www.bg3.co Open in urlscan Pro
84.17.37.44 Public Scan

Software

sffe /

Resource Hash

889c8dd97d82a778b37300d54b338cd093040b2aacc208df8b2c4f5896bde98e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Sun, 25 Dec 2022 04:32:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72681
x-xss-protection: 0
server: sffe
etag: "0f8f5d9d8c9a8fd9"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3000, stale-while-revalidate=1206600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 25 Dec 2022 04:32:45 GMT

GET
H2 200 amp-sidebar-0.1.js Show response
cdn.ampproject.org/v0/ 31 KB
10 KB 1503ms
954ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-sidebar-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74a728f3606e8e792cd0959126c33a0d15aa2c047e20efc083aecf408ee16fce

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Sun, 25 Dec 2022 04:32:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9654
x-xss-protection: 0
server: sffe
etag: "4b66d6f91d1262b7"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 25 Dec 2022 04:32:45 GMT

GET
H2 200 amp-auto-ads-0.1.js Show response
cdn.ampproject.org/v0/ 24 KB
8 KB 1345ms
817ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-auto-ads-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b803ad1dd4b7e46b45dfa6f3cdf42053ae31b0ca7e1ed7cc71ed2d098324ebd

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Sun, 25 Dec 2022 04:32:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7580
x-xss-protection: 0
server: sffe
etag: "68f3175abba6e2b9"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 25 Dec 2022 04:32:45 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/v0/ 109 KB
31 KB 1368ms
840ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-analytics-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

321b3e630cd5162192ca9753f956dda11f61aba3f45c8265d4604e41257c60a7

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Sun, 25 Dec 2022 04:32:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31959
x-xss-protection: 0
server: sffe
etag: "a9a002bfa741eb92"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 25 Dec 2022 04:32:45 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
49 KB 832ms
286ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5961800537962381

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6e30b7f49f846c1b15330a6f640663e0c57003b1d971e3373d907366c8b606f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49439
x-xss-protection: 0
server: cafe
etag: 14807486649332860205
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 25 Dec 2022 04:32:45 GMT

GET
H2

200

sdk Show response
cdn.aralego.net/ucfad/sdk/apac-sg/
Redirect Chain

https://ads.aralego.com/sdk
https://cdn.aralego.net/ucfad/sdk/apac-sg/sdk

44 KB
45 KB

443ms
151ms

Script
application/octet-stream

104.26.5.103
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/sdk/apac-sg/sdk
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Server: 104.26.5.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8af4a7b3549631244df52a0d91b22ccfb355b2f10caab9fe9fa0b57a2beff473

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:45 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3631
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45472
last-modified: Wed, 21 Dec 2022 06:34:24 GMT
server: cloudflare
etag: "63a2a8f0-b1a0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JpMT8s7%2FuJWk6YeagNW0%2FRLr5ec4gEAgsCgQRpYPOMDwB5kFwCyiQdWEvwKRBSCbH2ClRd6cgjIKaU4suldFCXO38Kx6PHtx%2B3vVNrPUJIzV6oOHrNl92th3TZS4%2B1rCVg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 77eedacc4f57aae4-SYD

Redirect headers

location: https://cdn.aralego.net/ucfad/sdk/apac-sg/sdk
connection: close
content-length: 0

GET
H2 200 adRecover.js Show response
delivery.adrecover.com/43519/ 34 KB
9 KB 1443ms
349ms Script
application/javascript 42.99.140.201
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivery.adrecover.com/43519/adRecover.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.201 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-201.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 0c34cb102990c1b0ba90b693198e9bde03f0a060d26ff42b3b230e781bb31f49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Sun, 25 Dec 2022 04:32:45 GMT
content-encoding: br
last-modified: Sat, 24 Dec 2022 08:00:30 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
x-cf-geodata: NZ
content-length: 9215
expires: Sun, 25 Dec 2022 05:32:45 GMT

GET
H2 200 adpushup.js Show response
cdn.adpushup.com/42753/ 524 KB
114 KB 1511ms
363ms Script
application/javascript 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/adpushup.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 04d04f0a5ea44e5c6e9a2be97dd68c1197349ba9f73e95333d6928a3818eb1f4

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Sun, 25 Dec 2022 04:32:45 GMT
content-encoding: br
last-modified: Thu, 22 Dec 2022 12:04:02 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
x-cf-geodata: NZ
content-length: 116557
expires: Sun, 25 Dec 2022 05:32:45 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/ 356 KB
117 KB 841ms
296ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/show_ads_impl_fy2021.js?bust=31071219

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5961800537962381

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6a66d5cb24c201f7d7e68416c4b3ed712fa7646e616243401a7f2829c8b6c2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119973
x-xss-protection: 0
server: cafe
etag: 15046969941380596776
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 25 Dec 2022 04:32:46 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221207/r20190131/ Frame 6F11 10 KB
5 KB 829ms
273ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221207/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5961800537962381

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 58692
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 24 Dec 2022 12:14:34 GMT
etag: 10353107486223812946
expires: Sat, 07 Jan 2023 12:14:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ucfad-formats.css
cdn.aralego.net/css/dev/ 975 B
622 B 149ms
148ms Stylesheet
text/css 104.26.5.103
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/css/dev/ucfad-formats.css
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.5.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1be00e223b2840fe8ac2d3a1aec0cf757088dd68f53a92275d0e1db6cb9afced

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:45 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7677
cf-polished: origSize=1191
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 16 Mar 2018 07:19:46 GMT
server: cloudflare
etag: W/"5aab7012-4a7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jJnT%2BJWP3XMZQBUuXqsaHC8UTs4dc4wRIkia2ZjNI15nH37wN6KeMQLPcoXH8maXTZToy%2FCNr31%2FkSt2oFOvPj0gi6GkuAw5FB%2BIz5MCUZ2Hx0qJ5JMjlEglZ%2BY%2BPWJ8Ag%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
access-control-allow-credentials: true
cf-ray: 77eedace2951aae4-SYD

GET
H/1.1 200
OK idRequest Show response
sync.aralego.com/ 46 B
488 B 1065ms
267ms XHR
text/html 209.58.188.181
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.aralego.com/idRequest?lang=en-US,en&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.58.188.181 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: 64130342828152e777b39517eb0e90586f5ff14d092ee86658f2f09e524c7053

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:46 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Allow-Credentials: true
Connection: close
Content-Length: 46

GET
H/1.1 200
OK idRequest Show response
sync.aralego.com/ 46 B
488 B 1064ms
268ms XHR
text/html 209.58.188.181
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.aralego.com/idRequest?lang=en-US,en&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.58.188.181 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: 64130342828152e777b39517eb0e90586f5ff14d092ee86658f2f09e524c7053

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:46 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Allow-Credentials: true
Connection: close
Content-Length: 46

GET
H/1.1 200
OK ad_request Show response
ads.aralego.com/ 508 B
1 KB 763ms
293ms XHR
text/html 23.108.102.145
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.aralego.com/ad_request?sw=1600&sh=1200&ifr=0&bl=en-US&je=1&dnt=0&host=www.bg3.co&u=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&adid=ad-627443DBE4283AB9F7A46EA83243447&w=336&h=280&ver=UCX_WEB-20200113&pos=1&seq=0&cb=0.17983626529265684&gdpr=1&euconsent-v2=%24%7BGDPR_CONSENT_607%7D&format=336%2C280%3B&lang=en-US%2Cen&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&uaMobile=%3F0
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.102.145 , Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: e813a8d8d41c0dbdc33020ad6ef27d16afd2b590ceeb998e267409c8f666b829

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:46 GMT
x-width: 336
x-height: 280
x-adstyle: banner
access-control-allow-methods: GET,POST,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: X-Width,X-Height,X-AdStyle,X-AdCap,X-AdWatchUrl,X-AdSource,X-SspId,X-Deal
vary: Accept-Encoding
access-control-allow-credentials: true
x-adsource: PSA
x-adtype: html
connection: close
content-length: 508

GET
H/1.1 200
OK ad_request Show response
ads.aralego.com/ 508 B
1 KB 775ms
306ms XHR
text/html 23.108.102.145
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.aralego.com/ad_request?sw=1600&sh=1200&ifr=0&bl=en-US&je=1&dnt=0&host=www.bg3.co&u=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&adid=ad-627443DBE4283AB9F7A46EA83243447&w=336&h=280&ver=UCX_WEB-20200113&pos=1&seq=1&cb=0.16053511806597398&gdpr=1&euconsent-v2=%24%7BGDPR_CONSENT_607%7D&format=336%2C280%3B&lang=en-US%2Cen&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&uaMobile=%3F0
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.102.145 , Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: e813a8d8d41c0dbdc33020ad6ef27d16afd2b590ceeb998e267409c8f666b829

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:46 GMT
x-width: 336
x-height: 280
x-adstyle: banner
access-control-allow-methods: GET,POST,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: X-Width,X-Height,X-AdStyle,X-AdCap,X-AdWatchUrl,X-AdSource,X-SspId,X-Deal
vary: Accept-Encoding
access-control-allow-credentials: true
x-adsource: PSA
x-adtype: html
connection: close
content-length: 508

GET
H2 403 0d870f7fb657a12d21dd87b293c8694a.jpg
static.bg3.co/imgs/202105/ 0
0 447ms
151ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/0d870f7fb657a12d21dd87b293c8694a.jpg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 3b1f5640c7ae081bfefce31b2cc3b153.jpg
static.bg3.co/imgs/202105/ 0
0 466ms
170ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/3b1f5640c7ae081bfefce31b2cc3b153.jpg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 89d187e271051b63e32de2a7c0ad8aca.jpg
static.bg3.co/imgs/202105/ 0
0 459ms
163ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/89d187e271051b63e32de2a7c0ad8aca.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 2d54fbaed45eb6d2d36e79c251da6cc2.jpg
static.bg3.co/imgs/202105/ 0
0 576ms
280ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/2d54fbaed45eb6d2d36e79c251da6cc2.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 04a5e30e50d869ef795574a3a520c7a0.jpg
static.bg3.co/imgs/202105/ 0
0 472ms
176ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/04a5e30e50d869ef795574a3a520c7a0.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 264080350bffa3cc3354a6d8a4485bee.jpg
static.bg3.co/imgs/202105/ 0
0 478ms
182ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/264080350bffa3cc3354a6d8a4485bee.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 a7e0a58342f643e524f2314fff04db1a.jpg
static.bg3.co/imgs/202105/ 0
0 444ms
148ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/a7e0a58342f643e524f2314fff04db1a.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 b5c67e807c24f65aef079583d595bc3c.jpg
static.bg3.co/imgs/202105/ 0
0 586ms
290ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/b5c67e807c24f65aef079583d595bc3c.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 6117ecdc398ff26507cae9e079e1c4e5.jpg
static.bg3.co/imgs/202105/ 0
0 452ms
157ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/6117ecdc398ff26507cae9e079e1c4e5.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 8e82291da0f4d6ac7ad669d6553ecb95.jpg
static.bg3.co/imgs/202105/ 0
0 150ms
150ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/8e82291da0f4d6ac7ad669d6553ecb95.jpg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 eead99884da479f2536d7d36e315d4d9.jpg
static.bg3.co/imgs/202105/ 0
0 150ms
149ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/eead99884da479f2536d7d36e315d4d9.jpg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 44549fda9ebd1d6a263aa7b14edddc44.jpg
static.bg3.co/imgs/202105/ 0
0 154ms
154ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/44549fda9ebd1d6a263aa7b14edddc44.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 3b62362a729373082feea126fccf1768.jpg
static.bg3.co/imgs/202105/ 0
0 159ms
159ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/3b62362a729373082feea126fccf1768.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 32a9fa9fce8682c1125e4b2ae52fe174.jpg
static.bg3.co/imgs/202105/ 0
0 148ms
148ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/32a9fa9fce8682c1125e4b2ae52fe174.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 764e00a584b5a82ade58dfe8281847b9.jpg
static.bg3.co/imgs/202105/ 0
0 147ms
147ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/764e00a584b5a82ade58dfe8281847b9.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 292dd0bd04177404a2ecbe0f3f293cd5.jpg
static.bg3.co/imgs/202105/ 0
0 150ms
150ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/292dd0bd04177404a2ecbe0f3f293cd5.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 0d8a0675733b753bbaf3c1d87b46e063.jpg
static.bg3.co/imgs/202206/ 0
0 153ms
153ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202206/0d8a0675733b753bbaf3c1d87b46e063.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 e426be803ffd28e0a7d176ed20754cf4.jpg
static.bg3.co/imgs/202105/ 0
0 149ms
149ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/e426be803ffd28e0a7d176ed20754cf4.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 ba2f94b6ac580f82e9a6382ef9b39c5b.jpg
static.bg3.co/imgs/202105/ 0
0 151ms
151ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/ba2f94b6ac580f82e9a6382ef9b39c5b.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 4351ffc2de33f2d21576e92cccb717c5.jpg
static.bg3.co/imgs/202106/ 0
0 159ms
159ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/4351ffc2de33f2d21576e92cccb717c5.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 0072171a45d17518097f607781829b3e.jpg
static.bg3.co/imgs/202105/ 0
0 148ms
147ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/0072171a45d17518097f607781829b3e.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 0cf869c25febb309e4da53bf7b4ac8e4.jpg
static.bg3.co/imgs/202105/ 0
0 153ms
153ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/0cf869c25febb309e4da53bf7b4ac8e4.jpg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 e72784ed3a181a01e825160ae3e9569a.jpg
static.bg3.co/imgs/202105/ 0
0 162ms
161ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/e72784ed3a181a01e825160ae3e9569a.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 a2d425144b506e8c7c27fb87bde82bd3.jpg
static.bg3.co/imgs/202105/ 0
0 168ms
167ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/a2d425144b506e8c7c27fb87bde82bd3.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 422bc102f20b8e6545080328a9b3a2c2.jpg
static.bg3.co/imgs/202105/ 0
0 157ms
156ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/422bc102f20b8e6545080328a9b3a2c2.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 a356be4c596d0389aa883110e5b6a577.jpg
static.bg3.co/imgs/202105/ 0
0 149ms
149ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/a356be4c596d0389aa883110e5b6a577.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 6530df00782fdc071965a1747048bea2.jpg
static.bg3.co/imgs/202201/ 0
0 150ms
150ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202201/6530df00782fdc071965a1747048bea2.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 1f9104c2873b34cb88c581b9241d4e5a.jpg
static.bg3.co/imgs/202105/ 0
0 154ms
154ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/1f9104c2873b34cb88c581b9241d4e5a.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 amp-auto-lightbox-0.1.js Show response
cdn.ampproject.org/rtv/012211302304002/v0/ 8 KB
3 KB 273ms
273ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211302304002/v0/amp-auto-lightbox-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d890adb2cee66d5527d37756a7c31451767903ffcc0f7063cb923043db885c25

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Dec 2022 00:32:48 GMT
age: 360000
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2982
x-xss-protection: 0
server: sffe
etag: "2822a89a04832126"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 21 Dec 2023 00:32:48 GMT

GET
H3 200 amp-loader-0.1.js Show response
cdn.ampproject.org/rtv/012211302304002/v0/ 12 KB
4 KB 273ms
273ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211302304002/v0/amp-loader-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

17ad2ba9644dc2e2245219e384abf35638308374aad83151d64b9af2cd0d7e7d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Dec 2022 00:32:48 GMT
age: 360000
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3930
x-xss-protection: 0
server: sffe
etag: "e11794ea739ab772"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 21 Dec 2023 00:32:48 GMT

GET
H3 200 amp-ad-0.1.js Show response
cdn.ampproject.org/rtv/012211302304002/v0/ 82 KB
23 KB 273ms
273ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211302304002/v0/amp-ad-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37f6ae60595a0d47a07f29de8025c7f9023ede6b23230df0af72a9698c7ca849

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Dec 2022 00:32:48 GMT
age: 360000
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23078
x-xss-protection: 0
server: sffe
etag: "e8aa1933667594a4"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 21 Dec 2023 00:32:48 GMT

GET
H2 200 ama Show response
pagead2.googlesyndication.com/getconfig/ 3 KB
568 B 277ms
276ms Fetch
application/json 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/ama?client=ca-pub-3216231935713038&plah=www.bg3.co&ama_t=amp&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1e1123e2469a7db5500a09760a212a71816fda07c14bec61dae452ebc3afd4d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 475
x-xss-protection: 0

GET
H2 200 jquery-2.2.2.min.js Show response
code.jquery.com/ 84 KB
30 KB 850ms
284ms Script
application/javascript 69.16.175.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.2.min.js
Requested by: Host: delivery.adrecover.com
URL: https://delivery.adrecover.com/43519/adRecover.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: tlb.hwcdn.net
Software: nginx /
Resource Hash: dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-sp-metadata: HS256.CIHBn50GEogBCiRjOTYzNjdhYS00OWIwLTQzMGMtODlmMy0zMTA2YmY4MDI5YjUQ+OiCoKvU+wIaBgjxpJ+dBiINMTE2LjkwLjc0LjIwOCiE9wIwAzgEQhZUTFNfQUVTXzEyOF9HQ01fU0hBMjU2WiAzZTliMjA2MTAwOThiNmM5YmZmOTUzODU2ZTU4MDE2YRosCAESJGYwODdjYzAxLWJlYzAtNDQ0OS1hZTRhLTUzMDVhYjIwNWVhNxi46QEiGAgCEhRjZHMyMTAubGEzLmh3Y2RuLm5ldA==.eXT+HUUYbwFx/DsO/EmWE2JwmUEZOL+bg91odDJ+wKw=
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-14e98"
vary: Accept-Encoding
x-hw: 1671942769.dop008.la3.t,1671942769.cds204.la3.hn,1671942769.cds210.la3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 29880

GET
H3 200 amp-sticky-ad-1.0.js Show response
cdn.ampproject.org/rtv/012211302304002/v0/ 40 KB
10 KB 377ms
376ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211302304002/v0/amp-sticky-ad-1.0.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87e708d4895549290624cdda1268bba48ae78ab289a955f39b2adf8d54fdf5fc

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Dec 2022 00:32:48 GMT
age: 360000
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10271
x-xss-protection: 0
server: sffe
etag: "07afe8ec7a5b890f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 21 Dec 2023 00:32:48 GMT

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
31 KB 1099ms
556ms Script
application/javascript 69.16.175.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: tlb.hwcdn.net
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-sp-metadata: HS256.CIHBn50GEogBCiQ5YzE1NTY5Ny1jZjdiLTQyYjItODRiOS1lN2FiMTExYzkyMGEQ+OiCoKvU+wIaBgjxpJ+dBiINMTE2LjkwLjc0LjIwOCiE9wIwAzgEQhZUTFNfQUVTXzEyOF9HQ01fU0hBMjU2WiAzZTliMjA2MTAwOThiNmM5YmZmOTUzODU2ZTU4MDE2YRosCAESJDAxNzlmMzJkLWE3MGYtNGIzYi05MmFiLWUwODc2ZDQ3NzU3NBib8QEiGAgCEhRjZHMyNjcubGEzLmh3Y2RuLm5ldA==.9IUMjqUnaMfheFYSr7u1SKEmrY62hBLgeOKcYtWruZI=
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-15d9d"
vary: Accept-Encoding
x-hw: 1671942769.dop008.la3.t,1671942769.cds204.la3.hn,1671942769.cds267.la3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 2F94 99 KB
33 KB 293ms
293ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: ads.aralego.com
URL: https://ads.aralego.com/sdk

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4502750abe083fa7a911d75e5a6f83a199469c0438786bb2abd951e758561a3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34145
x-xss-protection: 0
server: cafe
etag: 8104860165656700927
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 25 Dec 2022 04:32:46 GMT

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame E7F2 99 KB
33 KB 382ms
382ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: ads.aralego.com
URL: https://ads.aralego.com/sdk

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8bfe5e287e36c562f187ad58dcca3cf47a6efd11cb90b6844541fb0e2ab4c355

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34178
x-xss-protection: 0
server: cafe
etag: 10532727656062052195
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 25 Dec 2022 04:32:46 GMT

GET
H3 200 gtag.json Show response
cdn.ampproject.org/rtv/012211302304002/v0/analytics-vendors/ 2 KB
931 B 826ms
279ms Fetch
application/json 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211302304002/v0/analytics-vendors/gtag.json

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8993772c9eb591474f38d257bebc8c4286703e1af72d04c8c294be5fff7b649

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Dec 2022 00:32:50 GMT
age: 359997
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 901
x-xss-protection: 0
server: sffe
etag: "57cb31050eaf5482"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 21 Dec 2023 00:32:50 GMT

GET
H3 200 cookieSyncIframe.html Show response
cdn.aralego.net/ucfad/cookie/ Frame 4E41 714 B
800 B 150ms
150ms Document
text/html 104.26.5.103
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.5.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36a7d95f2760a813f3e782dfc125ea786174d581d6f6f896021d6994e9514bd6

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
age: 7779
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 77eedad4ebaca81f-SYD
content-encoding: br
content-type: text/html
date: Sun, 25 Dec 2022 04:32:46 GMT
last-modified: Wed, 09 Feb 2022 05:59:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yzb99oSd9vHu0zzWSlCkQW%2B7J%2Fjvz87kWX7rfKX1wHnAsHweCz2CLHGa9%2Fg8zoWF3fi4KR4oAUJ7WtYR6Vm7WgHQ5rFi0UNYI10YOOm%2FZkQCL%2Bpcgzvox22NzoVwcPoc%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK idsync
sync.aralego.com/ 35 B
384 B 269ms
268ms Image
image/gif 209.58.188.181
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.aralego.com/idsync?gdpr=1&euconsent-v2=${GDPR_CONSENT_607}&
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.58.188.181 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:48 GMT
Connection: close
Content-Length: 35
Content-Type: image/gif

GET
H3 200 cookieSyncIframe.html Show response
cdn.aralego.net/ucfad/cookie/ Frame 2631 714 B
762 B 149ms
149ms Document
text/html 104.26.5.103
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.5.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36a7d95f2760a813f3e782dfc125ea786174d581d6f6f896021d6994e9514bd6

