a09ac7e
ea3b426f52eb2e3b1be82153c25ab7d1c77db0fbbbfed7b5f347efe3f477a47b
ebeb8017dea624e96d74fc47c4f8c622993e511b256f148dd41e20f20ee909a3
ee01483c763fcc1cee90cde3b33ea8e87be3991511d37534290907c2ff5b2db0
ee6c0f621745e1cab45392204a460a84c2673d528febfff337884f4857a17ada
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce
efbe27a9115d94a2318d9435fbfed07c45d0194d76fce89f4b60501914a0a3b9
f24a6c91b2816f650c823fa79560f8746193dcce5921e3c7500c43d635e513bf
f47a1b67dfd6b5ddaaaa0febde7acf2fb9a16f0c3e0d6ba612a82135cb790b80
f4b8e846e1436e318306ff6394bc05b4367a700f6156c67a1cbc5ed594b9a1bc
f4f64b87c86c09c59cf3e0a9827d6703fcb2ed10db96495d91fc259d231eb105
f66663288c356836650b769dbe1b68bc97e4d08f5b230f2ffc1e1c72480b0b06
f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48
f748110cf8280254c6705d7cf18de8b04369c521d9db43e63897e531c283578d
f8375bf4214fa9f41b23879a739807b97204ad583ef53b3125b755870a022496
f92408753dcb5fa6d0fd4b4ac2b6ed2b64f93340a00dd774653faef70bec9ccf
fa697a8aa6470a68997f6074bee3fe8890e34ea44fb72bdf1aa4dd6ed1cfea6e
ff28c2ecaab0c068fb5c2db084aaad89f02a14132f13d8606e7f3a66aa7bfc2d