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
age: 7779
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 77eedad4fbc3a81f-SYD
content-encoding: br
content-type: text/html
date: Sun, 25 Dec 2022 04:32:46 GMT
last-modified: Wed, 09 Feb 2022 05:59:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LLE9R62I3o05Uotn4OLs%2FGk5HD3B6%2FFglY9Za9H0NWlPBqxe6inZSbUMVOjtG3cjq4yb7cT3NCnFLr5zV2kSSJOBaKBWRxfJBqxaF1UxGEC1F%2BC9zMtE%2B7xjIu2aiNlPSg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 4E41 80 KB
27 KB 822ms
274ms Script
text/javascript 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.aralego.net
URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3bd3fb9f25b8c4b6741c0430c375f4b4b14f9a0c03779ac6bd228cea036f04e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27544
x-xss-protection: 0
server: sffe
etag: "1431 / 378 of 1000 / last-modified: 1670587582"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 25 Dec 2022 04:32:47 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 2631 80 KB
27 KB 1097ms
565ms Script
text/javascript 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.aralego.net
URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0efe5a2440bc8207ce66ffdef2f4f59e6cdbcf0b02da8ebd623df6e8344167d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27542
x-xss-protection: 0
server: sffe
etag: "1431 / 797 of 1000 / last-modified: 1670587517"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 25 Dec 2022 04:32:47 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/ Frame 2F94 356 KB
117 KB 306ms
305ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53e24d0fdd4a03024d0cf65c56d187b215836299f3f9f950bfa643142e75724b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119962
x-xss-protection: 0
server: cafe
etag: 9783107303096584660
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 25 Dec 2022 04:32:48 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/ Frame E7F2 356 KB
117 KB 314ms
314ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/show_ads_impl_fy2021.js?bust=31071168

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e30495af52a4e786273d1a8b2043b2241397cc4f702f79350fc52760b52f6592

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119966
x-xss-protection: 0
server: cafe
etag: 17032808635672379382
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 25 Dec 2022 04:32:48 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 379 B
691 B 826ms
277ms Script
text/javascript 74.125.68.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.bg3.co&callback=_gfp_s_&client=ca-pub-5961800537962381&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/show_ads_impl_fy2021.js?bust=31071219

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f156.1e100.net

Software

cafe /

Resource Hash

ea3a777525ea687d6e1fc5c19b6c8f3613ae10e667c76bb1f73b808f522cd676

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ 107 B
792 B 824ms
276ms Script
application/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/show_ads_impl_fy2021.js?bust=31071219

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 825ms
275ms Script
application/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/show_ads_impl_fy2021.js?bust=31071219

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7B9F 9 KB
4 KB 637ms
336ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5961800537962381&output=html&adk=1812271804&adf=3025194257&lmt=1671942767&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32&plas=188x1080_l%7C188x1080_r&format=0x0&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1671942765648&bpp=4&bdt=1263&idt=1629&shv=r20221207&mjsv=m202212050101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2684637076624&frm=20&pv=2&ga_vid=1878843823.1671942767&ga_sid=1671942767&ga_hid=393509541&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44777877%2C31071219%2C44779793%2C44780792&oid=2&pvsid=3161634060883018&tmod=699634411&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=1649

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/show_ads_impl_fy2021.js?bust=31071219

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df8fb66572e9d7cda975f55dad51594539cbc30458256351984c4d1161382ac1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 3979
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:47 GMT
expires: Sun, 25 Dec 2022 04:32:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 amp Show response
www.googletagmanager.com/gtag/ 610 B
808 B 823ms
274ms Fetch
application/json 142.251.12.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/amp?__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

8492f3fc13f89700f09e8a96308911979a6289be084af2c497ea54dbd7dd7f5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=utf-8

Response headers

date: Sun, 25 Dec 2022 04:32:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="amp.json"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 258
x-xss-protection: 0
pragma: no-cache
amp-access-control-allow-source-origin: https://www.bg3.co
server: Google Tag Manager
vary: *
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_2022120501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 4E41 380 KB
129 KB 574ms
273ms Script
text/javascript 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js?cb=31071221

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e288c4dc57f72a69a497baef524f41c57e1c6a414b09a5bde22cd5b2f1b7cdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Dec 2022 07:43:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593335
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131905
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 09:36:10 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 18 Dec 2023 07:43:53 GMT

GET
H2 200 pubads_impl_2022120501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 2631 380 KB
129 KB 875ms
574ms Script
text/javascript 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e288c4dc57f72a69a497baef524f41c57e1c6a414b09a5bde22cd5b2f1b7cdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Dec 2022 18:04:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210471
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131905
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 09:36:10 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 22 Dec 2023 18:04:57 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
396 B 823ms
274ms Image
image/gif 172.253.118.138
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=a1&ds=AMP&aip&_s=1&dt=%E3%80%90%E5%BD%B1%E3%80%91%E8%B8%A2%E6%AF%BD%E5%AD%90%E8%88%9E%E5%A1%91%E9%80%A0%E5%AE%8C%E7%BE%8E%E8%BA%AB%E6%9D%90%E3%80%80%E5%B0%91%E5%A5%B3%E6%99%82%E4%BB%A3%E5%A4%A7%E7%A7%80%E4%BF%AE%E9%95%B7%E7%BE%8E%E8%85%BF%20-%20%E5%A4%A9%E5%A4%A9%E8%A6%81%E8%81%9E&sr=1600x1200&cid=amp-Si5SS-eYORi5E3KZ-XPXKw&tid=UA-172083736-2&dl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&dr=&sd=24&ul=en-us&de=UTF-8&t=pageview&jid=0.09848694657098345&gjid=0.054288800615143185&_r=1&a=4350&z=0.3119140095263684&gtm=2pu000

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/ 23 KB
8 KB 576ms
275ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/amp4ads-host-v0.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/show_ads_impl_fy2021.js?bust=31071219

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c8c525c55cf82a2b7abf6fbfb179c7b8c21f0ae7efef5ddc53372422440444ee

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Sun, 25 Dec 2022 04:32:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7852
x-xss-protection: 0
server: sffe
etag: "c0564ce6402f500c"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3000, stale-while-revalidate=1206600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 25 Dec 2022 04:32:49 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame 2F94 379 B
316 B 507ms
278ms Script
text/javascript 74.125.68.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.bg3.co&callback=_gfp_s_&client=ca-pub-4485239425924787&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f156.1e100.net

Software

cafe /

Resource Hash

beef4655e002aeb1092c9221aed61a0806910c1fd475abf94e00537c398eec1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 247
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame 2F94 107 B
165 B 576ms
275ms Script
application/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 2F94 107 B
165 B 582ms
281ms Script
application/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8BFD 26 KB
11 KB 458ms
457ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1671942768&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1671942767038&bpp=12&bdt=1317&idt=1835&shv=r20221207&mjsv=m202212010101&ptt=5&saldr=sa&correlator=2684637076624&frm=23&ife=1&pv=2&ga_vid=794614638.1671942769&ga_sid=1671942769&ga_hid=445563408&ga_fc=0&ga_cid=amp-Si5SS-eYORi5E3KZ-XPXKw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=60&biw=1600&bih=1200&isw=336&ish=280&ifk=204013863&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44774648%2C44774652%2C44780792&oid=2&pvsid=2150646398706856&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.fogr5mayhrgb&fsb=1&dtd=1852

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ad9ddfa75efb0b1ec43b9dd4dc02acfac426afe4d126d52bab36a3efb8f6dd1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 11629
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:49 GMT
expires: Sun, 25 Dec 2022 04:32:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 amp-ad-network-adsense-impl-0.1.js Show response
cdn.ampproject.org/rtv/012211302304002/v0/ 215 KB
57 KB 273ms
273ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211302304002/v0/amp-ad-network-adsense-impl-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2400797e6cdc3aa0e87ecfcf346be3ddf2179ec973448a82a260c562061a7c0a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Dec 2022 00:33:34 GMT
age: 359955
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57898
x-xss-protection: 0
server: sffe
etag: "477261eabf4dff2e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 21 Dec 2023 00:33:34 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame E7F2 379 B
317 B 575ms
274ms Script
text/javascript 74.125.68.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.bg3.co&callback=_gfp_s_&client=ca-pub-4485239425924787&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/show_ads_impl_fy2021.js?bust=31071168

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f156.1e100.net

Software

cafe /

Resource Hash

228980506e7db472cb1989955fac86d9c95525725b55054c822d0046d3398064

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame E7F2 107 B
165 B 576ms
275ms Script
application/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/show_ads_impl_fy2021.js?bust=31071168

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame E7F2 107 B
165 B 576ms
276ms Script
application/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/show_ads_impl_fy2021.js?bust=31071168

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2

200

NqeGLmvuPvGdeaxEq2qKJUjcmyulAyFU8K2rHVjS.html Show response
adx.holmesmind.com/adx-file/20221117/ Frame 931A
Redirect Chain

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134177&pi=t.ma~as.3006%2F14006&w=336&lmt=1671942769&url=...
https://adx.holmesmind.com/adx-file/20221117/NqeGLmvuPvGdeaxEq2qKJUjcmyulAyFU8K2rHVjS.html

673 B
1 KB

721ms
235ms

Document
text/html

13.33.33.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://adx.holmesmind.com/adx-file/20221117/NqeGLmvuPvGdeaxEq2qKJUjcmyulAyFU8K2rHVjS.html
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/show_ads_impl_fy2021.js?bust=31071168
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.33.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-33-38.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 21902e4026c2f774fbd13f64845d6fd3a823c1ea64ee93e76a9fe06a49a74711

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 1369
content-length: 673
content-type: text/html
date: Sun, 25 Dec 2022 04:10:08 GMT
etag: "48eae0cda160246f65db69ea3a0e8b6a"
last-modified: Thu, 17 Nov 2022 07:10:46 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 74e86ed0fa6d314b06f69aa24cdc2c36.cloudfront.net (CloudFront)
x-amz-cf-id: U4Js2YeDzy-VJ1tvBMzP_IZPeRk6g6T_bVa--VguWMozeVi33DFAhw==
x-amz-cf-pop: SIN2-P1
x-amz-version-id: b3LGmBAhby0rF5s3WuXdhl5wmvGClwHA
x-cache: Hit from cloudfront

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:49 GMT
location: https://adx.holmesmind.com/adx-file/20221117/NqeGLmvuPvGdeaxEq2qKJUjcmyulAyFU8K2rHVjS.html
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame 4E41 107 B
122 B 570ms
275ms Script
application/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js?cb=31071221

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 4E41 107 B
122 B 575ms
279ms Script
application/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js?cb=31071221

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 4E41 492 B
264 B 307ms
306ms XHR
text/plain 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2929754655092833&correlator=3737722364997703&eid=31071221&output=ldjh&gdfp_req=1&vrg=2022120501&ptt=17&impl=fifs&iu_parts=18087395%2Ccookie&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&adks=64515409&sfv=1-0-40&sc=1&cdm=cdn.aralego.net&abxe=1&dt=1671942769140&lmt=1644386353&dlt=1671942766941&idt=2178&adxs=-12245933&adys=-12245933&biw=-12245933&bih=-12245933&scr_x=-12245933&scr_y=-12245933&ucis=q977if5sktsa&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Fcdn.aralego.net%2Fucfad%2Fcookie%2FcookieSyncIframe.html&ref=https%3A%2F%2Fwww.bg3.co%2F&top=https%3A%2F%2Fwww.bg3.co%2F&frm=24&vis=1&psz=0x0&msz=0x-1&fws=256&ohw=0&ea=0&ga_vid=1849739361.1671942769&ga_sid=1671942769&ga_hid=1826823358&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js?cb=31071221

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e79356d442ab7d9c71c014543496c6d8f74f9c3ba76876b4f89c3600796b8411

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 233
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cdn.aralego.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
a6908cfda5fa1b887369cc8fa6408cb5.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0168 6 KB
3 KB 831ms
274ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a6908cfda5fa1b887369cc8fa6408cb5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js?cb=31071221

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:49 GMT
expires: Mon, 25 Dec 2023 04:32:49 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame 2631 107 B
122 B 359ms
278ms Script
application/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 2631 107 B
122 B 357ms
275ms Script
application/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 2631 492 B
263 B 307ms
307ms XHR
text/plain 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3030272667403393&correlator=3485335992410778&eid=31071094%2C44761477&output=ldjh&gdfp_req=1&vrg=2022120501&ptt=17&impl=fifs&iu_parts=18087395%2Ccookie&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&adks=64515409&sfv=1-0-40&sc=1&cdm=cdn.aralego.net&abxe=1&dt=1671942769355&lmt=1644386353&dlt=1671942766958&idt=2374&adxs=-12245933&adys=-12245933&biw=-12245933&bih=-12245933&scr_x=-12245933&scr_y=-12245933&ucis=uxo4vxzf8nfa&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Fcdn.aralego.net%2Fucfad%2Fcookie%2FcookieSyncIframe.html&ref=https%3A%2F%2Fwww.bg3.co%2F&top=https%3A%2F%2Fwww.bg3.co%2F&frm=24&vis=1&psz=0x0&msz=0x-1&fws=256&ohw=0&ea=0&ga_vid=150046489.1671942769&ga_sid=1671942769&ga_hid=1483768011&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e82c29b08312ce212ac5700b4f4785aa6918c0d789c27ecffdda9689f753d332

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cdn.aralego.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
16f258c24164251de9a65e23aa19a0da.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 569B 6 KB
3 KB 825ms
274ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://16f258c24164251de9a65e23aa19a0da.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:50 GMT
expires: Mon, 25 Dec 2023 04:32:50 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame 8BFD 3 KB
2 KB 822ms
272ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1671942768&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1671942767038&bpp=12&bdt=1317&idt=1835&shv=r20221207&mjsv=m202212010101&ptt=5&saldr=sa&correlator=2684637076624&frm=23&ife=1&pv=2&ga_vid=794614638.1671942769&ga_sid=1671942769&ga_hid=445563408&ga_fc=0&ga_cid=amp-Si5SS-eYORi5E3KZ-XPXKw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=60&biw=1600&bih=1200&isw=336&ish=280&ifk=204013863&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44774648%2C44774652%2C44780792&oid=2&pvsid=2150646398706856&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.fogr5mayhrgb&fsb=1&dtd=1852

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 07:15:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76659
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Jan 2023 07:15:11 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame 8BFD 18 KB
7 KB 823ms
273ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 02:21:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7909
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Jan 2023 02:21:01 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 8BFD 0
0 867ms
321ms Image
text/html 172.217.194.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRpr5yWzjnpTXLpuzLeqjhB2IrStKTlIkWB0vn26wVq8F5JiTscDDVJkoDIVH3lTE6nJaBIJnLPE3g8lMMpw-d1znj5fg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1671942768&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1671942767038&bpp=12&bdt=1317&idt=1835&shv=r20221207&mjsv=m202212010101&ptt=5&saldr=sa&correlator=2684637076624&frm=23&ife=1&pv=2&ga_vid=794614638.1671942769&ga_sid=1671942769&ga_hid=445563408&ga_fc=0&ga_cid=amp-Si5SS-eYORi5E3KZ-XPXKw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=60&biw=1600&bih=1200&isw=336&ish=280&ifk=204013863&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44774648%2C44774652%2C44780792&oid=2&pvsid=2150646398706856&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.fogr5mayhrgb&fsb=1&dtd=1852
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.194.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f106.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8BFD 153 KB
47 KB 280ms
274ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 25 Dec 2022 04:32:49 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 8BFD 0
0 286ms
283ms Fetch
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C2IJMcdKnY_e0AaOk4t4Pvrya8ASY_NGxXKqEzOSFAcCNtwEQASAAYKvssYXgGIIBF2NhLXB1Yi00NDg1MjM5NDI1OTI0Nzg3yAEJqQLNj3uIMY2mPqgDAaoEuQJP0Cuv-IL6I1Q33vZ7WMdkokGMLhiCi4NsVocWZ7BzgnlskD4taAwmDA1EUxpZC1-UJUqHgFy8s31bNBK3fny4_jVUgSBpQBvXLV0Fl1nDNxr4h1y0eVeHrJY5uEj1QRX2hk0OnEHR36f5qVV-kL_-j-BQG9iVxvjOJAuc_WZTJnRiIQ5TUUm3Bomz3Wvh-wDFRcyybJY29DoGyOCdkIQFHK0lZbs6JOGg5rBYc-vEChuUNVm_7CNlXHYfbaRB18-ITMdgUbQkuAUENeF3p8BxSf6QsBvSYVokveWwbXAsdwYmU1mGl-Wp-_iZiytP5KYYSO8zgd70yytx0N6RP78qfAAccj9o9Pq2g_E5m7XVNn7Ar1pdNBHm2-h56KQtMK0zRMzjMlfe0i98l0s4SXR3xPgni0xKOYwQgAbUk42X87_1mH2gBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQIAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi00NDg1MjM5NDI1OTI0Nzg3GOLMGQ&sigh=xHpxeOSJSI8&uach_m=[UACH]&cid=CAQSKQDq26N9wdplZSmN4fFGwWHlPOVlBnN0qSAv7KEMwYnvFZcY7Osjbf9yGAEgEw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1671942768&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1671942767038&bpp=12&bdt=1317&idt=1835&shv=r20221207&mjsv=m202212010101&ptt=5&saldr=sa&correlator=2684637076624&frm=23&ife=1&pv=2&ga_vid=794614638.1671942769&ga_sid=1671942769&ga_hid=445563408&ga_fc=0&ga_cid=amp-Si5SS-eYORi5E3KZ-XPXKw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=60&biw=1600&bih=1200&isw=336&ish=280&ifk=204013863&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44774648%2C44774652%2C44780792&oid=2&pvsid=2150646398706856&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.fogr5mayhrgb&fsb=1&dtd=1852
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 25 Dec 2022 04:32:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.jp2.as.criteo.com/google/auction/ Frame 8BFD 0
0 957ms
317ms Fetch 182.161.74.19
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.jp2.as.criteo.com/google/auction/notify?profile=14&payload=k-qNEp_IC9ACmAJi-C0SAgAAACE5AQwCW-6I5uT8IWU3JEEQcNKnY3WUq_NgYHJpKI_gABIAAA&wp=Y6fScQAAWncF2JIjAAaePgoHo--3zkpLvZcfhQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 184228
content-length: 0

GET
H2 200 afr.php Show response
ads.as.criteo.com/delivery/r/ Frame A615 176 KB
55 KB 942ms
469ms Document
text/html 182.161.73.148
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.as.criteo.com/delivery/r/afr.php?z=Y6fScQAAWncF2JIjAAaePgoHo--3zkpLvZcfhQ&u=%7CqlwYN1eqbB3%2Fdf9XanbbVL1RFnSKW%2F1WPexUma9rkjI%3D%7C&c1=2P_wVlUbBFsw5yK-nUdqc6nygJ274zNPhQpJEnippfnLPctJAgOVJK5QBvON9Ye9GS_f4NkHgJjP411SnRRB4NYNBIFxzdOHml7PNonrT-zmF72qHrkOOzHD_abEaZbA2VLl84eGElffx-kTEOCrKkqNkoubxSQ7ECpOoMVr-_U3n5m8AuKthJ9tzA_Pi_azPt3_PkcN38tGB0whwgyr5tfqM85lWyGMAqvqqm_o0CLE6nULdcK90Cfs_KlrkHYta7odE15zhppr0T7G0099QpcGQTzO6_HaJKOwGGYa8KtaVhG9Au773xbwBS_vldOWJAwdDbgZgG_vqwbrMg4EBIlGvxTlfCkNxkwL29Oi6kZihE5aGCJW7knpI3e9BrCmIPKH6244t3m-oXwAbj_F7EOHb28kCVog-FYGGCXFi4ROwJHPlsYvCoRNcU98pkWYe3nMHs5ljfA1wpoa991zVrNKJ_QOJxn21x7dMJcxxJirqLiZLFVdjJWLY9vSeRS6XrRZwyuOPGV-Kzcdo1jzfb6-W7fLQBXLHFLhz2LfdUBx-Mgtbj917Gu8QuFs4shyvY2zAXXQFt5FLQ6NYqfQTLIQ-nXEJ48OGwP8qQG9066JeZ-313tiobGW-bCmfauI&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuyIocdKnY_e0AaOk4t4Pvrya8ASY_NGxXKqEzOSFAcCNtwEQASAAYKvssYXgGIIBF2NhLXB1Yi00NDg1MjM5NDI1OTI0Nzg3yAEJqQLNj3uIMY2mPqgDAaoEvAJP0Cuv-IL6I1Q33vZ7WMdkokGMLhiCi4NsVocWZ7BzgnlskD4taAwmDA1EUxpZC1-UJUqHgFy8s31bNBK3fny4_jVUgSBpQBvXLV0Fl1nDNxr4h1y0eVeHrJY5uEj1QRX2hk0OnEHR36f5qVV-kL_-j-BQG9iVxvjOJAuc_WZTJnRiIQ5TUUm3Bomz3Wvh-wDFRcyybJY29DoGyOCdkIQFHK0lZbs6JOGg5rBYc-vEChuUNVm_7CNlXHYfbaRB18-ITMdgUbQkuAUENeF3p8BxSf6QsBvSYVokveWwbXAsdwYmU1mGl-Wp-_iZiytP5KYYSO8zgd70yytx0N6RP78qfAAccj9o9Pq2g_E5m7XVNn7ArxhfFYMDFWEHFy1crkZl3g_KJl1J2AFkf8PLH-6-euYLk6uhqPLvlv4HgAbUk42X87_1mH2gBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0RQVsRKGE-25iCERUcpQPDAP4RbA%26client%3Dca-pub-4485239425924787%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.148 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

b64ef5c956f792e027d36e6c11bb0baa155d8bb517842d1977fdedf211576aad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:49 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.as.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.as.criteo.net/heavyad?cppv=3&cpp=jUuovJxa2bYLZiRu3DiDIdC6Ls6XzWsfDnnLFJvUZdKD5F3_r5vXEeTFuSV1pgZ0XaJoQfvs_vD1IJWBX7DHm3Jo0QuKBR8nJREiQ-5FkPYQF43NgC7Zl8_989f1Jl6vBQQ2oEbM2K9kIWNiBcjcXWOBB5Bbs1QKsFnceR-udB1LlIn__0X18bLu8jbdfKg7TV1xN0Yqxwgro-jn2rEQPAooDoJNvK6XbYIbwGpig3qjX6A4pdvS-WKOxy3T88mL-CEBjCxTgieX2cCK"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 52642477
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 31B3 1 KB
643 B 274ms
273ms Document
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 13232
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 00:52:17 GMT
etag: 48472445140208031
expires: Mon, 26 Dec 2022 00:52:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 block.jpg
delivery.adrecover.com/ 631 B
866 B 346ms
345ms Image
image/jpeg 42.99.140.201
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://delivery.adrecover.com/block.jpg?ts=1671942769559
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.201 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-201.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 9284d948e86d2e99f31483b5f4b3a4c3e65e0a6fbca9a8d2db8c6095f82ac3f5

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Sun, 25 Dec 2022 04:32:49 GMT
last-modified: Wed, 23 Jun 2021 06:37:54 GMT
server: nginx/1.18.0
etag: "60d2d6c2-277"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
accept-ranges: bytes
content-length: 631
expires: Sun, 25 Dec 2022 05:32:49 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 31B3
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEP5XT7PDwMSCxW8zmRwdKwk&google_cver=1&google_push=AavPq0PszMWK3N3cB_ykVA96yBZmF7qweOdD751Za2XvMcKJp34s4Y-G-dOiz9zC_iQg5IpH3lYjNQCD-DWctMvNNe-iR-mGWJfJ
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mzg3OTYwNzc2NDYxMDMzNDEzOA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEI-T7kXQIixPSms10lpP4ms&google_cver=1

43 B
398 B

1202ms
264ms

Image
image/gif

50.116.239.135
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEI-T7kXQIixPSms10lpP4ms&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1671942768&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1671942767038&bpp=12&bdt=1317&idt=1835&shv=r20221207&mjsv=m202212010101&ptt=5&saldr=sa&correlator=2684637076624&frm=23&ife=1&pv=2&ga_vid=794614638.1671942769&ga_sid=1671942769&ga_hid=445563408&ga_fc=0&ga_cid=amp-Si5SS-eYORi5E3KZ-XPXKw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=60&biw=1600&bih=1200&isw=336&ish=280&ifk=204013863&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44774648%2C44774652%2C44780792&oid=2&pvsid=2150646398706856&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.fogr5mayhrgb&fsb=1&dtd=1852
Protocol: H2
Server: 50.116.239.135 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 25 Dec 2022 04:32:51 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEI-T7kXQIixPSms10lpP4ms&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 31B3 35 B
464 B 753ms
238ms Image
image/gif 103.229.10.171
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESECGIcxwvGGaF_-xZh1rxWAs&google_cver=1&google_push=AavPq0OdC2_P9A6E9OqWymQS8MwlHHIaX--zcCGCn-bSGI17DZf1Py7W2zxtB0Gw4hNIA31t6JIClsR9qndpoDqp8hRUKSLHAPSj

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.229.10.171 , Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:50 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 31B3 0
173 B 525ms
236ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEJpL4Tcz1miG5kWL1Czem9Y&google_cver=1&google_push=AavPq0MyzMNd6oE8aOa7UABvwM8ugzLus3rOPhHZkQ8ivBtdn86ecKhqirSkgmjAou83mfblAgE43C7aCalBzPaG-35fli7VXos
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1671942768&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1671942767038&bpp=12&bdt=1317&idt=1835&shv=r20221207&mjsv=m202212010101&ptt=5&saldr=sa&correlator=2684637076624&frm=23&ife=1&pv=2&ga_vid=794614638.1671942769&ga_sid=1671942769&ga_hid=445563408&ga_fc=0&ga_cid=amp-Si5SS-eYORi5E3KZ-XPXKw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=60&biw=1600&bih=1200&isw=336&ish=280&ifk=204013863&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44774648%2C44774652%2C44780792&oid=2&pvsid=2150646398706856&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.fogr5mayhrgb&fsb=1&dtd=1852
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 31B3
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEGSBkxUxlkWiJBWU2L1u0Xs&google_cver=1&google_push=AavPq0MG4LALVaPO59GWqA-0PZ3NqACv7Tou1sepdm_XCmr-p_RovAdb0oAo1CRRRi9Jj_coY5zVFDX_y_ZmTe1H...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=0ee37f4f&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AavPq0MG4LALVaPO59GWqA-0PZ3NqACv7Tou1sepdm_XCmr-...

170 B
188 B

278ms
277ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=0ee37f4f&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AavPq0MG4LALVaPO59GWqA-0PZ3NqACv7Tou1sepdm_XCmr-p_RovAdb0oAo1CRRRi9Jj_coY5zVFDX_y_ZmTe1HOsA__s_-eUat

Requested by

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 25 Dec 2022 04:32:50 GMT
via: 1.1 d349739893df3b59b8ea4953ff21a5e8.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: SIN2-P2
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=0ee37f4f&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=AavPq0MG4LALVaPO59GWqA-0PZ3NqACv7Tou1sepdm_XCmr-p_RovAdb0oAo1CRRRi9Jj_coY5zVFDX_y_ZmTe1HOsA__s_-eUat
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: 4kG_s-ANUVUU05KnGbQOC_Tb2ooGKuucks-_Gy1dbMhNHw0c-zbQmg==

GET pub
cs.chocolateplatform.com/ Frame 31B3 0
0

GET
H/1.1 200
OK ebda_cs
y.one.impact-ad.jp/ul_cb/ Frame 31B3 11 B
218 B 1075ms
353ms Image
text/html 35.213.109.249
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://y.one.impact-ad.jp/ul_cb/ebda_cs?google_gid=CAESEOd7gTP1aq9KzdAXOz1Eo00&google_cver=1&google_push=AavPq0PQgvradAD2ynJ43EfTWXa-ro33vEWa7sHqHVo8DLNhErCe4Ra959oDpnVyqtVVxvqqxx6Prwh_4uLcw9SqjEQo1zQso9wI
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1671942768&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1671942767038&bpp=12&bdt=1317&idt=1835&shv=r20221207&mjsv=m202212010101&ptt=5&saldr=sa&correlator=2684637076624&frm=23&ife=1&pv=2&ga_vid=794614638.1671942769&ga_sid=1671942769&ga_hid=445563408&ga_fc=0&ga_cid=amp-Si5SS-eYORi5E3KZ-XPXKw&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=60&biw=1600&bih=1200&isw=336&ish=280&ifk=204013863&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44774648%2C44774652%2C44780792&oid=2&pvsid=2150646398706856&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.fogr5mayhrgb&fsb=1&dtd=1852
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.109.249 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 249.109.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:50 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 11
Content-Type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 31B3
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEEyAaJHcs4QfJ65KTpVPRPs&google_cver=1&google_push=AavPq0MwkdPCby1AHbEjbsSy4qVQtKs63yE2HJNZEjpVoQ9R4NCH2eLLvvmm4LbIbo027mLegm8JlJ6539WKUhnRu...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ODExMWFhZDItZTgyNy00ZDQ1LTk5NDgtZDRjYTVjYjU0ODY4&google_push=AavPq0MwkdPCby1AHbEjbsSy4qVQtKs63yE2HJNZEjpVoQ9R4NCH2eLLvvmm4LbI...

170 B
188 B

277ms
277ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ODExMWFhZDItZTgyNy00ZDQ1LTk5NDgtZDRjYTVjYjU0ODY4&google_push=AavPq0MwkdPCby1AHbEjbsSy4qVQtKs63yE2HJNZEjpVoQ9R4NCH2eLLvvmm4LbIbo027mLegm8JlJ6539WKUhnRumrgjRNMR0DkJQ

Requested by

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ODExMWFhZDItZTgyNy00ZDQ1LTk5NDgtZDRjYTVjYjU0ODY4&google_push=AavPq0MwkdPCby1AHbEjbsSy4qVQtKs63yE2HJNZEjpVoQ9R4NCH2eLLvvmm4LbIbo027mLegm8JlJ6539WKUhnRumrgjRNMR0DkJQ
date: Sun, 25 Dec 2022 04:32:50 GMT
content-length: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 31B3 0
69 B 275ms
274ms Image
text/html 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IXDu7w5s8DfHlKsOkngQK6HuIixIOvX2it6U2ycva56qepE-nuyyaMnDRHbn1JwI-OzWrrYQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 pb.42753.1663912421366.js Show response
cdn.adpushup.com/prebid/ 342 KB
92 KB 1388ms
380ms Script
application/javascript 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 1c479d0abecadc8d5fde30eeb515508b6148fa3d92dd617b427788d6c792b0a8

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Sun, 25 Dec 2022 04:32:51 GMT
content-encoding: br
last-modified: Fri, 23 Sep 2022 05:54:31 GMT
server: nginx/1.18.0
etag: W/"632d4a17-5578b"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=2
content-length: 94168
expires: Mon, 25 Dec 2023 04:32:51 GMT

GET
H2 200 quantcast.js Show response
cdn.adpushup.com/pbuseridscripts/ 450 B
505 B 1395ms
416ms Script
application/javascript 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 26914004d3a8d5ddde2202b642d7936eb61c9f195b5cd3c87e44ef8ad4d57c16

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Sun, 25 Dec 2022 04:32:51 GMT
content-encoding: br
last-modified: Mon, 28 Jun 2021 04:15:23 GMT
server: nginx/1.18.0
etag: W/"60d94cdb-1c2"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 211
expires: Mon, 25 Dec 2023 04:32:51 GMT

GET
H2 200 linkPreview.js Show response
cdn.adpushup.com/42753/ 75 KB
18 KB 1332ms
354ms Script
application/javascript 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/linkPreview.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 6b278e48df6b2e2f917803f532a9257fbb46bf576a8dfc07f1f8eb94468b54e8

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Sun, 25 Dec 2022 04:32:51 GMT
content-encoding: br
last-modified: Tue, 13 Dec 2022 07:20:55 GMT
server: nginx/1.18.0
etag: W/"639827d7-12dc3"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=4
content-length: 18371
expires: Sun, 25 Dec 2022 05:32:51 GMT

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
27 KB 275ms
275ms Script
text/javascript 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0efe5a2440bc8207ce66ffdef2f4f59e6cdbcf0b02da8ebd623df6e8344167d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27542
x-xss-protection: 0
server: sffe
etag: "1431 / 149 of 1000 / last-modified: 1670587517"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 25 Dec 2022 04:32:49 GMT

GET
H2 200 sync
e3.adpushup.com/AdPushupFeedbackWebService/user/ 70 B
538 B 715ms
233ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/user/sync
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 , Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:50 GMT
server: nginx/1.10.3 (Ubuntu)
ap-cookie-status: cookies ap_uid and ap_usid are set
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
317 B 572ms
235ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2NzE5NDI3Njk4OTgsInBhY2tldElkIjoiMDAwMEE3MDEtMjdhZDY1ZWQtZTE2Ny00NmRmLWFlYjctY2E1NWY3NzQ4MDI5Iiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL3lpbmctdGktamlhbi16aS13dS1zdS16YW8td2FuLW1laS1zaGVuLWNhaS1zaGFvLW51LXNoaS1kYWktZGEteGl1LXhpdS1jaGFuZy1tZWktdHVpLmh0bWwiLCJtb2RlIjo0LCJlcnJvckNvZGUiOjAsInJlZmVycmVyIjoiIiwicGFnZUdyb3VwIjoiQVJUSUNMRSIsInBhZ2VWYXJpYXRpb25JZCI6Ijk2NzUwMTI1LWI5MGMtNDk3YS04Njk5LTczMTcxZjdiNDkzNSIsInBhZ2VWYXJpYXRpb25OYW1lIjoiQWRQdXNodXAiLCJwYWdlVmFyaWF0aW9uVHlwZSI6MSwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6bnVsbH0%3D&c_b=6978.5
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 , Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:50 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
317 B 234ms
234ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2NzE5NDI3Njk4OTksInBhY2tldElkIjoiMDAwMEE3MDEtMjdhZDY1ZWQtZTE2Ny00NmRmLWFlYjctY2E1NWY3NzQ4MDI5Iiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL3lpbmctdGktamlhbi16aS13dS1zdS16YW8td2FuLW1laS1zaGVuLWNhaS1zaGFvLW51LXNoaS1kYWktZGEteGl1LXhpdS1jaGFuZy1tZWktdHVpLmh0bWwiLCJtb2RlIjo1LCJlcnJvckNvZGUiOjEsInJlZmVycmVyIjoiIiwicGFnZUdyb3VwIjoiQVJUSUNMRSIsInBhZ2VWYXJpYXRpb25JZCI6Ijk2NzUwMTI1LWI5MGMtNDk3YS04Njk5LTczMTcxZjdiNDkzNSIsInBhZ2VWYXJpYXRpb25OYW1lIjoiQWRQdXNodXAiLCJwYWdlVmFyaWF0aW9uVHlwZSI6MSwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6bnVsbH0%3D&c_b=6979.099999427795
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 , Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:50 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 234ms
233ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NzE5NDI3Njk4OTksInBhY2tldElkIjoiMDAwMEE3MDEtMjdhZDY1ZWQtZTE2Ny00NmRmLWFlYjctY2E1NWY3NzQ4MDI5Iiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL3lpbmctdGktamlhbi16aS13dS1zdS16YW8td2FuLW1laS1zaGVuLWNhaS1zaGFvLW51LXNoaS1kYWktZGEteGl1LXhpdS1jaGFuZy1tZWktdHVpLmh0bWwiLCJtb2RlIjoxLCJlcnJvckNvZGUiOjEsInJlZmVycmVyIjoiIiwicGFnZUdyb3VwIjoiQVJUSUNMRSIsInBhZ2VWYXJpYXRpb25JZCI6Ijk2NzUwMTI1LWI5MGMtNDk3YS04Njk5LTczMTcxZjdiNDkzNSIsInBhZ2VWYXJpYXRpb25OYW1lIjoiQWRQdXNodXAiLCJwYWdlVmFyaWF0aW9uVHlwZSI6MSwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6W3sic2VjdGlvbklkIjoiNzdhOWMyMmYtYWMwMi00NWRkLTk2YmMtYjA4OTZhOGE3ZDVhIiwic2VjdGlvbk5hbWUiOiJBUF9MX0RfQVJUSUNMRV83MjhYMjUwXzc3YTljIiwic3RhdHVzIjoxLCJuZXR3b3JrIjoiYWRwVGFncyIsIm5ldHdvcmtBZFVuaXRJZCI6IkFEUF80Mjc1M183MjhYMjUwXzc3YTljMjJmLWFjMDItNDVkZC05NmJjLWIwODk2YThhN2Q1YSIsInNlcnZpY2VzIjpbMSwzXSwiYWRVbml0VHlwZSI6MX1dfQ%3D%3D&c_b=6979.39999961853
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 , Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:50 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 adpushup-label.svg
campaign.adpushup.com/ads/ 8 KB
9 KB 601ms
144ms Image
image/svg+xml 152.199.39.108
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://campaign.adpushup.com/ads/adpushup-label.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.39.108 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nwa/E7CA) /
Resource Hash: eb3577f46647f2e2db7307936038a47cc31c0ce75239496f6b7117282a47864c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
last-modified: Thu, 12 Nov 2020 09:18:18 GMT
server: ECAcc (nwa/E7CA)
age: 7913
etag: "5facfdda-21e0"
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=14400
accept-ranges: bytes
content-length: 8672
expires: Sun, 25 Dec 2022 08:32:51 GMT

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 234ms
233ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NzE5NDI3Njk5MDQsInBhY2tldElkIjoiMDAwMEE3MDEtMjdhZDY1ZWQtZTE2Ny00NmRmLWFlYjctY2E1NWY3NzQ4MDI5Iiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL3lpbmctdGktamlhbi16aS13dS1zdS16YW8td2FuLW1laS1zaGVuLWNhaS1zaGFvLW51LXNoaS1kYWktZGEteGl1LXhpdS1jaGFuZy1tZWktdHVpLmh0bWwiLCJtb2RlIjoxLCJlcnJvckNvZGUiOjEsInJlZmVycmVyIjoiIiwicGFnZUdyb3VwIjoiQVJUSUNMRSIsInBhZ2VWYXJpYXRpb25JZCI6Ijk2NzUwMTI1LWI5MGMtNDk3YS04Njk5LTczMTcxZjdiNDkzNSIsInBhZ2VWYXJpYXRpb25OYW1lIjoiQWRQdXNodXAiLCJwYWdlVmFyaWF0aW9uVHlwZSI6MSwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6W3sic2VjdGlvbklkIjoiZDFjMTBhNzItMjdiNC00OTMxLThjZTctOTlhMThlYmJkYmFlIiwic2VjdGlvbk5hbWUiOiJBUF9JX0RfQVJUSUNMRV83MjhYOTBfZDFjMTAiLCJzdGF0dXMiOjEsIm5ldHdvcmsiOiJhZHBUYWdzIiwibmV0d29ya0FkVW5pdElkIjoiU1RJQ0tZX0FEUF80Mjc1M183MjhYOTBfZDFjMTBhNzItMjdiNC00OTMxLThjZTctOTlhMThlYmJkYmFlIiwic2VydmljZXMiOls1LDNdLCJhZFVuaXRUeXBlIjozfV19&c_b=6984.099999427795
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 , Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:51 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 234ms
234ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NzE5NDI3Njk5MDYsInBhY2tldElkIjoiMDAwMEE3MDEtMjdhZDY1ZWQtZTE2Ny00NmRmLWFlYjctY2E1NWY3NzQ4MDI5Iiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL3lpbmctdGktamlhbi16aS13dS1zdS16YW8td2FuLW1laS1zaGVuLWNhaS1zaGFvLW51LXNoaS1kYWktZGEteGl1LXhpdS1jaGFuZy1tZWktdHVpLmh0bWwiLCJtb2RlIjoxLCJlcnJvckNvZGUiOjEsInJlZmVycmVyIjoiIiwicGFnZUdyb3VwIjoiQVJUSUNMRSIsInBhZ2VWYXJpYXRpb25JZCI6Ijk2NzUwMTI1LWI5MGMtNDk3YS04Njk5LTczMTcxZjdiNDkzNSIsInBhZ2VWYXJpYXRpb25OYW1lIjoiQWRQdXNodXAiLCJwYWdlVmFyaWF0aW9uVHlwZSI6MSwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6W3sic2VjdGlvbklkIjoiMTA0YjI4MmEtYmQxMS00ZDhkLWFkNjQtMDQ5MjA2M2I2Y2JhIiwic2VjdGlvbk5hbWUiOiJBUF9JX0RfQVJUSUNMRV8xMjBYNjAwXzEwNGIyIiwic3RhdHVzIjoxLCJuZXR3b3JrIjoiYWRwVGFncyIsIm5ldHdvcmtBZFVuaXRJZCI6IlNUSUNLWV9BRFBfNDI3NTNfMTIwWDYwMF8xMDRiMjgyYS1iZDExLTRkOGQtYWQ2NC0wNDkyMDYzYjZjYmEiLCJzZXJ2aWNlcyI6WzUsM10sImFkVW5pdFR5cGUiOjN9XX0%3D&c_b=6986.5
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 , Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:51 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H3 200 integrator.json Show response
adservice.google.com/adsid/ 86 B
107 B 281ms
281ms Fetch
application/json 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.json?domain=www.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

14cfb5058acaf3af2f07088f1582f29941d7a4cc74fd1cea5050cecad862d154

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83
x-xss-protection: 0

GET
H2 200 nameframe.html
d-3418162887980756407.ampproject.net/2211302304002/ 0
0 830ms
274ms Other
text/html 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d-3418162887980756407.ampproject.net/2211302304002/nameframe.html
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.24.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f94.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 4E41 16 KB
12 KB 282ms
282ms XHR
application/json 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022120501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js?cb=31071221

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d918846e12a08cfd9aeff925ff331b6745739890d871016df401e0aaf299191

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12499
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 2631 16 KB
12 KB 280ms
280ms XHR
application/json 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022120501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0a7288314db805180bfe38bc4e1e13994d06320fa38356f63c2f4dc30e8a002

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12543
x-xss-protection: 0

GET
H3 200 pubads_impl_2022120501.js Show response
securepubads.g.doubleclick.net/gpt/ 380 KB
129 KB 274ms
273ms Script
text/javascript 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e288c4dc57f72a69a497baef524f41c57e1c6a414b09a5bde22cd5b2f1b7cdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Dec 2022 18:04:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210474
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131905
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 09:36:10 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 22 Dec 2023 18:04:57 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 134 B
105 B 820ms
275ms XHR
application/json 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

482100f0328f0fade00ad3e301b6aa9579cfa9a88eedaf0feafe56f43e119473

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80
x-xss-protection: 0
expires: Sun, 25 Dec 2022 04:32:50 GMT

GET
DATA 200
OK truncated
/ Frame 8BFD 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3f54b0f972d89d16c18164a0ff4d5849d8cb8ccd81a6e382a8a6bc8148255a96

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 931A 99 KB
33 KB 285ms
285ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: adx.holmesmind.com
URL: https://adx.holmesmind.com/adx-file/20221117/NqeGLmvuPvGdeaxEq2qKJUjcmyulAyFU8K2rHVjS.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

233cf5af8cc7054d99cf58755a2af0200e68bb6cabd75a240fc454bd635208c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://adx.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34202
x-xss-protection: 0
server: cafe
etag: 2222521737245155322
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 25 Dec 2022 04:32:50 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 4E41 17 KB
7 KB 574ms
273ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js?cb=31071221

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 25 Dec 2022 04:32:50 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4120 28 KB
13 KB 624ms
624ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3216231935713038&format=400x250&w=400&h=250&ptt=12&adk=90073500&output=html&bc=7&to=ampa&pv=1&wgl=1&asnt=0-39904443701284981326&dff=sans-serif&prev_fmts=1600x96&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&ifi=2&pfx=0&pwprc=1037897477&adf=16789255&nhd=0&adx=1000&ady=3290&oid=2&is_amp=5&amp_v=2211302304002&d_imp=1&c=553004350&ga_hid=393509541&dt=1671942770306&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&bdt=5921&dtd=3&__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012211302304002/v0/amp-ad-0.1.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6405cbaa0c8aa5fba846ed89bb3465279c1e41b62cdf97ea736c61f8262e6f25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 12910
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame A615 2 KB
1 KB 711ms
236ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.as.criteo.com
URL: https://ads.as.criteo.com/delivery/r/afr.php?z=Y6fScQAAWncF2JIjAAaePgoHo--3zkpLvZcfhQ&u=%7CqlwYN1eqbB3%2Fdf9XanbbVL1RFnSKW%2F1WPexUma9rkjI%3D%7C&c1=2P_wVlUbBFsw5yK-nUdqc6nygJ274zNPhQpJEnippfnLPctJAgOVJK5QBvON9Ye9GS_f4NkHgJjP411SnRRB4NYNBIFxzdOHml7PNonrT-zmF72qHrkOOzHD_abEaZbA2VLl84eGElffx-kTEOCrKkqNkoubxSQ7ECpOoMVr-_U3n5m8AuKthJ9tzA_Pi_azPt3_PkcN38tGB0whwgyr5tfqM85lWyGMAqvqqm_o0CLE6nULdcK90Cfs_KlrkHYta7odE15zhppr0T7G0099QpcGQTzO6_HaJKOwGGYa8KtaVhG9Au773xbwBS_vldOWJAwdDbgZgG_vqwbrMg4EBIlGvxTlfCkNxkwL29Oi6kZihE5aGCJW7knpI3e9BrCmIPKH6244t3m-oXwAbj_F7EOHb28kCVog-FYGGCXFi4ROwJHPlsYvCoRNcU98pkWYe3nMHs5ljfA1wpoa991zVrNKJ_QOJxn21x7dMJcxxJirqLiZLFVdjJWLY9vSeRS6XrRZwyuOPGV-Kzcdo1jzfb6-W7fLQBXLHFLhz2LfdUBx-Mgtbj917Gu8QuFs4shyvY2zAXXQFt5FLQ6NYqfQTLIQ-nXEJ48OGwP8qQG9066JeZ-313tiobGW-bCmfauI&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuyIocdKnY_e0AaOk4t4Pvrya8ASY_NGxXKqEzOSFAcCNtwEQASAAYKvssYXgGIIBF2NhLXB1Yi00NDg1MjM5NDI1OTI0Nzg3yAEJqQLNj3uIMY2mPqgDAaoEvAJP0Cuv-IL6I1Q33vZ7WMdkokGMLhiCi4NsVocWZ7BzgnlskD4taAwmDA1EUxpZC1-UJUqHgFy8s31bNBK3fny4_jVUgSBpQBvXLV0Fl1nDNxr4h1y0eVeHrJY5uEj1QRX2hk0OnEHR36f5qVV-kL_-j-BQG9iVxvjOJAuc_WZTJnRiIQ5TUUm3Bomz3Wvh-wDFRcyybJY29DoGyOCdkIQFHK0lZbs6JOGg5rBYc-vEChuUNVm_7CNlXHYfbaRB18-ITMdgUbQkuAUENeF3p8BxSf6QsBvSYVokveWwbXAsdwYmU1mGl-Wp-_iZiytP5KYYSO8zgd70yytx0N6RP78qfAAccj9o9Pq2g_E5m7XVNn7ArxhfFYMDFWEHFy1crkZl3g_KJl1J2AFkf8PLH-6-euYLk6uhqPLvlv4HgAbUk42X87_1mH2gBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0RQVsRKGE-25iCERUcpQPDAP4RbA%26client%3Dca-pub-4485239425924787%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 20 Dec 2023 04:32:50 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame A615 2 KB
1 KB 712ms
237ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 20 Dec 2023 04:32:50 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame A615 308 B
637 B 709ms
235ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Wed, 20 Dec 2023 04:32:50 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame A615 293 B
621 B 710ms
236ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Wed, 20 Dec 2023 04:32:50 GMT

GET
H2 200 lg.php
cat.sg1.as.criteo.com/delivery/ Frame A615 43 B
349 B 774ms
300ms Image
image/gif 182.161.73.132
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.sg1.as.criteo.com/delivery/lg.php?cppv=3&cpp=QgpUMf75XM3tyKw0QFopdBT6cT1GzsUfbKPE2OTPD3IM16HUh6ZCBUFqV5NFrrZCr6NpzQ469xUnrILNbY-WUwSwmQmPIRrUvQ3v1GjVt24Hel3kf2DypZejZw_Of0l9G7UpIbHmO-Rt4hiZ5TbIwww3wrsuuCIT0jfUnCuBWUv4x9EGwNlGhDR1w6MpHblD6TUcn2ijxsnZPtxUrzFsWsrvK1bcP-fr3IKHsH3fhOSpg6RG4eiOWHYdUdUw6ym0KstpYLSa-tHxFOie7rxgXt3ff2w-UKRfaoTljeONRDC3JGH4f1xQ024M7HoRt9EgWEnRSI7_59f6mdxkEdoAumZCNrCdAzbtR_t1vDmI-JCQwJlqNPjLb9IBdTGglodMBTRTbxzI4ZaoBTnWs0Ka2lPC5s3TDNHQYReb-KBpUG3W8pVW

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.132 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:50 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 26886224
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 795461768ece4a89b18a9f8c80409c30_euclidcirculara-regular.woff
static.criteo.net/design/dt/ Frame A615 51 KB
51 KB 993ms
522ms Font
application/octet-stream 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/795461768ece4a89b18a9f8c80409c30_euclidcirculara-regular.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a63352e1cd1d58eb182679f2a2ec9bc94bfe34c5ddb594cec95384bb145d9cad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
Origin: https://ads.as.criteo.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 17 Sep 2021 13:03:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6144923f-cbac"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 20 Dec 2023 04:32:50 GMT

GET
H2 200 1bfe579521a74e66a22e4022793700cb_novaresestd-medium.woff
static.criteo.net/design/dt/ Frame A615 20 KB
21 KB 939ms
469ms Font
application/octet-stream 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/1bfe579521a74e66a22e4022793700cb_novaresestd-medium.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

385eb75d03c130230da212fba0a0d230e0d09b8335067a3eb7e4d9167590a59b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
Origin: https://ads.as.criteo.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 17 Sep 2021 13:03:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6144923f-50d0"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 20 Dec 2023 04:32:50 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame A615 12 KB
5 KB 434ms
147ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 812650
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nn4vXCInS8C4guotz%2BxUYj8CfSUqqtNJw5wnj%2B0pbMnrlOK9BAsuFFltGWS8pcmTRo67kn%2BK3k3guzB7CMdcmteZEtnGdwmpnggokUcoORBuwjyICI8m1BkpQOEfB9%2FbR6Eh%2BK61"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 77eedaf1bf70aabe-SYD
expires: Fri, 15 Dec 2023 04:32:51 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 2631 17 KB
6 KB 576ms
275ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 25 Dec 2022 04:32:50 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame A615 12 KB
6 KB 236ms
236ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 20 Dec 2023 04:32:51 GMT

GET
H2 200 0de3566013914383836dcf943517c81f_cpn_336x280_1.jpg
static.criteo.net/design/dt/85833/221214/ Frame A615 61 KB
62 KB 335ms
335ms Image
image/jpeg 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/85833/221214/0de3566013914383836dcf943517c81f_cpn_336x280_1.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

5b0570558c1b63c5569392865cad79234d882182c6b8c7da8e4abfe09ac6c7b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 14 Dec 2022 10:42:46 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6399a8a6-f547"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 62791
expires: Wed, 20 Dec 2023 04:32:51 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame A615 23 KB
23 KB 714ms
235ms Image
image/png 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?h=152&m=0&partner=85833&q=80&r=0&u=http%3A%2F%2Fstatic.sg1.as.criteo.net%2Fdesign%2Fdt%2F55107%2F210723%2Fe9cd2ec2f5594aef93573b54d93251c1_brandlogo.png&v=3&w=668&s=Plfybc99RBiiwXw0FK6zcWVJ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

4b5faf9fe073ac81c10c229dccf3deca39d02f9869eac293777ca1942bc20f55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=29022622
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 23355
expires: Sun, 26 Nov 2023 02:23:14 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame A615 8 KB
9 KB 984ms
505ms Image
image/png 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?cq=256&h=400&m=0&partner=85833&q=80&r=0&u=https%3A%2F%2Fasset.swarovski.com%2Fimages%2F%24size_1208%2Ft_swa103%2Fb_rgb%3Affffff%252Cc_scale%252Cdpr_auto%252Cf_auto%252Cw_auto%2F5437517_png%2Fswarovski-symbolic-pendant--evil-eye-and-key--blue--rose-gold-tone-plated-swarovski-5437517.png&v=3&w=400&s=HeLre9-A3-qPQTYjjCUrWp_i&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

47615049f5f0592554f49d2fc2810b036dec70f4fd0d4f4492cc5f50e718e604

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=30016446
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8552
expires: Thu, 07 Dec 2023 14:26:58 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame A615 11 KB
12 KB 1281ms
853ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?cq=256&h=400&m=0&partner=85833&q=80&r=0&u=https%3A%2F%2Fasset.swarovski.com%2Fimages%2F%24size_1208%2Ft_swa103%2Fb_rgb%3Affffff%252Cc_scale%252Cdpr_auto%252Cf_auto%252Cw_auto%2F5642905_png%2Fstone-ring--blue--rhodium-plated-swarovski-5642905.png&v=3&w=400&s=dImA9lSPPqOlJe3BKAisU4v6&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

000c8108172259714eff619a9a946ec2abde78ee9bcd01dcef40ac93059ab229

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30129433
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11670
expires: Fri, 08 Dec 2023 21:50:05 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame A615 13 KB
14 KB 1020ms
791ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?cq=256&h=400&m=0&partner=85833&q=80&r=0&u=https%3A%2F%2Fasset.swarovski.com%2Fimages%2F%24size_1208%2Ft_swa103%2Fb_rgb%3Affffff%252Cc_scale%252Cdpr_auto%252Cf_auto%252Cw_auto%2F5647662_png%2Fconstella-ring--set-%25282%2529--princess-cut--white--rhodium-plated-swarovski-5647662.png&v=3&w=400&s=2QT0vObgX-0U3T3p5p8zMuiy&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

6265424574fa49316a4a3149ee66ce688248e02a0defead258f1ae421ed06f8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31278656
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 13754
expires: Fri, 22 Dec 2023 05:03:48 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame A615 4 KB
4 KB 843ms
701ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?cq=256&h=400&m=0&partner=85833&q=80&r=0&u=https%3A%2F%2Fasset.swarovski.com%2Fimages%2F%24size_1208%2Ft_swa103%2Fb_rgb%3Affffff%252Cc_scale%252Cdpr_auto%252Cf_auto%252Cw_auto%2F5172560_png%2Fswarovski-symbolic-pendant--evil-eye--blue--mixed-metal-finish-swarovski-5172560.png&v=3&w=400&s=0yDAJTNKIltPrhIejdpiIF8u&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

935659324222daaf3a2abb43dae8234e7916f2d87a31542b008f326b76011fcb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30086879
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3652
expires: Fri, 08 Dec 2023 10:00:51 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame A615 19 KB
19 KB 844ms
702ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?cq=256&h=400&m=0&partner=85833&q=80&r=0&u=https%3A%2F%2Fasset.swarovski.com%2Fimages%2F%24size_1208%2Ft_swa103%2Fb_rgb%3Affffff%252Cc_scale%252Cdpr_auto%252Cf_auto%252Cw_auto%2F5601887_png%2Fgema-clip-earrings--mixed-cuts--chandelier--multicoloured--rhodium-plated-swarovski-5601887.png&v=3&w=400&s=E-LJGi4bzvg5Ty7_60CktUO7&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

caa9be8bacf42f3600b4d668762ebdf8be3d6b3a2932865e24557ae1616a548c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31511091
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 19158
expires: Sun, 24 Dec 2023 21:37:43 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame A615 11 KB
11 KB 706ms
706ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?cq=256&h=400&m=0&partner=85833&q=80&r=0&u=https%3A%2F%2Fasset.swarovski.com%2Fimages%2F%24size_1208%2Ft_swa103%2Fb_rgb%3Affffff%252Cc_scale%252Cdpr_auto%252Cf_auto%252Cw_auto%2F5459597_png%2Fsunshine-stud-earrings--mixed-cuts--sun--white--rose-gold-tone-plated-swarovski-5459597.png&v=3&w=400&s=8aoZmJEaunBvFhHknPe_S8pK&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

f5cdb3fad7d9b3305b220ab96a0572bd9c2228a7a62bb8dea6c9b49e06a358f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30016244
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11044
expires: Thu, 07 Dec 2023 14:23:36 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame A615 11 KB
12 KB 670ms
670ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?cq=256&h=400&m=0&partner=85833&q=80&r=0&u=https%3A%2F%2Fasset.swarovski.com%2Fimages%2F%24size_1208%2Ft_swa103%2Fb_rgb%3Affffff%252Cc_scale%252Cdpr_auto%252Cf_auto%252Cw_auto%2F5672635_png%2Fgolden-goose-super-star-trainers--women%2527s--white-swarovski-5672635.png&v=3&w=400&s=rokSJJKvzQ_NsZaI-OezOyBi&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

b34bada35719d05dfd2186eca5611db1ee1ab052207a7d008fd0a0a47e40bffc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30966481
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11720
expires: Mon, 18 Dec 2023 14:20:53 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame A615 14 KB
15 KB 499ms
499ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?cq=256&h=400&m=0&partner=85833&q=80&r=0&u=https%3A%2F%2Fasset.swarovski.com%2Fimages%2F%24size_1208%2Ft_swa103%2Fb_rgb%3Affffff%252Cc_scale%252Cdpr_auto%252Cf_auto%252Cw_auto%2F5619495_png%2Fmillenia-drop-earrings--pear-cut--yellow--gold-tone-plated-swarovski-5619495.png&v=3&w=400&s=qNT7JSI5Bc0ui4Q3xj2UDgfG&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

43a33cc3a3639bf1b014e8a598c9b8ca946a6435c35bb34ff79a3bba0a301cc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29700522
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 14764
expires: Sun, 03 Dec 2023 22:41:34 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame A615 16 KB
16 KB 522ms
522ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?cq=256&h=400&m=0&partner=85833&q=80&r=0&u=https%3A%2F%2Fasset.swarovski.com%2Fimages%2F%24size_1208%2Ft_swa103%2Fb_rgb%3Affffff%252Cc_scale%252Cdpr_auto%252Cf_auto%252Cw_auto%2F5600855_png%2Fmesmera-cocktail-ring--octagon-cut--white--rhodium-plated-swarovski-5600855.png&v=3&w=400&s=OXd3OEMARDE52cxtpdoOk_Iv&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

61ac32d01f2c46a8f2d0578b800755ce24eac2b020e386ca07a3f400ee355060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30434168
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 16544
expires: Tue, 12 Dec 2023 10:29:01 GMT

POST
H2 200 all
csm.as.criteo.net/ Frame A615 0
128 B 709ms
235ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.as.criteo.net/all?cppv=3&cpp=jUuovJxa2bYLZiRu3DiDIdC6Ls6XzWsfDnnLFJvUZdKD5F3_r5vXEeTFuSV1pgZ0XaJoQfvs_vD1IJWBX7DHm3Jo0QuKBR8nJREiQ-5FkPYQF43NgC7Zl8_989f1Jl6vBQQ2oEbM2K9kIWNiBcjcXWOBB5Bbs1QKsFnceR-udB1LlIn__0X18bLu8jbdfKg7TV1xN0Yqxwgro-jn2rEQPAooDoJNvK6XbYIbwGpig3qjX6A4pdvS-WKOxy3T88mL-CEBjCxTgieX2cCK&sds=2&rev=83933&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sun, 25 Dec 2022 04:32:53 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame A615 2 KB
1 KB 325ms
324ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 20 Dec 2023 04:32:51 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame A615 2 KB
1 KB 235ms
234ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:52 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 20 Dec 2023 04:32:52 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212070101/ Frame 931A 355 KB
117 KB 302ms
302ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212070101/show_ads_impl_fy2021.js?bust=31071251

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

456fc4e275ed164d35761aaa2b5defbd40c65300e2ef733df2c6034fac7766bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://adx.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119787
x-xss-protection: 0
server: cafe
etag: 3097355562685812850
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 25 Dec 2022 04:32:50 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 8230 13 KB
5 KB 274ms
272ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 246518
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 Dec 2022 08:04:13 GMT
expires: Fri, 22 Dec 2023 08:04:13 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 5700 783 B
1001 B 578ms
276ms Document
text/html 172.217.194.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

3464ce90f1c6a3b9b0fcdfeab874644af1debbaf925e9dd6eca6ec6764d05a77

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-daEY1YSw3E-HziCWd-qe5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-daEY1YSw3E-HziCWd-qe5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:51 GMT
expires: Sun, 25 Dec 2022 04:32:51 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DD7F 624 B
242 B 277ms
277ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIY1oGCvQEwAQ&v=APEucNXUdgzCzlo4EYdTu1T_1lDx85_x-wauTFeE1XZesDgZhqZct2ovdfFx_c-DNTXuEQudbfU0JdxfMLSr9H_dhUXMyeBNyA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3216231935713038&format=400x250&w=400&h=250&ptt=12&adk=90073500&output=html&bc=7&to=ampa&pv=1&wgl=1&asnt=0-39904443701284981326&dff=sans-serif&prev_fmts=1600x96&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&ifi=2&pfx=0&pwprc=1037897477&adf=16789255&nhd=0&adx=1000&ady=3290&oid=2&is_amp=5&amp_v=2211302304002&d_imp=1&c=553004350&ga_hid=393509541&dt=1671942770306&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&bdt=5921&dtd=3&__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3216231935713038&format=400x250&w=400&h=250&ptt=12&adk=90073500&output=html&bc=7&to=ampa&pv=1&wgl=1&asnt=0-39904443701284981326&dff=sans-serif&prev_fmts=1600x96&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&ifi=2&pfx=0&pwprc=1037897477&adf=16789255&nhd=0&adx=1000&ady=3290&oid=2&is_amp=5&amp_v=2211302304002&d_imp=1&c=553004350&ga_hid=393509541&dt=1671942770306&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&bdt=5921&dtd=3&__amp_source_origin=https%3A%2F%2Fwww.bg3.co
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A384 15 KB
11 KB 300ms
300ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CkX07qLNbO4TvaS-ldDW21cPfQJIgAaQtr4QbaSfQqlGrdRRDzJsmWhkcdfzbkhPLSFZ5hhs5ISs9Oi-x68PGp_1zksAFfHpEGqavQAj77qvULpBqhY4IrVWLFLgIpeF-6Es3TaPI4shXFsmLcxesrGelv1im8hvZzrICTtXUkE9OjbDw&cry=1&dbm_d=AKAmf-BWoIkVu-E_wLw-ENns6zVNFEyNwRIrMl0cQfwuZp-avSG1PF6eEImhC-vaFcSCapKvI4TiRHU3-oXOUvC0bBXSkr1ykLcBiD-hxgYn18jNv0gCUpr5Qn1djvkO1ElPT-gtgqLHF0mUYbH3ufNnRhit8hz7FHDVXUWYs85tSfCmJLoK6JOXOsZiAREq8hG0efMv7eQ7cYO7stJx5CSDlitom1tsYTeVC6GGokSXhFLFYVC5Ij3l2iLIw4G0ULCmXiUmkgsFAPXOyoL0HMGfidLnhrus9M1-5t_WP8AckzP4BNB08nl76eDvShqunOfz-Klf1zV5GwAJXMo1Jqx0qg_o2jH8d2e6fCrZEH1DHZCgI0V5Vl5U4yCc_wklDPia_guQ4JubtqmSEWwFAvr4NFJ1VxIe9-lNZ8aik7rLfvf3ZS68n4Dfn_OvQ1iXhzLuGpEcgXO98jw23Jm8rgRMQtPopbpPIVlNFxnSIIihBTfE9YzKjO91vHkVTdJk_SH_shs1sTxjDQ0ZbAQXZBK9zBk6lFwkZnMFRyt9wjS2CuY5rJNWpfEVc2M2YrmDsbu5wvD0LcgWmXwYng1WqvRieCZXB4ZM_wjKrVfCO1Neop28FjnZ6lEecI_ShvsyB-Pu3ivgFpQ0ga-gjZ0--9TAapxSJbCNeP76PlA002lEjPbuI0DZSx4ogA9-mAp-niqVKYEotahezJw1MM4guQ1VomuAGOou8ijm9nZT-L-oWp_BJ7jUZ7EYEVNfzTe6ND2l84_sVFXkb4d_44rxqBzZQ6rI15QGwX1XmRNVRnlBW9i-KXx5xgUa_Tkih2SsUyRs9ACs-bUqugCO0mdztz8yvT0btbOyhdxbAweFoFh7_1Mga9CroN3i1x7aVwtxYglX_G-UWEyC0447kibaiH5-Kb0Jo70yS0REKK6978M5mT2BDCe907I9juEpfq6cvWMLWJjs8_e38y5wALd3JWyPSqoF57CEvzaRleQOxoPrnUfqBskpLu3mrNQWM2p_9xAToTkkZKAiQGpS4WL2RwfQdR30HJypWlpdiBvmwdNRynDdTKTWlJ6O1l-UxRISy2Re8JgZcWl7wpPMEn42OBkYHaFFbuFAspqL-1HZ0c7oBEWNprulBWhjLtuCGYCZV1njU9Hfk42YUK1DPcu6wQnhWcSZmd6gRRLVsUaoga_OuY4LXUeBOIhVU1H90gCbFI-jdzoqalhp08_uQUMQI421Uu_cZyDEfvqy2RIQooeTj3ypI3pDBG8YxqoEwsqkvTjz_p9QXYzAtGG53E4zUOg3mH8QbkVCvLAXUxDThNxHuuTxB0QRhp0Ehr6JTtjb54o-CRNGxGWjqJOYhgptVFPDkhi0a76znOyxQFoMt4cy6BE3_LiQCzPeDt0a3aqHTg3kxS2ndJDUcIqbTTjGPexbz026QvmvWsh3I_C7DopGfME5V_k3x26qKNhP3qubUrM9FRPcKV6UcZOE0u8GYpTzkXADuGeCuK2H2ed3X3KWj8JmlXghQTzLlYOW7u_iwsmkIzacu33rKJhJpaeQhc2d0sizz50XfSYECbapgsGPl6rDTwQNtxMGE3UbD83WmmaIqrk5_fe_MvzWj3xBKQ1ujPRRYqoKFuABr1nurBU1lLKdSji6crOKHr4KSbM1gcIPJV8a8JP0ePT6E3yopjBXymz0-Uw-yFs8P5FJeRz-pGDmuwv0Pfo4N59h-RsJ27Qv6pi3t25RiBLfM0lY7qJH7MVUABMu9k6-_DNwdvnVIJYGJ2wF7X9fV0_QgeD3499i9Tr87RZWwgvbCCijpI-OVQTR_O0HbT3ESPblkwC8cPCLYTImIAtrHhBs3aV81u4mdEPfOikIj5Uh7Jx33YGBJO4zCgv9AEBC77gKR8H7iDxK9zhMkBNrQA0t0E-09sW49_aq7ieoLUKl_Tje60xJasY0FpwjPM9FtQC559EIP-3Nfemus3qMIuWRQw_bb9i-wb49j1gSeR7w0rJkbZWXIoTqZsBh3K8CSeopBYM3j2X14afpGJKUfvJzU-SMJYI3ct6Jvw9p0npzj5ibD0P45RlrtBHatGljYf6tXX8W-NHImmYhRsGVmd7OSkOivIioumVLG_m0QhUY0YXPVlgN8G7JzQsPp-tmAZBNhdaat5G2quoSQrYglxCaUM10EH3hnEU7lt6wvBYRR8OEr5P2-1425B2Z1IDotFbrb9vrxrj4s2Bid11xn6cfSPbAKmXz81fHhVAwI-ZROz4FBBfVzPU9tXtRTs0IhMI2NPzNErI9mZXY9bBtmRdQhq_ByQW_DlpIx5l4X9gcUmxjkoilwsnQadVbJUL0ogWTKXei8NbGM-qacWm0LZdT_X7HZhLc6du-tv8pG8oqj2VEHlHiZSL6u9mpdB-PbVyQb5rko0j4Sb93xmODOrzRbbHxjvX_WGRIUDTQVf4ydeWZM50Y93wOV3AzoTvZy8FtUzsOVuLwJxhagbodcAyEHcTSetM9dj9P5dN02JJfZ9rvjLyYisKXaGrHVOM9rGxMNTESTqy0c4u3yifitdjxcNX8dp9iwOH9DV3SkOJ7EjifjpCqz_XQJ_5MtVPaYHCRGYMHtTmA3aM62LCyDjwKm4Oqm4oO1gWlVwitPX1bF78EKT3OhGTpE7IWDQuVWCrsh7bbiuObRALnreol1odrgn7Ql3PiyQ5qiOdxHFrrCgGxpMvhAp6PTV6DiQbFsNEo1pVQVSBSrK1LN5YYBewZeDlXRzVgNrdRwutb_q1OHciKN0Uu14sZ0sYWQVyhiV7pWkZ1D7acVz0mEpd1Tfeogb74D7_7FkAmysYzlL1extPVHiJ3FiADfFIJiImDf6K9SAsp24xzKJ2vf1ioCAK25dm-msP9TESO46CissTWOrXPiuShSLUz25DOUddJPXq3viNBQL75Kp-SWMS7N4VH1Z7lOXXtrdIwoTgHKk4h-amwHnhiDWKLF--MPg48YP-HGTt_Mo_olHPgDEZ-5VfW9amxLFoKFv60IuH1iK2eMOnI2-6AsOmRmo4j-2W4yHFN_ogsRnbaCwJeZAW7Nu9zKQzI0oyQqoMZdMMCq3Shd-U8gGo7uz9m369Z5AeW75MXY6lXFVDr-SaIad1rd9aWtYqGQOBezxi4JqhW1EZwXn5-892V6wxteFTDiEq9ahotLV4LelWJO4LoqIIBVFdDF9KccnHWzRmpKr1LlcitNzITJuEctkaV-3ZkUSxWLoPsxZjcokowgk074qS6x0EZ1A7soXKOTXUOQQaQTDGd86AivbdnqPJNIzyHQ7quuhdoVAP82rfdgF8EFCpo2vI-5bkUSGJHpUyZ1WkfvYScA7H3gXxfag6RxFZb6KSiABW-m3VCEDIrIQEvaZTqqfuIl90xU9m8ZWNjY91heYml7gMFv2BPPESZfmu73V2t0go2IPj4Ge--DAws8TdVG2YlXLrVc5KhOD8T7Ex32thbCKs8iXRFFn0J3cL9oqk8LtpIK-LKVRrKDa64gQmugDHaeX_5ZutsFPLKd-VpsvykXjzaJY04Tf2TSRdvu-VlnV8cw9JaQB1ktY4_hwU&cid=CAQSKQDq26N9ANb-in5pS_lU0lmb1SoRMqewkov_9JpF_4d5B2ALmk6vZCoQGAEgEw&rfl=2%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eab908f19f6bc4676df639dd19b2f2347667736ba0cc66a7f2401a0c8a046162

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3216231935713038&format=400x250&w=400&h=250&ptt=12&adk=90073500&output=html&bc=7&to=ampa&pv=1&wgl=1&asnt=0-39904443701284981326&dff=sans-serif&prev_fmts=1600x96&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&ifi=2&pfx=0&pwprc=1037897477&adf=16789255&nhd=0&adx=1000&ady=3290&oid=2&is_amp=5&amp_v=2211302304002&d_imp=1&c=553004350&ga_hid=393509541&dt=1671942770306&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&bdt=5921&dtd=3&__amp_source_origin=https%3A%2F%2Fwww.bg3.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11235
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame A384 2 KB
1 KB 847ms
250ms Script
application/javascript 23.50.117.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115843&plc=4214575&sid=18330&dvregion=0&unit=300x250&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0jZfz7Qym3R8-D4MdQ-HZJK&DVP_DBM_1=3060631&DVP_DBM_2=23009949&DVP_DBM_3=14586208515&DVP_DBM_4=396394710&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=881479034793&turl=https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&DVP_PP_BUNDLE_ID=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3216231935713038&format=400x250&w=400&h=250&ptt=12&adk=90073500&output=html&bc=7&to=ampa&pv=1&wgl=1&asnt=0-39904443701284981326&dff=sans-serif&prev_fmts=1600x96&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&ifi=2&pfx=0&pwprc=1037897477&adf=16789255&nhd=0&adx=1000&ady=3290&oid=2&is_amp=5&amp_v=2211302304002&d_imp=1&c=553004350&ga_hid=393509541&dt=1671942770306&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&bdt=5921&dtd=3&__amp_source_origin=https%3A%2F%2Fwww.bg3.co
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.117.184 Jakarta, Indonesia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-50-117-184.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: d8b1280df015b12fd4ea4138faad855238e57f1819a6d2b854d0fd9879532805

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:51 GMT
Content-Encoding: gzip
Last-Modified: Tue, 20 Dec 2022 11:37:28 GMT
Server: Microsoft-IIS/10.0
ETag: "f3ae98706714d91:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1170

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame A384 8 KB
4 KB 860ms
257ms Script
application/javascript 23.50.117.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&advid=3398311&adsrv=0&btreg=&btadsrv=&tagtype=&dvtagver=6.1.src&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVPX_PP_IMP_ID=ABAjH0jZfz7Qym3R8-D4MdQ-HZJK&DVP_DBM_1=3060631&DVP_DBM_2=23009949&DVP_DBM_3=14586208515&DVP_DBM_4=396394710&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=881479034793&turl=https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&DVP_PP_BUNDLE_ID=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3216231935713038&format=400x250&w=400&h=250&ptt=12&adk=90073500&output=html&bc=7&to=ampa&pv=1&wgl=1&asnt=0-39904443701284981326&dff=sans-serif&prev_fmts=1600x96&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&ifi=2&pfx=0&pwprc=1037897477&adf=16789255&nhd=0&adx=1000&ady=3290&oid=2&is_amp=5&amp_v=2211302304002&d_imp=1&c=553004350&ga_hid=393509541&dt=1671942770306&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&bdt=5921&dtd=3&__amp_source_origin=https%3A%2F%2Fwww.bg3.co
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.117.184 Jakarta, Indonesia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-50-117-184.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 84850d50823ca8d77cb4c238356e9289dc59dc770f00829d7f3a70aed85c3f70

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:51 GMT
Content-Encoding: gzip
Last-Modified: Tue, 13 Dec 2022 15:05:32 GMT
Server: Microsoft-IIS/10.0
ETag: W/"064f584fd91:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=0
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3314

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame A384 3 KB
1 KB 272ms
272ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 07:15:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76660
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Jan 2023 07:15:11 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame A384 18 KB
7 KB 273ms
272ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 02:21:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7910
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Jan 2023 02:21:01 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame A384 0
0 318ms
318ms Image
text/html 172.217.194.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTMcF68S_MGKGb5AbhfvgxQp4ahYsNfksg-PKKZgcCSrwcwoFVrnJVpRdWgZ_gk_Mf2ko4J3-Yg451Oi8hEBp8p03aAjg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3216231935713038&format=400x250&w=400&h=250&ptt=12&adk=90073500&output=html&bc=7&to=ampa&pv=1&wgl=1&asnt=0-39904443701284981326&dff=sans-serif&prev_fmts=1600x96&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&ifi=2&pfx=0&pwprc=1037897477&adf=16789255&nhd=0&adx=1000&ady=3290&oid=2&is_amp=5&amp_v=2211302304002&d_imp=1&c=553004350&ga_hid=393509541&dt=1671942770306&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&bdt=5921&dtd=3&__amp_source_origin=https%3A%2F%2Fwww.bg3.co
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.194.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f106.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A384 153 KB
47 KB 657ms
657ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 25 Dec 2022 04:32:51 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A384 42 B
63 B 276ms
275ms Image
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BaEuduGf2xYJuNWbPsOfm8Qmb3_tTgjkk4M20MHuTImfO8je6OS5s0cdL5TVXO1in34qvPHQkl-IMflb8winpjpYO_KZPpbpVK-XQzB8n08v9EdQs

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame 931A 107 B
122 B 275ms
274ms Script
application/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=adx.holmesmind.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212070101/show_ads_impl_fy2021.js?bust=31071251

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://adx.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 931A 107 B
122 B 275ms
275ms Script
application/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=adx.holmesmind.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212070101/show_ads_impl_fy2021.js?bust=31071251

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://adx.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2

200

CRsRsXd0FUmqwYRG7gS9TIn516je7wIpMnr86Jcv.html Show response
adx.holmesmind.com/adx-file/20221110/ Frame 4C8E
Redirect Chain

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006-1&adk=3314916115&adf=3653020619&pi=t.ma~as.3006%2F14006-1&w=336&url=https%3A%2F...
https://adx.holmesmind.com/adx-file/20221110/CRsRsXd0FUmqwYRG7gS9TIn516je7wIpMnr86Jcv.html

801 B
1 KB

238ms
237ms

Document
text/html

13.33.33.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://adx.holmesmind.com/adx-file/20221110/CRsRsXd0FUmqwYRG7gS9TIn516je7wIpMnr86Jcv.html
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212070101/show_ads_impl_fy2021.js?bust=31071251
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.33.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-33-38.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: da4085030009e98daf6eb2656f5fae35c7a3bb947e1a290ddbb20581cc2678b9

Request headers

Referer: https://adx.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 446
content-length: 801
content-type: text/html
date: Sun, 25 Dec 2022 04:25:33 GMT
etag: "ecb9b362af60ffdbe438788aa8ca18e5"
last-modified: Thu, 10 Nov 2022 10:57:04 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 74e86ed0fa6d314b06f69aa24cdc2c36.cloudfront.net (CloudFront)
x-amz-cf-id: eLhTUZHwHCqsvKZjFx-ptdSV8VuGWBkz7KJKCVsEGMfcvDqwmqIIyA==
x-amz-cf-pop: SIN2-P1
x-amz-version-id: jJWfL_fJcKwy89AgB0I8qjWdNPPXmBep
x-cache: Hit from cloudfront

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:51 GMT
location: https://adx.holmesmind.com/adx-file/20221110/CRsRsXd0FUmqwYRG7gS9TIn516je7wIpMnr86Jcv.html
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 425F 13 KB
5 KB 274ms
272ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 246518
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 Dec 2022 08:04:13 GMT
expires: Fri, 22 Dec 2023 08:04:13 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4479 783 B
738 B 579ms
278ms Document
text/html 172.217.194.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4941e6859ba7a9fc3365dad7ed6670e4bc05223dd72f48f80e2ae70a402b3cdb

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-6hlZCh_zx_xDrNHNCh6G4g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-6hlZCh_zx_xDrNHNCh6G4g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:51 GMT
expires: Sun, 25 Dec 2022 04:32:51 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 8230 36 KB
16 KB 273ms
273ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 15:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48267
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 15:08:24 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame DD7F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpQXehuutOlaUQC-TX_whk&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpQXehuutOlaUQC-TX_whk&google_cver=1&C=1

43 B
766 B

353ms
352ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpQXehuutOlaUQC-TX_whk&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIY1oGCvQEwAQ&v=APEucNXUdgzCzlo4EYdTu1T_1lDx85_x-wauTFeE1XZesDgZhqZct2ovdfFx_c-DNTXuEQudbfU0JdxfMLSr9H_dhUXMyeBNyA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:53 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:52 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEJpQXehuutOlaUQC-TX_whk&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame DD7F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y6fSdLwdZDk2vWVraVTFHAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpQXehuutOlaUQC-TX_whk&google_cver=1

43 B
766 B

359ms
359ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpQXehuutOlaUQC-TX_whk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIY1oGCvQEwAQ&v=APEucNXUdgzCzlo4EYdTu1T_1lDx85_x-wauTFeE1XZesDgZhqZct2ovdfFx_c-DNTXuEQudbfU0JdxfMLSr9H_dhUXMyeBNyA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:53 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpQXehuutOlaUQC-TX_whk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame DD7F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEOD0n67pvfqM8E-RS_zeI7A&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEOD0n67pvfqM8E-RS_zeI7A%26google_cver%3D1

43 B
1 KB

372ms
372ms

Image
image/gif

104.254.148.252
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEOD0n67pvfqM8E-RS_zeI7A%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIY1oGCvQEwAQ&v=APEucNXUdgzCzlo4EYdTu1T_1lDx85_x-wauTFeE1XZesDgZhqZct2ovdfFx_c-DNTXuEQudbfU0JdxfMLSr9H_dhUXMyeBNyA

Protocol

HTTP/1.1

Server

104.254.148.252 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:52 GMT
AN-X-Request-Uuid: dfeb3d9c-b9fb-4192-905c-aedfa65cec2d
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 116.90.74.208; 116.90.74.208; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:52 GMT
AN-X-Request-Uuid: 74dc5cd2-b757-45e9-8384-5d0fda192831
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEOD0n67pvfqM8E-RS_zeI7A%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 116.90.74.208; 116.90.74.208; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DD7F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzY4NjgzMjU3MzE0MzQxNDk1Ng%3D%3D

170 B
188 B

277ms
276ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzY4NjgzMjU3MzE0MzQxNDk1Ng%3D%3D

Requested by

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sun, 25 Dec 2022 04:32:52 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.208; 116.90.74.208; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 9b26732b-9a61-416a-8eba-6c89c1dcaedd
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzY4NjgzMjU3MzE0MzQxNDk1Ng%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 25 KB
10 KB 244ms
236ms Script
application/javascript 103.229.10.171
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.229.10.171 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: d854082be0173c977aad8f65cdb9b88fd005f3dd3f34f894ab9fdba5a283780f

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
content-encoding: gzip
etag: "StHfV9prSwQMxjKWocWEFw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Sun, 01 Jan 2023 04:32:51 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8BFD 42 B
64 B 275ms
274ms Fetch
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssm2tQzMAgBXhPjGF_PFixfY-P_DbWRPyEcYUaHC8XZrlcxSIUFFnoPBvJ2Dj6yFKmue6xhMhUJdgiUC2Es3aZll_vF&sig=Cg0ArKJSzPGLk1bQwoCgEAE&cid=CAASFeRo-xHyfywyclvRMH4KqLrqaOVkxg&id=lidar2&mcvt=1000&p=0,0,280,336&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221207&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2365071409&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1671942768893&rpt=1364&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A384 41 KB
15 KB 273ms
273ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CkX07qLNbO4TvaS-ldDW21cPfQJIgAaQtr4QbaSfQqlGrdRRDzJsmWhkcdfzbkhPLSFZ5hhs5ISs9Oi-x68PGp_1zksAFfHpEGqavQAj77qvULpBqhY4IrVWLFLgIpeF-6Es3TaPI4shXFsmLcxesrGelv1im8hvZzrICTtXUkE9OjbDw&cry=1&dbm_d=AKAmf-BWoIkVu-E_wLw-ENns6zVNFEyNwRIrMl0cQfwuZp-avSG1PF6eEImhC-vaFcSCapKvI4TiRHU3-oXOUvC0bBXSkr1ykLcBiD-hxgYn18jNv0gCUpr5Qn1djvkO1ElPT-gtgqLHF0mUYbH3ufNnRhit8hz7FHDVXUWYs85tSfCmJLoK6JOXOsZiAREq8hG0efMv7eQ7cYO7stJx5CSDlitom1tsYTeVC6GGokSXhFLFYVC5Ij3l2iLIw4G0ULCmXiUmkgsFAPXOyoL0HMGfidLnhrus9M1-5t_WP8AckzP4BNB08nl76eDvShqunOfz-Klf1zV5GwAJXMo1Jqx0qg_o2jH8d2e6fCrZEH1DHZCgI0V5Vl5U4yCc_wklDPia_guQ4JubtqmSEWwFAvr4NFJ1VxIe9-lNZ8aik7rLfvf3ZS68n4Dfn_OvQ1iXhzLuGpEcgXO98jw23Jm8rgRMQtPopbpPIVlNFxnSIIihBTfE9YzKjO91vHkVTdJk_SH_shs1sTxjDQ0ZbAQXZBK9zBk6lFwkZnMFRyt9wjS2CuY5rJNWpfEVc2M2YrmDsbu5wvD0LcgWmXwYng1WqvRieCZXB4ZM_wjKrVfCO1Neop28FjnZ6lEecI_ShvsyB-Pu3ivgFpQ0ga-gjZ0--9TAapxSJbCNeP76PlA002lEjPbuI0DZSx4ogA9-mAp-niqVKYEotahezJw1MM4guQ1VomuAGOou8ijm9nZT-L-oWp_BJ7jUZ7EYEVNfzTe6ND2l84_sVFXkb4d_44rxqBzZQ6rI15QGwX1XmRNVRnlBW9i-KXx5xgUa_Tkih2SsUyRs9ACs-bUqugCO0mdztz8yvT0btbOyhdxbAweFoFh7_1Mga9CroN3i1x7aVwtxYglX_G-UWEyC0447kibaiH5-Kb0Jo70yS0REKK6978M5mT2BDCe907I9juEpfq6cvWMLWJjs8_e38y5wALd3JWyPSqoF57CEvzaRleQOxoPrnUfqBskpLu3mrNQWM2p_9xAToTkkZKAiQGpS4WL2RwfQdR30HJypWlpdiBvmwdNRynDdTKTWlJ6O1l-UxRISy2Re8JgZcWl7wpPMEn42OBkYHaFFbuFAspqL-1HZ0c7oBEWNprulBWhjLtuCGYCZV1njU9Hfk42YUK1DPcu6wQnhWcSZmd6gRRLVsUaoga_OuY4LXUeBOIhVU1H90gCbFI-jdzoqalhp08_uQUMQI421Uu_cZyDEfvqy2RIQooeTj3ypI3pDBG8YxqoEwsqkvTjz_p9QXYzAtGG53E4zUOg3mH8QbkVCvLAXUxDThNxHuuTxB0QRhp0Ehr6JTtjb54o-CRNGxGWjqJOYhgptVFPDkhi0a76znOyxQFoMt4cy6BE3_LiQCzPeDt0a3aqHTg3kxS2ndJDUcIqbTTjGPexbz026QvmvWsh3I_C7DopGfME5V_k3x26qKNhP3qubUrM9FRPcKV6UcZOE0u8GYpTzkXADuGeCuK2H2ed3X3KWj8JmlXghQTzLlYOW7u_iwsmkIzacu33rKJhJpaeQhc2d0sizz50XfSYECbapgsGPl6rDTwQNtxMGE3UbD83WmmaIqrk5_fe_MvzWj3xBKQ1ujPRRYqoKFuABr1nurBU1lLKdSji6crOKHr4KSbM1gcIPJV8a8JP0ePT6E3yopjBXymz0-Uw-yFs8P5FJeRz-pGDmuwv0Pfo4N59h-RsJ27Qv6pi3t25RiBLfM0lY7qJH7MVUABMu9k6-_DNwdvnVIJYGJ2wF7X9fV0_QgeD3499i9Tr87RZWwgvbCCijpI-OVQTR_O0HbT3ESPblkwC8cPCLYTImIAtrHhBs3aV81u4mdEPfOikIj5Uh7Jx33YGBJO4zCgv9AEBC77gKR8H7iDxK9zhMkBNrQA0t0E-09sW49_aq7ieoLUKl_Tje60xJasY0FpwjPM9FtQC559EIP-3Nfemus3qMIuWRQw_bb9i-wb49j1gSeR7w0rJkbZWXIoTqZsBh3K8CSeopBYM3j2X14afpGJKUfvJzU-SMJYI3ct6Jvw9p0npzj5ibD0P45RlrtBHatGljYf6tXX8W-NHImmYhRsGVmd7OSkOivIioumVLG_m0QhUY0YXPVlgN8G7JzQsPp-tmAZBNhdaat5G2quoSQrYglxCaUM10EH3hnEU7lt6wvBYRR8OEr5P2-1425B2Z1IDotFbrb9vrxrj4s2Bid11xn6cfSPbAKmXz81fHhVAwI-ZROz4FBBfVzPU9tXtRTs0IhMI2NPzNErI9mZXY9bBtmRdQhq_ByQW_DlpIx5l4X9gcUmxjkoilwsnQadVbJUL0ogWTKXei8NbGM-qacWm0LZdT_X7HZhLc6du-tv8pG8oqj2VEHlHiZSL6u9mpdB-PbVyQb5rko0j4Sb93xmODOrzRbbHxjvX_WGRIUDTQVf4ydeWZM50Y93wOV3AzoTvZy8FtUzsOVuLwJxhagbodcAyEHcTSetM9dj9P5dN02JJfZ9rvjLyYisKXaGrHVOM9rGxMNTESTqy0c4u3yifitdjxcNX8dp9iwOH9DV3SkOJ7EjifjpCqz_XQJ_5MtVPaYHCRGYMHtTmA3aM62LCyDjwKm4Oqm4oO1gWlVwitPX1bF78EKT3OhGTpE7IWDQuVWCrsh7bbiuObRALnreol1odrgn7Ql3PiyQ5qiOdxHFrrCgGxpMvhAp6PTV6DiQbFsNEo1pVQVSBSrK1LN5YYBewZeDlXRzVgNrdRwutb_q1OHciKN0Uu14sZ0sYWQVyhiV7pWkZ1D7acVz0mEpd1Tfeogb74D7_7FkAmysYzlL1extPVHiJ3FiADfFIJiImDf6K9SAsp24xzKJ2vf1ioCAK25dm-msP9TESO46CissTWOrXPiuShSLUz25DOUddJPXq3viNBQL75Kp-SWMS7N4VH1Z7lOXXtrdIwoTgHKk4h-amwHnhiDWKLF--MPg48YP-HGTt_Mo_olHPgDEZ-5VfW9amxLFoKFv60IuH1iK2eMOnI2-6AsOmRmo4j-2W4yHFN_ogsRnbaCwJeZAW7Nu9zKQzI0oyQqoMZdMMCq3Shd-U8gGo7uz9m369Z5AeW75MXY6lXFVDr-SaIad1rd9aWtYqGQOBezxi4JqhW1EZwXn5-892V6wxteFTDiEq9ahotLV4LelWJO4LoqIIBVFdDF9KccnHWzRmpKr1LlcitNzITJuEctkaV-3ZkUSxWLoPsxZjcokowgk074qS6x0EZ1A7soXKOTXUOQQaQTDGd86AivbdnqPJNIzyHQ7quuhdoVAP82rfdgF8EFCpo2vI-5bkUSGJHpUyZ1WkfvYScA7H3gXxfag6RxFZb6KSiABW-m3VCEDIrIQEvaZTqqfuIl90xU9m8ZWNjY91heYml7gMFv2BPPESZfmu73V2t0go2IPj4Ge--DAws8TdVG2YlXLrVc5KhOD8T7Ex32thbCKs8iXRFFn0J3cL9oqk8LtpIK-LKVRrKDa64gQmugDHaeX_5ZutsFPLKd-VpsvykXjzaJY04Tf2TSRdvu-VlnV8cw9JaQB1ktY4_hwU&cid=CAQSKQDq26N9ANb-in5pS_lU0lmb1SoRMqewkov_9JpF_4d5B2ALmk6vZCoQGAEgEw&rfl=2%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Dec 2022 20:16:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202582
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:16:29 GMT

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 425F 36 KB
16 KB 273ms
273ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 15:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48267
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 15:08:24 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 5700 0
0 274ms
273ms Image
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022120501&jk=2929754655092833&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rules-p-54Nt-1NAaEEe0.js Show response
rules.quantcount.com/ 160 B
613 B 718ms
235ms Script
application/javascript 13.33.33.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-54Nt-1NAaEEe0.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.33.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-33-127.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: edc30a0e05622f71d52d07a0b7b5e94e654ee06854f893be1954336730eb0db6

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 03:41:21 GMT
via: 1.1 69b39b6769984cf063fcfceb47941eb6.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN2-P1
age: 3092
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Thu, 13 Oct 2022 15:29:19 GMT
server: AmazonS3
etag: "05b131079c67d484167fd1b1f6c79577"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: o7HjTBcp99a96i33hiSe_XQBK0falSiXewelChiefNQshzp_38sQbA==

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 8230 0
10 B 272ms
272ms Image
text/plain 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?sJCFOg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 435ms
147ms XHR
application/json 104.16.86.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20221225

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.86.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

297f9ba17399952c1c714755f4e3a2b00b4ca7a911cf24533c26a3039b323700

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1888
x-jsd-version: 1.0.1566
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230021-FRA, cache-yyz4538-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"66b-Za0NOhqUsqdyNOVkqe6n6NFrtgU"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3OtXCjaQrhYTJaz4AFbrE%2BjYNff4c5UyfFLC53EEgFrEC5Mr04VlzVq7GT5nNUTuLgfxQCAGA2BLXWV1xNo0R2xcD%2BPRHXIij2jMAvtSmFK%2BEozVAwMpDyKurSpX38csAbY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 77eedaf4e9c7aabe-SYD

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
502 B 1227ms
464ms XHR
application/json 23.50.119.72
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.119.72 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-119-72.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:52 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Sun, 25 Dec 2022 04:32:52 GMT

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
358 B 1023ms
549ms XHR
application/json 51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.100 , Singapore, ASN16276 (OVH, FR),

Reverse DNS

894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://www.bg3.co
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 185 B
408 B 2521ms
355ms XHR
application/json 52.193.158.132
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.193.158.132 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-193-158-132.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: ce220f2d9b0298916494f4fff764227ab1f6150e46350de32eba1943ee3600c0

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:54 GMT
content-encoding: gzip
x-prebid: pbs-java/1.106.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 175
expires: 0

POST auction
prebid-server.rubiconproject.com/openrtb2/ 0
0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 185 B
406 B 2786ms
621ms XHR
application/json 52.193.158.132
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.193.158.132 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-193-158-132.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: c3c85e2dc81c2e384a20448a1827923b18106ce50338f503707fcfb9fd250004

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:54 GMT
content-encoding: gzip
x-prebid: pbs-java/1.106.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 174
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 472 B
2 KB 1603ms
340ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=20616&site_id=395958&zone_id=2209398&size_id=15%3B2%3B8&alt_size_ids=2%2C1%2C13%2C14%2C19%2C43%2C44%2C117%3B1%2C43%2C44%3B&rp_schain=1.0,1!adpushup.com,062d9a21f747ddee7c25d4297776e0aa,1,,,&eid_pubcid.org=62fa2fbf-805b-415a-801b-ff14780da23a%5E1&rf=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&tk_flint=pbjs_lite_v6.19.0&x_source.tid=11db5036-bf3d-4e05-af20-873978091adf%3Bced20926-37d5-45b3-a1f8-bc0e9ec51f49%3Bf9625ebc-c50a-4eb5-9783-3eeef98f854a&l_pb_bid_id=18cc0bcb445cdbc%3B19f3d46ea268f2b%3B2031b5ee1cd4a85&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=3&rand=0.7159745403314577
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: b4784f001741a3e1fcf5d8ec4352ceef517d2af66b6d4f19e3cb7a68a6cbd676

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:53 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 12 KB
7 KB 545ms
392ms XHR
application/json 104.254.148.252
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.148.252 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

8027e36a58e876eeae7a177310db30c7003a2c5d7282268a10c50e7faf446a59

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sun, 25 Dec 2022 04:32:52 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.208; 116.90.74.208; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 17482b2a-ac26-4dff-bddc-92f79bcfb464
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
1 KB 662ms
375ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUPEPKI9
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5f289b9b9702435d63acce2727d675849f660eba5b5ee361cf1a6a49b80b80ba

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:52 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.bg3.co
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 135
alt-svc: clear
expires: Sun, 25 Dec 2022 04:32:52 GMT

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 3 B
517 B 932ms
317ms XHR
application/json 44.240.100.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&CanonicalUrl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&PublisherDomain=https%3A%2F%2Fbg3.co%2F

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.240.100.190 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-240-100-190.us-west-2.compute.amazonaws.com

Software

Resource Hash

37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 25 Dec 2022 04:32:52 GMT
via: kong/2.8.3
x-content-type-options: nosniff
x-kong-proxy-latency: 0
p3p: CP="CAO PSA OUR"
x-kong-upstream-latency: 14
content-length: 3
pragma: no-cache
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
212 B 775ms
299ms XHR
text/plain 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.19.0&cb=67721785221

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 25 Dec 2022 04:32:52 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

POST
H2 200 adreq Show response
ads.servenobid.com/ 717 B
672 B 1342ms
524ms XHR
application/json 52.16.72.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=4910
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.16.72.231 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-72-231.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 037192b727defa55cc176629db61c9c71c1126decfae405ffc3b0fb355a0d705

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 25 Dec 2022 04:32:52 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
504 B 1026ms
548ms XHR
application/json 3.1.214.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.19.0&referrer=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&tmax=3000

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.1.214.35 , Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-1-214-35.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:52 GMT
accept-ch: sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 arj Show response
adpushup-d.openx.net/w/1.0/ 174 B
382 B 679ms
390ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=0b0b08a3-fbae-49f8-9ba9-abc7233717d9%2C838d5cac-87e5-4aa3-80a1-a8e554bc9ea9%2Cddd52a1d-ca97-4f5e-bfd9-d151a385b418&nocache=1671942771665&pubcid=62fa2fbf-805b-415a-801b-ff14780da23a&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&aus=728x250%2C728x90%2C690x90%2C690x250%2C675x90%2C675x250%2C670x90%2C670x250%2C650x90%2C650x250%2C650x150%2C630x90%2C630x250%2C602x100%2C600x90%2C600x250%2C580x90%2C570x90%2C550x150%2C468x60%2C320x50%2C320x100%2C300x50%2C300x100%2C300x75%2C300x250%2C250x250%2C200x200%7C728x90%2C690x90%2C675x90%2C670x90%2C650x90%2C630x90%2C600x90%2C580x90%2C570x90%2C468x60%2C320x50%2C300x50%2C300x75%7C120x600&divids=ADP_42753_728X250_77a9c22f-ac02-45dd-96bc-b0896a8a7d5a%2CSTICKY_ADP_42753_728X90_d1c10a72-27b4-4931-8ce7-99a18ebbdbae%2CSTICKY_ADP_42753_120X600_104b282a-bd11-4d8d-ad64-0492063b6cba&aucs=%2C%2C&auid=545618347%2C545618347%2C545618347
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 1762410da84a420405b0fbe814a86766fd441c55512803467b8bdea9bf208088

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:52 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
504 B 568ms
280ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=21265123-5aa5-43f9-b3b5-1b84103eb377&nocache=1671942771665&pubcid=62fa2fbf-805b-415a-801b-ff14780da23a&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A120%2C%22h%22%3A600%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=120&vht=600&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:52 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
296 B 706ms
418ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=638140ed-c106-4dbb-9a98-1983ecf67d7f&nocache=1671942771665&pubcid=62fa2fbf-805b-415a-801b-ff14780da23a&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=728&vht=90&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:52 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
296 B 625ms
338ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=8cae0b2c-d509-42c6-bf11-ab6d25afb1e7&nocache=1671942771666&pubcid=62fa2fbf-805b-415a-801b-ff14780da23a&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A400%2C%22h%22%3A225%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=400&vht=225&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:52 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
562 B 617ms
372ms XHR
application/json 172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=693656&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2262cce5d18ad2479%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A7%2C%22msi%22%3A7%2C%22mfu%22%3A3%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A3%2C%22ou%22%3A3%2C%22allu%22%3A3%2C%22ren%22%3Atrue%2C%22version%22%3A%226.19.0%22%2C%22userIds%22%3A%5B%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2269379c693ef0a77%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22320x50%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x50%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22250x250%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%2272115a6617d4131%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22320x50%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x50%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%227355540e9bcab11%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A120%2C%22h%22%3A600%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22120x600%22%7D%7D%5D%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22adpushup.com%22%2C%22sid%22%3A%22062d9a21f747ddee7c25d4297776e0aa%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2262fa2fbf-805b-415a-801b-ff14780da23a%22%7D%5D%7D%5D%7D%7D
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e107c3b577fbfd8e2c656cdfb9342197643cfa3f5768e105d9b2e0332ee12ac0

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:52 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sPkn84WHxkD6vzMkZZzet%2BP%2BDCbQtan8Oe7zX6KRfIeVlddnDJx0jZwkEZd9o6NloMeeWVqnVhuZuEL3SCfaY03AIHSv5EVPyPRIfMRSS5J5D0gDdjAd0Lp7B0BXuqBGaRZY7tRx"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 77eedaf4dc75fb94-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
311 B 657ms
412ms XHR
application/json 172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=693656&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%2262cce5d18ad2479%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A3%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A3%2C%22ou%22%3A3%2C%22allu%22%3A3%2C%22ren%22%3Atrue%2C%22version%22%3A%226.19.0%22%2C%22userIds%22%3A%5B%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2272115a6617d4131%22%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playerSize%22%3A%5B%5B728%2C90%5D%5D%2C%22api%22%3A%5B2%5D%2C%22linearity%22%3A1%2C%22placement%22%3A4%2C%22w%22%3A728%2C%22h%22%3A90%7D%7D%2C%7B%22id%22%3A%227355540e9bcab11%22%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22120x600%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playerSize%22%3A%5B%5B120%2C600%5D%5D%2C%22api%22%3A%5B2%5D%2C%22linearity%22%3A1%2C%22placement%22%3A4%2C%22w%22%3A120%2C%22h%22%3A600%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22adpushup.com%22%2C%22sid%22%3A%22062d9a21f747ddee7c25d4297776e0aa%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2262fa2fbf-805b-415a-801b-ff14780da23a%22%7D%5D%7D%5D%7D%7D
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e107c3b577fbfd8e2c656cdfb9342197643cfa3f5768e105d9b2e0332ee12ac0

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:52 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=th%2FjcwvYSqLHoPiEMH27wjFZexVNiR2wnDEsOJegF4Q0HMExrWKspJUuyZIg4dg9p2EIyO7ArU6zWt2nu8LVXnLz1x5ZNiuke7EmmAB%2FbQqCbyDxHezEMBkopHjZ%2FmqwtQ4T6c%2Bz"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 77eedaf4dc76fb94-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 24 B
361 B 869ms
301ms XHR
application/json 35.213.117.18
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.117.18 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 18.117.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: ab6158038ab748111e8f121e955854c58c9d83c1e69b633b7330be470f54e0d0

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sun, 25 Dec 2022 04:32:52 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 49

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
167 B 1017ms
343ms XHR
text/plain 145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 8
date: Sun, 25 Dec 2022 04:32:52 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://www.bg3.co
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 5

POST
H2 200 all
csm.as.criteo.net/ Frame A615 0
127 B 712ms
238ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sun, 25 Dec 2022 04:32:52 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 4C8E 144 KB
48 KB 287ms
287ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4126554779393986

Requested by

Host: adx.holmesmind.com
URL: https://adx.holmesmind.com/adx-file/20221110/CRsRsXd0FUmqwYRG7gS9TIn516je7wIpMnr86Jcv.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bc3dcb6dd0f01c05cd96b4aedc7358e5e7d7c12fd90ef209052fbee98a056f4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adx.holmesmind.com/
Origin: https://adx.holmesmind.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49331
x-xss-protection: 0
server: cafe
etag: 16230913801802826851
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 25 Dec 2022 04:32:51 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4479 0
0 274ms
274ms Image
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022120501&jk=3030272667403393&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 200
OK dvbs_src_internal115.js Show response
cdn.doubleverify.com/ Frame A384 59 KB
19 KB 272ms
272ms Script
application/javascript 23.50.117.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal115.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115843&plc=4214575&sid=18330&dvregion=0&unit=300x250&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0jZfz7Qym3R8-D4MdQ-HZJK&DVP_DBM_1=3060631&DVP_DBM_2=23009949&DVP_DBM_3=14586208515&DVP_DBM_4=396394710&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=881479034793&turl=https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&DVP_PP_BUNDLE_ID=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.117.184 Jakarta, Indonesia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-50-117-184.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 4804c2aedacd4aeaa883f9ee68a46db16fca0019e321d2991ccc16531d57f7aa

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:51 GMT
Content-Encoding: gzip
Last-Modified: Tue, 20 Dec 2022 11:38:02 GMT
Server: Microsoft-IIS/10.0
ETag: "096c846714d91:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19510

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 425F 0
10 B 300ms
299ms Image
text/plain 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?cz4KzQ
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:51 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame A384 1 KB
904 B 2528ms
242ms Script
text/javascript 34.149.43.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=0&jsCallback=__verify_callback_929573868984&jsTagObjCallback=__tagObject_callback_929573868984&num=6&ctx=1828362&cmp=115843&plc=4214575&sid=18330&advid=&adsrv=&unit=300x250&isdvvid=&uid=929573868984&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&nav_pltfrm=Win32&dvp_strhd=0.40&dvpx_strhd=0.40&brid=3&brver=89&bridua=3&dup=null&turl=https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&chro=1&hist=2&winh=250&winw=400&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=2&htmlmsging=1&tstype=128&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0jZfz7Qym3R8-D4MdQ-HZJK&DVP_DBM_1=3060631&DVP_DBM_2=23009949&DVP_DBM_3=14586208515&DVP_DBM_4=396394710&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=881479034793&DVP_PP_BUNDLE_ID=&prr=1&aUrlD=-1&m1=13&noc=4&fcifrms=7&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=163&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D38b%5D4%40TauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D38b%5D4%40Tar9EEADTbpTauTau8%40%408%3D625D%5D8%5D5%40F3%3D64%3D%3A4%3C%5D%3F6ETar9EEADTbpTauTau8%40%408%3D625D%5D8%5D5%40F3%3D64%3D%3A4%3C%5D%3F6EU2%26C%3Dl9EEADTbpTauTauHHH%5D38b%5D4%40Tau2TauJ%3A%3F8%5CE%3A%5C%3B%3A2%3F%5CK%3A%5CHF%5CDF%5CK2%40%5CH2%3F%5C%3E6%3A%5CD96%3F%5C42%3A%5CD92%40%5C%3FF%5CD9%3A%5C52%3A%5C52%5CI%3AF%5CI%3AF%5C492%3F8%5C%3E6%3A%5CEF%3A%5D9E%3E%3D&dvp_exetime=6.70&callbackName=__verify_callback_929573868984
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal115.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.43.113 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 113.43.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 9507fadfd5cd038fdc1ac2be92f4838f61a66f3f91d1ef0166259c98a918591e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:54 GMT
Content-Encoding: br
X-DV-Response: 1
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Expires: 12/24/2022 04:32:54

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0B13 22 KB
8 KB 274ms
272ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 341066
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Dec 2022 05:48:26 GMT
expires: Thu, 21 Dec 2023 05:48:26 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 404 L2EveWluZy10aS1qaWFuLXppLXd1LXN1LXphby13YW4tbWVpLXNoZW4tY2FpLXNoYW8tbnUtc2hpLWRhaS1kYS14aXUteGl1LWNoYW5nLW1laS10dWkuaHRtbA==.json Show response
cdn.adpushup.com/42753/ 555 B
818 B 588ms
588ms XHR
text/html 42.99.140.200
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/L2EveWluZy10aS1qaWFuLXppLXd1LXN1LXphby13YW4tbWVpLXNoZW4tY2FpLXNoYW8tbnUtc2hpLWRhaS1kYS14aXUteGl1LWNoYW5nLW1laS10dWkuaHRtbA==.json
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.200 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-200.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 6d83b77c3d8c5c0ccc7078540a1fb0bd9fa43eeb82b89f83264d469aa100c088

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Sun, 25 Dec 2022 04:32:52 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=MISS, edge; dur=8, origin; dur=221
content-length: 555
expires: Sun, 25 Dec 2022 05:32:52 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/ Frame 4C8E 356 KB
117 KB 302ms
301ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4126554779393986

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6e8f85b1cb1c5229d58a68934d5241457af0d0d64075d5087c9e4146a734fd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://adx.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:52 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119955
x-xss-protection: 0
server: cafe
etag: 7117926654099438639
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 25 Dec 2022 04:32:52 GMT

GET
H2 200 pixel;r=850532212;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html;uh=e51ed67dfb8d91dc24b15e2ace0c3...
pixel.quantserve.com/ 35 B
210 B 244ms
238ms Image
image/gif 103.229.10.171
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=850532212;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=1;fpa=P0-1876743617-1671942771550;pbc=62fa2fbf-805b-415a-801b-ff14780da23a;ns=0;ce=1;qjs=1;qv=bf501fc4-20221215111636;cm=;gdpr=0;ref=;d=bg3.co;dst=0;et=1671942772272;tzo=0;ogl=;ses=ed35858f-3081-403b-9479-168cbb281632

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.229.10.171 , Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 25 Dec 2022 04:32:54 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 0B13 36 KB
16 KB 273ms
273ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 15:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48268
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 15:08:24 GMT

GET
H3 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame 4C8E 107 B
122 B 278ms
277ms Script
application/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=adx.holmesmind.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://adx.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 4C8E 107 B
122 B 276ms
276ms Script
application/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=adx.holmesmind.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://adx.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 66E3 603 B
66 B 288ms
288ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4126554779393986&output=html&adk=1812271804&adf=2253520749&plat=1%3A520%2C2%3A520%2C3%3A2163200%2C4%3A2163200%2C8%3A512%2C9%3A520%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1049088%2C32%3A32%2C41%3A32&format=0x0&url=https%3A%2F%2Fadx.holmesmind.com%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1671942772229&bpp=3&bdt=536&idt=372&shv=r20221207&mjsv=m202212010101&ptt=9&saldr=aa&nras=1&correlator=4411100037047&frm=8&ife=1&pv=2&ga_vid=316716031.1671942773&ga_sid=1671942773&ga_hid=427512652&ga_fc=0&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=336&ish=280&ifk=3680311399&scr_x=-12245933&scr_y=-12245933&eid=44759876%2C44759927%2C44759842%2C44774649%2C44774653%2C44779793%2C44780792&oid=2&pvsid=2435376668215380&tmod=725982185&uas=0&nvt=1&top=https%3A%2F%2Fwww.bg3.co%2F&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=4&bc=31&ifi=1&uci=1.h1qke1kellt2&fsb=1&dtd=389

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adx.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6C0B 603 B
66 B 291ms
290ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4126554779393986&output=html&h=280&slotname=4923695364&adk=3446667921&adf=552093737&pi=t.ma~as.4923695364&w=336&fwrn=16&format=336x280&url=https%3A%2F%2Fadx.holmesmind.com%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1671942772232&bpp=2&bdt=538&idt=393&shv=r20221207&mjsv=m202212010101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4411100037047&frm=8&ife=1&pv=1&ga_vid=316716031.1671942773&ga_sid=1671942773&ga_hid=427512652&ga_fc=0&nhd=3&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=336&ish=280&ifk=3680311399&scr_x=-12245933&scr_y=-12245933&eid=44759876%2C44759927%2C44759842%2C44774649%2C44774653%2C44779793%2C44780792&oid=2&pvsid=2435376668215380&tmod=725982185&uas=0&nvt=1&top=https%3A%2F%2Fwww.bg3.co%2F&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=2&uci=2.5opmwhtr44ir&fsb=1&dtd=399

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-233-146-55.compute-1.amazonaws.com

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adx.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 224 KB
77 KB 576ms
274ms Script
application/javascript 142.251.12.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Z0TZ7TDHS1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

a6889f6487cc985ea90b1be32d1865865adc0a70fab7d78a64f997f56de21d01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 78544
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 25 Dec 2022 04:32:54 GMT

POST
H2 202 logs Show response
http-intake.logs.datadoghq.com/api/v2/ 2 B
234 B 1061ms
384ms Fetch
application/json 3.233.146.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://http-intake.logs.datadoghq.com/api/v2/logs?dd-api-key=pub6b45632781dd758b20e9d8357c39efab&ddsource=nodejs&service=adpushup.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.233.146.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800;
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Sun, 25 Dec 2022 04:32:53 GMT
strict-transport-security: max-age=15724800;
x-content-type-options: nosniff
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
content-type: application/json
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 2

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0B13 0
20 B 278ms
277ms Image
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B8jkPc9KnY8mZBpfk3LUPws6QqAUAAAAAOAHgBAI&bg=!19Sl1JDNAAYgquz3AKo7ACkAdvg8WnvRSbC5bnSZchxiNdE-JACN9mFOL9ZESbfU-D3PJ0R34FGecgIAAABNUgAAAANoAQeZAuPpD8Eio1SlTiwQQUiHp5SCOXrIuAkN17B237hOLAnS1I1rZ9pyMsoKALeR3S6zzdIIsLTg8gkVkp4D-T_75ULuvCKQNPI2urpWFyxr-UZyG9Kya6XxJrmoc0pGLzdMbFW-55BfU5u1ONxA0del-T3s9NcsO1QKeM8MLpnGhvnkWWvGYBTPLt81q5qKJCWKf38FoPmxbYdrXfHM0QgbblNVM_F7e9q3uR1yNxV5ViQFmWbKNvT0p34lYomOCatKMFQ29kHOpIFEl-LIgj-tfR-96IWwJm8w_nYgFejnRBO1FCBRoG3IG5biU92A4FS3hXx5rER3niMTyH8jOXQv1UMprlnpPrzPM8hZvHZM52d_DIYwb2L39uPevHAASBSIa8FgAK34nDBlzg4HaOUNq--QnbCh7Smkr_67xGlcy_uwCaDM6H7ZFJh6p8voL7aY3H8Oopcjl5BOliy9LTAgVMJwkmuuBKhCjG4digEZwqwD29HRMXM7APLqwUjAp7uODtFQpzucTVFT1YTuWFsyrEUYwTPJ-PyD4CdtnxE2mJEJ8o7x_Tgr-lmP15GSKQfGPtBta0PePsfddzYssWOznyFLXztWcp07CzjLi-CpBUZx0hV6IMBquHYe_Kp3TLegdjp-lRm14lyNveskM3dtfLHjyYKrG069RVDNKlGciFmST1ptawXTCa5HLscooZbM9vwg47gMTBLuVYqk1p0Sa5CXrgtc-eMgM7CTeeQmTQnMxCHXP35kiEkTCpTdIfJAcCjMYFWg6ul7UzODtuHhe1DFF4z5IDbUh88E7ZeoeWVl_2hcXTN4PNYZTnYAC06fK0fm_cWHXm0O8iWmw7aEDn-PwcKWsw4EeP8lopXa7i0DiutGJ8HHeRi5gII_7eVHVyDKSest5kn2Z7OaPE0P3vcG1KKcLSvh9zv_M9O6JxnC2ua6ZWvm9HOiYbruE9hQ8o8osxm2gag8fRcBW-XADagTFhRU

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 2F94 16 KB
12 KB 281ms
281ms XHR
application/json 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221207&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ed7a8d4ba9b599c039dcf293112f37d4802fe80b34cc8e32c72bd980b964a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:52 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12618
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 4C8E 16 KB
12 KB 370ms
370ms XHR
application/json 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221207&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae284e65a1c21fdce995a236fb945dff76d72943b34a707b01ed8cb94d26fbc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://adx.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12496
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 931A 16 KB
12 KB 280ms
280ms XHR
application/json 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221207&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212070101/show_ads_impl_fy2021.js?bust=31071251

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0297867a46851e546a64f1b12cccf9cb7f559be6540bb10322fb6eac6563d68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://adx.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12646
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame E7F2 16 KB
12 KB 324ms
324ms XHR
application/json 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221207&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/show_ads_impl_fy2021.js?bust=31071168

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9fa1fb61a85a69758dc7a916321d2a8683cf3e650102f0398f0d446d931a1b16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12439
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 2F94 17 KB
6 KB 275ms
274ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 25 Dec 2022 04:32:54 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 931A 17 KB
6 KB 275ms
275ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212070101/show_ads_impl_fy2021.js?bust=31071251

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://adx.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 25 Dec 2022 04:32:53 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame E7F2 17 KB
6 KB 275ms
274ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/show_ads_impl_fy2021.js?bust=31071168

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 25 Dec 2022 04:32:54 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 4C8E 17 KB
6 KB 274ms
274ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://adx.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 25 Dec 2022 04:32:53 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame D97F 13 KB
5 KB 273ms
272ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adx.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 246520
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 Dec 2022 08:04:13 GMT
expires: Fri, 22 Dec 2023 08:04:13 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame B351 783 B
537 B 277ms
276ms Document
text/html 172.217.194.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

0751b860222a373357be5e8df5244945fbbb9c76c29b9093082755b342bff03a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-G5V50wJR_zaCJMY2GpLU4A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://adx.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 515
content-security-policy: script-src 'report-sample' 'nonce-G5V50wJR_zaCJMY2GpLU4A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:53 GMT
expires: Sun, 25 Dec 2022 04:32:53 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4E41 0
0 277ms
277ms Image
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022120501&jk=2929754655092833&bg=!JCelJ2PNAAYgquz3AKo7ACkAdvg8WkMhFeF3CdP9hbqCZmBxFGeTo1v4TLxtaLa2qVE-CFseLe5BagIAAABaUgAAAAJoAQcKACFBiMcaKojUY-19oPoLFekwKG8na4rdDlKeiLomruWi2BCZAtz4qISX2_jKDFsO8QS7CBBKCOv1humwtKrpvIqS1sBjsiW3uLemsDHLhJzkdsEJBLUie5UE97jF-UxBJZ55DbaMmgrVN8uierga_Q_cNXgO3x4VOn0FQYviay9S9eMfwtQIhtJtkIELawjKPQ53CEQglucNHjC0BMwVJmJ_kvaFeMXwQYp4FfC1-IawPJG9zQkXnPflJMRVwnqyysGmL0Z1Vq_dskVT3qbBwGsEbFjbZGeqL12jcH5BZGWiTfIbdOZ9pX1IZPrSZrZED_Q8P3Ho3V4XaORMlNRBh5zwBJWC__-k63hGZYKb8HTgDaXVAeVv7QhV4__OD1PUD-nNbWJ8Be7uhUwK4B4RRKHlzy6msYOSvYPRe4Q-Xodt9w8oYjzverJnteWloscNJTskzCUH37xHVSNKLsTMDTiF8rYa6qBaqXPIBHzkh21DRJw7ORQ6dP97wpQSFPMmhlfrN5c7tkXLnAwRU_2DrdHp05-9R-Os2dDRCEQ_wKnS-q0UV6jgCUkXjtMXEhTxLJZPG7jxX5KW2T8apRHpY-Se72pEyml37iouYFhO-B1V6UzkZr_ANpZAHn2ynS2s6BOQ9KWtmAHTQGz08hNz59MF0KBMQ-iMRNPL2bMPM3mDQCFQp6u4cro8GGovYgFM12qAqYCIUF8N7JfAtBk3Tm8RSPB8QW9UOspH40-nRhvXuu8fGQHcV4KZ-U7eO-ETr_ZyOP6wdcLwqon2ssb84M-sm0flPflJ5aXE1zcnC0U_82cJq7VnGxqANH4Yki123OgmOizm5YRAB2MI3dduVcyDGjEinbDxQCeFhXLp2A8as2_Dn-Xz5DAk79IMeunXHwzULDOFtPZcmhNvnVWWZJAU0fjqOPDsjqdbf48xTSiNcAZhxeywgAwbq7PGmzl9eYsvI8h1Uh1yjepJXMh7Ty9NdzeSjKeGzimcAzFjR4M_w1YCHt-FoPzmaWg3CUZjl48
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 051C 13 KB
5 KB 273ms
272ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adx.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 246520
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 Dec 2022 08:04:13 GMT
expires: Fri, 22 Dec 2023 08:04:13 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame F5ED 783 B
535 B 276ms
276ms Document
text/html 172.217.194.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

66e623e8a3862f63caf0683ac08222e0d554cc2bf91d5a4d6c98449079bc1076

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-PUmE7F8fVuYNxrrvyBOzew' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://adx.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-PUmE7F8fVuYNxrrvyBOzew' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:53 GMT
expires: Sun, 25 Dec 2022 04:32:53 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame B351 0
0 275ms
275ms Image
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221207&jk=1843228990856770&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame D97F 36 KB
16 KB 274ms
274ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 15:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48269
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 15:08:24 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 2631 0
0 277ms
277ms Image
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022120501&jk=3030272667403393&bg=!7e6l7qrNAAYgquz3AKo7ACkAdvg8WpMx-H1scSHt6ibGuD1sMyNY4wdDUGWITRd0gE5WG8dWE6xHXgIAAAByUgAAAAJoAQcKACFgB9HJAGYfxsyEcRqyhAuy7tdvxU6dcgryV8ZaZL4ClAOZAsJvKGFInn7QIOcLuKZXuiG91qHNJvJIJVdHxtheyy_Jt25_mJl1ej89sHUFNv3j0qIf5AvlcJ-8npG-rYWzuMUMWx9xkHHErqtDblPNi66feB58i4a_YmzJieS0w9RTiv_5f4XOKvC9mEvupQlXqMREpXFrIcae__g3TBKX21E23XhimmYaljBR0LRqtJ3Su6zi_3xWT7fiY0yosKcIXcavspZNbd9TrWQ2XqJE5gyd0gV8FlPwWKGvFO4FpU-gxF-JszNSkcaMIweMIYR1U7htZSBz3ItcL43J9JTT53p91-QGbIOXfrv_kVcczYpsdMKDnSfl95ZP8NkC350Kad_u9UrAYXMh_9fIGOV8l6jBP_hdPGQ_rSbWTgp9UgfCLC04r1y2bsEkOpi9U_GGXu7EiqJyNlzINBBttBg4jM7558zVAX-m_nd2jIxzi-v-8nr98KsfoKlehbSCWDAxf-65ZRQAwqX-AS4D-py-t0OgPKrPTycduE2uS9y4-RRa9QSj0KjtIsyWcw70ZewoYsz7cccLk58yGaYY003lKRJ_xklA3jSzGpeWE1uCFNWwtA_QD2oogtgScgDbS1AiA_AS_XztP2M1BIhzdmlBtZCH5iGA08vacqQz6yaLAaHotjTMATEQaUmctqGxGnxJajWnBfSFOMD6YF-Px_iJvhA01o13lcXvJCcnU8e6UuGxBmhNA2gugQdce8qn7uKzx1bRFgd472WLXPn_-HF3PA391sCLpHvo60xx4w2PaHRS3_tethXWP3VuJZI7Fvm_-bsdo13wQQtlm5NMJ58eDr_k-O7zVgVx7NZzcHE4enRbEPs8yJ_W7rvrkjatedMb3acEis15WjSc4unWnFF1LKs74hD8GJqvJqR4JdWrTJAuahf1f06w4xX6ZRsaVEKUVHCO6du2oY5NEJW7NI0q4ECgcZl2
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame F5ED 0
0 275ms
274ms Image
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221207&jk=2435376668215380&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 051C 36 KB
16 KB 273ms
273ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 15:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48270
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 15:08:24 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame D97F 0
10 B 272ms
272ms Image
text/plain 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?RJVaXg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:54 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 051C 0
10 B 273ms
273ms Image
text/plain 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?KPr6Og
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:54 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame A384 28 KB
11 KB 273ms
273ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal115.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9406a92f81fad251295cd64386a8bb62ee7503f589ae1b96893faae2f4fcb18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:01:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1883
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10900
x-xss-protection: 0
last-modified: Wed, 09 Nov 2022 17:19:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Sun, 25 Dec 2022 05:01:31 GMT

GET
H2 200 auctionData
e3.adpushup.com/AdPushupFeedbackWebService/feedback/aphb/ 70 B
317 B 234ms
234ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/aphb/auctionData?data=eyJzaXRlSWQiOjQyNzUzLCJ1cmwiOiJodHRwczovL3d3dy5iZzMuY28vYS95aW5nLXRpLWppYW4temktd3Utc3UtemFvLXdhbi1tZWktc2hlbi1jYWktc2hhby1udS1zaGktZGFpLWRhLXhpdS14aXUtY2hhbmctbWVpLXR1aS5odG1sIiwic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInBhZ2VHcm91cCI6IkFSVElDTEUiLCJwYWdlVmFyaWF0aW9uSWQiOiI5Njc1MDEyNS1iOTBjLTQ5N2EtODY5OS03MzE3MWY3YjQ5MzUiLCJwYWdlVmFyaWF0aW9uTmFtZSI6IkFkUHVzaHVwIiwicGFnZVZhcmlhdGlvblR5cGUiOjEsInBsYXRmb3JtIjoiREVTS1RPUCIsInBhY2tldElkIjoiMDAwMEE3MDEtMjdhZDY1ZWQtZTE2Ny00NmRmLWFlYjctY2E1NWY3NzQ4MDI5Iiwic2VjdGlvbnMiOlt7InNlY3Rpb25JZCI6IjEwNGIyODJhLWJkMTEtNGQ4ZC1hZDY0LTA0OTIwNjNiNmNiYSIsInNlY3Rpb25OYW1lIjoiQVBfSV9EX0FSVElDTEVfMTIwWDYwMF8xMDRiMiIsInBsYWNlbWVudCI6MSwicmVmcmVzaENvdW50IjowLCJwcmViaWRBdWN0aW9uSWQiOiI2M2RkODYyYS0yNzg2LTQ3MTUtYWVhMS0yNTZiOTUzOThkODciLCJ0aW1lT2ZBdWN0aW9uIjoxNjcxOTQyNzcxNjM3LCJiaWRzIjpbXSwidGltZWRPdXRCaWRkZXJzIjpbXSwicmVxdWVzdGVkRm9ybWF0cyI6WyJkaXNwbGF5IiwidmlkZW8iLCJuYXRpdmUiXX0seyJzZWN0aW9uSWQiOiJkMWMxMGE3Mi0yN2I0LTQ5MzEtOGNlNy05OWExOGViYmRiYWUiLCJzZWN0aW9uTmFtZSI6IkFQX0lfRF9BUlRJQ0xFXzcyOFg5MF9kMWMxMCIsInBsYWNlbWVudCI6MSwicmVmcmVzaENvdW50IjowLCJwcmViaWRBdWN0aW9uSWQiOiI2M2RkODYyYS0yNzg2LTQ3MTUtYWVhMS0yNTZiOTUzOThkODciLCJ0aW1lT2ZBdWN0aW9uIjoxNjcxOTQyNzcxNjM3LCJiaWRzIjpbeyJjcG0iOjAuMDAwMzgzLCJhZElkIjoiODJmNzBkZDQ5NTRmODgyIiwib3JpZ2luYWxDcG0iOjAuMDAwMzgzLCJiaWRkZXIiOiJhcHBuZXh1cyIsInJldmVudWUiOjMuODNlLTcsImZvcm1hdFR5cGUiOiJiYW5uZXIiLCJyZXNwb25zZVRpbWUiOjU1MCwidGltZU9mQmlkUmVjZWl2ZWQiOjE2NzE5NDI3NzIyMDV9XSwidGltZWRPdXRCaWRkZXJzIjpbXSwicmVxdWVzdGVkRm9ybWF0cyI6WyJkaXNwbGF5IiwidmlkZW8iLCJuYXRpdmUiXSwicHJlYmlkV2lubmVyIjoiYXBwbmV4dXMiLCJwcmViaWRXaW5uZXJBZFVuaXRJZCI6IjgyZjcwZGQ0OTU0Zjg4MiIsInByZWJpZFdpbm5lckNwbSI6My44M2UtN30seyJzZWN0aW9uSWQiOiI3N2E5YzIyZi1hYzAyLTQ1ZGQtOTZiYy1iMDg5NmE4YTdkNWEiLCJzZWN0aW9uTmFtZSI6IkFQX0xfRF9BUlRJQ0xFXzcyOFgyNTBfNzdhOWMiLCJwbGFjZW1lbnQiOjEsInJlZnJlc2hDb3VudCI6MCwicHJlYmlkQXVjdGlvbklkIjoiNjNkZDg2MmEtMjc4Ni00NzE1LWFlYTEtMjU2Yjk1Mzk4ZDg3IiwidGltZU9mQXVjdGlvbiI6MTY3MTk0Mjc3MTYzNywiYmlkcyI6W10sInRpbWVkT3V0QmlkZGVycyI6W10sInJlcXVlc3RlZEZvcm1hdHMiOlsiZGlzcGxheSIsInZpZGVvIiwibmF0aXZlIl19XX0%3D&c_b=11729.79999923706
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 , Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:54 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H3 200 integrator.js Show response
adservice.google.co.nz/adsid/ 107 B
122 B 275ms
275ms Script
application/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 276ms
276ms Script
application/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 61 KB
23 KB 599ms
599ms XHR
text/plain 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3161634060883018&correlator=3107519791645421&eid=31071151%2C31071159%2C31061165%2C44780792&output=ldjh&gdfp_req=1&vrg=2022120501&ptt=17&impl=fifs&iu_parts=103512698%3A22574853003%2C22477626096%2C22479095528%2C22579309510&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=320x50%7C728x250%7C728x90%7C690x90%7C690x250%7C675x90%7C675x250%7C670x90%7C670x250%7C650x90%7C650x250%7C650x150%7C630x90%7C630x250%7C602x100%7C600x90%7C600x250%7C580x90%7C570x90%7C550x150%7C468x60%7C320x50%7C320x100%7C300x50%7C300x100%7C300x75%7C300x250%7C250x250%7C200x200%2C320x50%7C728x90%7C690x90%7C675x90%7C670x90%7C650x90%7C630x90%7C600x90%7C580x90%7C570x90%7C468x60%7C320x50%7C300x50%7C300x75%2C320x50%7C120x600&fluid=height%2Cheight%2Cheight&ifi=2&adks=1420297610%2C2857874404%2C4082231052&sfv=1-0-40&prev_scp=adpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30%7Cadpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30%26hb_ap_format%3Dbanner%26hb_ap_pb%3D0.00%26hb_ap_adid%3D82f70dd4954f882%26hb_ap_bidder%3Dappnexus%7Cadpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30&eri=1&cust_params=da%3Dadx%26outbrain%3Dtrue&sc=1&cookie=ID%3D9bd7e8433c5cb109-2205e37eadd90093%3AT%3D1671942770%3ART%3D1671942770%3AS%3DALNI_MaL15xxU04g7UJYkXNT3gw8ScTWCg&gpic=UID%3D00000b96d197098e%3AT%3D1671942770%3ART%3D1671942770%3AS%3DALNI_MZhYSeSn9HlJQqCf3-J4c9vggEzoQ&arp=1&abxe=1&dt=1671942774662&lmt=1671942774&dlt=1671942764385&idt=7471&adxs=236%2C436%2C5&adys=60%2C1110%2C300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=1%7C2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&frm=20&vis=1&psz=728x-1%7C728x-1%7C120x-1&msz=728x-1%7C728x-1%7C120x-1&fws=4%2C516%2C516&ohw=728%2C1600%2C1600&ga_vid=1878843823.1671942767&ga_sid=1671942767&ga_hid=393509541&ga_fc=false&ga_cid=amp-Si5SS-eYORi5E3KZ-XPXKw

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c1e005e1edeecb81042006dd137bf833b38d1b0d93006c291fd3ad443c92412

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:55 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23488
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 69F6 6 KB
3 KB 279ms
275ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:54 GMT
expires: Mon, 25 Dec 2023 04:32:54 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 publishertag.prebid.117.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 237ms
237ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.117.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

90c9017a8a6447588520f38cd94ba14cdb9839c92626aa06bb8a4a1052c2ab7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 29 Dec 2021 12:30:46 GMT
server: nginx
etag: W/"61cc54f6-15c19"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 26 Dec 2022 04:32:55 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0104 13 KB
5 KB 273ms
273ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 246521
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 Dec 2022 08:04:13 GMT
expires: Fri, 22 Dec 2023 08:04:13 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6449 783 B
533 B 281ms
281ms Document
text/html 172.217.194.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

02649f1607aa3ff09aae3aef95d12496b2e71ce75d8e463058f77b393dff3c15

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-mDupsSPcEa1JZZTqcXnLKA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 511
content-security-policy: script-src 'report-sample' 'nonce-mDupsSPcEa1JZZTqcXnLKA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:54 GMT
expires: Sun, 25 Dec 2022 04:32:54 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame C5C7 13 KB
5 KB 273ms
272ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 246521
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 Dec 2022 08:04:13 GMT
expires: Fri, 22 Dec 2023 08:04:13 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame B1BD 783 B
536 B 277ms
276ms Document
text/html 172.217.194.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7648611fc3eaa8b0c58186e8bc0323626d893191d1e6f7179f348789329de6ef

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-wX64yV7CQyDltYHY--WnBg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-wX64yV7CQyDltYHY--WnBg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:54 GMT
expires: Sun, 25 Dec 2022 04:32:54 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 impl_v92.js Show response
www.googletagservices.com/dcm/ Frame A384 60 KB
23 KB 274ms
273ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v92.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8acf96115cb55ad61bfdc24b7918a946d1b983ac14062a584dbbe8744021430a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 19:37:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32123
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23563
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 16:32:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 19:37:32 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 6449 0
0 275ms
274ms Image
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221207&jk=2150646398706856&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 0104 36 KB
16 KB 273ms
273ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 15:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48271
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 15:08:24 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame B1BD 0
0 274ms
274ms Image
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221207&jk=4156723046863717&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame C5C7 36 KB
16 KB 273ms
273ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 15:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48271
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 15:08:24 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 89 KB
29 KB 242ms
242ms XHR
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.117.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

61c1317e433c125a2ebbbdaf22fc3a0b3606bcb0c9cfea151425adf7b5195f48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 24 Oct 2022 11:21:19 GMT
server: nginx
etag: W/"6356752f-16294"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 26 Dec 2022 04:32:55 GMT

GET
H2 200 B9689862.280410797;dc_ver=92.271;sz=300x250;u_sd=1;dc_adk=521587881;ord=6qwbd4;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=2,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=KEl.e8... Show response
ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/ Frame A384 53 KB
26 KB 856ms
305ms Script
text/javascript 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=92.271;sz=300x250;u_sd=1;dc_adk=521587881;ord=6qwbd4;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=2,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=KEl.e8fSsW;stc=1;chaa=1;sttr=335;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v92.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

cafe /

Resource Hash

b7fa76ba793a24f7abf1b299ad8723d2a944339cc17fff208e71200e19154223

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25682
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C984 6 KB
3 KB 575ms
273ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:54 GMT
expires: Mon, 25 Dec 2023 04:32:54 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 48D7 6 KB
3 KB 580ms
279ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:54 GMT
expires: Mon, 25 Dec 2023 04:32:54 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 070F 6 KB
3 KB 592ms
291ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:54 GMT
expires: Mon, 25 Dec 2023 04:32:54 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
www.google-analytics.com/g/ 0
106 B 574ms
273ms Ping
text/plain 172.253.118.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-Z0TZ7TDHS1&gtm=2oebu0&_p=393509541&cid=1878843823.1671942767&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1671942775&sct=1&seg=0&dl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&dt=%E3%80%90%E5%BD%B1%E3%80%91%E8%B8%A2%E6%AF%BD%E5%AD%90%E8%88%9E%E5%A1%91%E9%80%A0%E5%AE%8C%E7%BE%8E%E8%BA%AB%E6%9D%90%E3%80%80%E5%B0%91%E5%A5%B3%E6%99%82%E4%BB%A3%E5%A4%A7%E7%A7%80%E4%BF%AE%E9%95%B7%E7%BE%8E%E8%85%BF%20-%20%E5%A4%A9%E5%A4%A9%E8%A6%81%E8%81%9E&en=link_preview&_fv=1&_ss=1&_ee=1&epn.value=1&epn.siteid=42753&ep.error_msg=no_mapping_success
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Z0TZ7TDHS1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.118.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sl-in-f138.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:55 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0104 0
10 B 273ms
272ms Image
text/plain 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?7BkfQA
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:55 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame C5C7 0
10 B 272ms
272ms Image
text/plain 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?PRreUg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:55 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 0de3566013914383836dcf943517c81f_cpn_336x280_1.jpg
static.criteo.net/design/dt/85833/221214/ Frame A615 61 KB
62 KB 250ms
250ms Image
image/jpeg 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/85833/221214/0de3566013914383836dcf943517c81f_cpn_336x280_1.jpg

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

5b0570558c1b63c5569392865cad79234d882182c6b8c7da8e4abfe09ac6c7b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:55 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 14 Dec 2022 10:42:46 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6399a8a6-f547"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 62791
expires: Wed, 20 Dec 2023 04:32:55 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 71F4 640 B
262 B 280ms
280ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIYkLfgxgEwAQ&v=APEucNVBGA_mBxJvP8Hqhel_Q0gfCRTCS3_L2hA1KnRGk2AX5ThoLoO6Flki5G7A-QrMl4zIz3dDMTMvbyJ_QzS10gtEs-hsyQ

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C984 15 KB
11 KB 311ms
311ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BkyPtBOG2R2NGXZOXHMHMUi1-Ny9jEF_SVTFzlOEep8LnMqWwDj6lDO1YNRkeuFGAx6BAkbLKKyxQOSXSVSRf3XR_Kn41vJOHPaikxoN99ojIXLkBUDqHTVhnXjH4O5rTtN_qvlUujg4JABtFFxKJWkU9UahM4nZQeul4mz1s9lM-wIZs&cry=1&dbm_d=AKAmf-DShUy4bN5mV7cTvm81HHrItY5sdKFYEcEQYsZDLSz4Y1SV0piEAwQAyRRdw3JxOBhbB3o2P7d8PfXZBZixtFMPMF-5wQtu5g-XgvcV4jt6FFy31mWxEDKPjA8JDi0_mMUB6gqkpzd14QFyDj1cxX1LADlSc6td5m0N-FippDzb2EQ9IgBfa8ZD6sEqimKemrgMJuvjIKaBqM2B6Fe-G2mK05vLWLmW3gJGbJK7NuKgcsT-9epf9VWaKPft82YhkepWfoyP1GLyceG77mBLF6teUxXzeomYiYCId1AKKylkyNm-upH-e4ora_mx8ZCfnz2Ts2iwC6_-Ij2YwVGGiHVm43bDS9s35aWTmV1YFvtY8mv308Pg91--4w0YqFvWdzc5QXFULCJZJcw6Gh9AwqhqkWTUdWxOAksYNRMup8OHkLvO_IhT3feRNN3LXWp3j8-eQSW_zmKnsITmdTcvz22qvq-RlEAm5hVcG0v0OuBAq6vyfyqQWQTuFx_lC7yd3ZIQ4x_D7G3_Ao0epwvwlyGRgmeGlOFGp-_vzjTYVfadWtCeUTydD_0F8tONXf9dzWTXoxNQwIqgJJk59GLNVgS29O8Q6sgm99DUUnk3zWSvprdS9BwsoTQc9sM6YRGdq9jajdWUXx4kdqrUcBKQRE4JpmHAdKH9JQX1tf0qF5wfPovOQz49Q36j1NYgMg2IxJOW8oRR1-7xl7QJGuyA66frID1_4yBZRtJkBcL34yNFNt-PdYijSR0IEGbJarMeoxKQ4iGZAhC4V0W0PHoESaaRY6dfTvy6jpUUwF1z-_RJqTGA7nx6D8FXcTA4hKG-fVjGFiwOZK5yxPZUpSJK5_4r8iaFknmZbEMsygKDZTuxtwi9tOFp6YkQR0CMx8WjBqcfrCuIF7uKlm_aVM1P9sQ-NZDU5Fr2AbypllpfYeYMdOFU0X7m6rE7MedBpWdOxMSE0kF51lzktajN-6TzJRAxlfRqy5iufyEvktwVFnqQoE0LshkTlSi_j9dvZYb46-6TVpXwsiqm3RSvj4ekykY_55ohViM2rB_gCVIbnXxLxDTyKoJzZQhdgjKCFuDZN9FaC1uOQeuvIFL_CKAa9US1FZzTKvlXxSsTTWuc2b2YC_aJ3DzeLg6Ru4pewKE_o4w9wlqdytTepLSQcBxdufwsXWw6nZFid_9b1RD0IYaA5uIiWLKxcVcekUorb50jnXnJzrnyaUxtSUlRh79gRpVRk_AHl4XDX_ME_W7YoX9XUBgPmsWsNgXXk3xAywGHh2Z4rCBLfDkL3a1KcWTBTmQcLxBRs5zIEbUEz1P4Ax-J9xU2beASZ4rcEW--J-gMYZ4aF8OSXAv3Y5VaHonw5fZH8OWbfFFspfZYeTULO0aigSJG2dNApEugZuZd205UbjHYlwVEt0hpHcHTTau7gd13qsPFssED2EkJqWYg8-B_UIWm5qWtYNdJzL8w9d9JGNrAjie6k_Rg6XrK6HoThryCxCgEt2BIjfXNHzeTIunk6LqZKE1-EjJJj9O3Zu27IB3iKyZzg61Yr1ITKVZhbChi7kOvk8fKJNCIpY3I8PmEjjfv_d_A1r5hhko3Epp5Pr7g70-oqY1zUQKE-dYiiatKk9r77H-eTclHIscnROxcTUuRbihJObvviuDIm3r9Z1qFyHQZaXRnwlUp-qdkVzZATRYlpbCaVf4-5K8DJ_0MR48f2CTjuXyhFJ6nVVE2nO-3CfpoKBmG_8GpXrMSTAzVQMw3hgOgUqbUK2yLKhs_4f1dPo9ry8sUKNjfKx_3bptVAo6ucQBsKw968XfYO6xBTofS1mklh7aun6jaKOsiwTsCp9avHkq5z67O69m4CPOPM2KR6IZ8iCaDFEI4IcrdPBLfu80FO9vDoHRNukmzFNu6we5MzzL0R8oWa0rCCNVHgkr9m5sfXIZ5U5rCr11HX4gBDBhoa8YaocOXvpJMEINPK72qpzpVbP64w8v2J66-DFRQ0l_DxCkS4_bX3rvGUp4cZ1nxv9T9OBF2h5uxP_3tl7BjujjiZ_RAPSnHtZ7x-oQ_OwQ-XHvZ77SqFU5mHoUgxx7KXJqHG--wQ76rcn5qfUXj93f7OYwUQMfs9Gd9WO0rAMR7StP7JpSz2iwWFg0TGyhrGM0I_S4GmARe0GkmxL5T7I_qv3Uk799_uoCp33TLcqWizHGizmenoizAa-eWkj-UZZ4-v_rf00A-L6VpsLnnb7p6BsGXDyk1GjYP4sPOte6HA6DVJV3XN66GdrkJEaHbeoH0vjbMoUi9Gi33TRMbhDY7UR-gEvRES433SmC9w05sgK2M5vSoMfQvyOPFYP5agt_BOaVQXY5oXkE6tpzPgRjZYXC4ip7XDjf9aF7xr0UzrO05SCh9ZSxTPvG0GdCxNB9iRqql8xGpchjO1lE5qQJqMtCxpB2hdXX_OHftxU6RWepYnZ_XbG9s3ujTLhWziUBq3ShGGdK9yOMypR2RdnzNa7_7CLA2VMLIwJf3jpy5AZ_-6H47BtwIAWbHUJsEVlIuMftF5lAhZuE69Y7O3THMqhc7pwOcJR5TOxDevSKij9WvIGgXQIXYz6Vx9jW-XRbuFHr2HJSYZ4v07xtJnxANiUP5l0wyHu1NoL1WwgsOUePkXtCyjO22WfxSGkOF5VAyAzFTqFQfWq_-jbyfukg7_PEB8FQJpX1AXf2eIQ1GMkVMcKf9EA2WwDOHrFXStVJtXA6sKoFOdTC3tb1OsBWWYBk9j1nUgKyFiFB2K_eBJSoVzZ8WCT-TQepP1gNcB1Jo7m2a0zfqIE_sB0GnLKK7SIbpzkMgYcPZkz3yPAt1UB-B-Q_CxSXrjxKSDUUF_IAXSNAWvJtZsPyU9JJMWiGvbEkqETH9vB59GbE1L1iKKjAkyB4QjWYvSM6TBUsP98gCq9nE1aIkYT_fCmGsIlJJ9TB-GetyYPOOaIryhCtBEYdMIC9c8uoAMc1fwtOUZaJda8hwtB2hmmHbsgGfKV0H5KAwv_BlHgon_cPhOuX5dJPbIkAyF0dMXKIuvnzSCOfZ-G3NdgWFAjRbbwYRjDDF98sHtk3R8ITYHTlmZfE8ByL7y4KkRb1nwDCnL7EGRa7Qk750px2FbAOyCkyVaL_KoTvalhL06BJYQjZj06q4qgmARQfpX_-E9r6hm93keL7DXk4iZx9znhMebT28F22krL2Q-1KeUwdwACs-LvqQtI6yU96_1nma5lM2UbU8FlZvPaSgXmiKC_yyL_CQsG_KSYyeoilFI4UfdmhU1k3s09tlkb8sNUTVaZr3UId7zOkXs-0esDrJftpdhIPN2nZRf49svO7LeC1rPrGSrm6d3s5by8dGNE0isZhw_rBjTvcKCjY4QftjeQESmlI-zI35k53p4d7mvQwCAUK2jpWhXzw026aeGbNa5Kcy3suGKN_jESbr_41FPPUNYuvWIJ2rDNLgubTOlMa6QWQhVE4pwtLUFLlpNQWRKJryPALW7EuxwvZJ0e3F9QwTSOn_FUGNh1Fp5JSAQIi1kWkvsMasIyZNOlmrdtgDQx0q0vWL01TcM-2HTJ4EXeviyTlQsk3ueFH9UMRYbD__JQY77KcJJASUBQTzxcSH5qkH5w&cid=CAQSPADq26N9Jee0olqkCnYexCxgdrKogFvE5EuF1hJqXSwNVXUZjhZH-mpDCe_y3Odx4GfP560bpwmgUOyhUBgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

023e1454e5cb5cc55881d86865263015f04303a75330565b8d7be17001bc027b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C984 42 B
63 B 277ms
277ms Image
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A_leRkO1gOZ9i3pHg8ySt5acDpsXWD6-3X_1-JzjyJ9oSFkP7nwAiqeUCfj4liNn0nSnyNhS6E5jKrJzWe4HdwpXkrVZUCkjgvq4J1FvTt3cN6Fpw

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame C984 2 KB
1 KB 251ms
250ms Script
application/javascript 23.50.117.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115843&plc=6419358&sid=18330&dvregion=0&unit=300x250&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0jjEdrLbI5D-dLfjSzFmk8T&DVP_DBM_1=3060631&DVP_DBM_2=23009949&DVP_DBM_3=16740933992&DVP_DBM_4=416816016&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=881479034793&turl=https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&DVP_PP_BUNDLE_ID=
Requested by: Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.117.184 Jakarta, Indonesia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-50-117-184.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: d8b1280df015b12fd4ea4138faad855238e57f1819a6d2b854d0fd9879532805

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:56 GMT
Content-Encoding: gzip
Last-Modified: Tue, 20 Dec 2022 11:37:28 GMT
Server: Microsoft-IIS/10.0
ETag: "f3ae98706714d91:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1170

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame C984 8 KB
4 KB 259ms
258ms Script
application/javascript 23.50.117.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&advid=3398311&adsrv=0&btreg=&btadsrv=&tagtype=&dvtagver=6.1.src&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVPX_PP_IMP_ID=ABAjH0jjEdrLbI5D-dLfjSzFmk8T&DVP_DBM_1=3060631&DVP_DBM_2=23009949&DVP_DBM_3=16740933992&DVP_DBM_4=416816016&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=881479034793&turl=https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&DVP_PP_BUNDLE_ID=
Requested by: Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.117.184 Jakarta, Indonesia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-50-117-184.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 84850d50823ca8d77cb4c238356e9289dc59dc770f00829d7f3a70aed85c3f70

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:56 GMT
Content-Encoding: gzip
Last-Modified: Tue, 13 Dec 2022 15:05:32 GMT
Server: Microsoft-IIS/10.0
ETag: W/"064f584fd91:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=0
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3314

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame C984 3 KB
1 KB 276ms
274ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/window_focus_fy2021.js

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 07:15:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Jan 2023 07:15:11 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame C984 18 KB
7 KB 274ms
273ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 02:21:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7914
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Jan 2023 02:21:01 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C984 0
0 319ms
317ms Image
text/html 172.217.194.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR01EiUTP3onFhdtPwa75H8IjRTLxwVkRVuoEb_H-I4F02IiM592vjG2f39N3jidhByLIFVQwpUEZ01Z5brTVBB0fFPHg
Requested by: Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.194.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f106.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C984 153 KB
47 KB 277ms
277ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 25 Dec 2022 04:32:56 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E07D 640 B
262 B 284ms
283ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLuEFBCarKQBGMjD5NsBMAE&v=APEucNWjTDg2SGQztJwNQaQmwOih33jAX-lMxQvpkilOHmR490qCyHCNoO9ePHxlEym-hePAM3S-eVk5Fp0eVTaLbVY8sn_onA

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 48D7 72 KB
34 KB 517ms
517ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DK2CAdgpjwBkKo0eBkm1VUeY7nxU6n3PXjtQ7j1NGNSyc6oxkGkA53d9Ft1TWZGaRSWmxQDYGi5BtjvQ55dpwGL-nqrQ&cry=1&dbm_d=AKAmf-AEPVqZVE4lWWl3kac06yt7wElBTIiNRnNOw60D69zxb9E8OJ2JeQb1JL8iRux7Vj9mRCKZAGkBtfRA13qrjR4hF842ZRJ5P2PB4bhrtfGiLMk2JO8ugwSpCeQDfuJd2tx8WH-tDdIvwWtIjbrXxRmsa8oq89dcaG5MvJnTkPXmfRhJd-Y5qZQgFyQG3ZJnKOndfF1ArtbYzTqpxdnVGs8gtX-mjxo-wVxjAKU_S4QpdcOAEjtST0yJ2fgc8XtNKz0pTIv6RQwOMv_UOrL0uZWTVz9ePjkvVvzSEVn5ZBfbSSM7qKBPLzvkU4qnv8RJcTzd4ivFix9qIHGdYJJAy-fmS9-5igpQWGdGBc6044s4ldOVZv-0Gn3WW7P-rI9QRF5GHwm9O_Qo8Voch7ft0Z3peY8u5lIIrNAM4ZKxhY75d9Fn2yL2lCteNyeURAJ0uT2_o2PDUQfwkoCArfx1jR8FHhfLi-nnr5rDia65AH4_EqaZmPmSbyCuUE72psVHZCNzfBh5AlNR6t-ujLOIGQus3lroyAQkNxIyGIUhd37il-q7q_S12OvjyCc_ycuRO-mLnFFY4cbHfY1yXhHliqJey8cNXM4NKc6Pqq3Xv8w3COHTQvh-Bnf55-qLYY_SW_z9c2_vLPzhMy2OFBYNKZLu6ihZLfHL8RzGpRMOfRfC9IRLTYltkI4ZSUatoA17ZTTXhI-XRybeq11ztf7RfJDktGRyNCq3lc5TSuB9vr6zQekrlQRRJLiS45KRxl_y9rz2HOGBs-52Bz5CChP2hzmUIiR-0p_WwnY4UzP0qbtAOZqYCrLeDL96q5_BO93f-PiFOFp9puaawNQZpKQhE1Cvv_i8AlnyPfXE4SHM0fU6PhEDm3UQek6fFsTtTKrDZceo5YJ4VHdNhBrALbTX6jnhKIpoQCuMEjYaho1Bgm9s43iXo3Cxz9ZfEiYzVSIDgoep5RjGdxtIKvDB02m-4ZGj9m6U4eu3aQc32kBmuQQjbOYnGq6r3VCL5AEnI_hLtQxhnkkQo3l8g5HfqzZeAYyhy51cu96iMoBZ_I9oaBHl9PW6XxSesSBJ2kiAfkepHSEku9rNcFVT2rvwaNIqpfcyqK1ic82Ej-tsYS9T9-lApZHq1yvv3ZT4OVsFYhc0a8Yllhkf8RbQIBRCuCsVPehFvX7mGdZsFi-K3VSdeovaYs6n2bC-sQGfxD5caMMpTXhXQRhPmYcfS1U9JvS6jEWv6GCYXNgp5-vhkQ4sfZWin41AQd0Ukufzowrc0Iz4YDNOvlvtWPQRjbu_3nYQTpqBZEAIeRW2jAWCbVQMn8lhDEK27UA3O3kT65QtkhIxEbk3VPJXeV7u4pBwHa3KDn5aXoisYfwWd2KntEKApDkCGKQjTCAnv76qd1ge_79Khl91GxOlyi5VZK8DBPoxbG1Ouhj-VBcCZjuR_e2GbLZCSIipx2HKaCKlqrOCp8PeDKwfLfuGCd_LEQDgTQQonxDw58Zo8aPy2BsvfIIf7uDLz2uzUbJ98fjH5LM6Zyk8WjYDjDFt5inA78eWs8OBqnNLFSAaNpC5Ezm1qWKSdusRjAfw6vRmm9UVVZe855YDsXJeB0tVTnYENaaNX3_EHTg0d9gUu6oI650LzsdJRlURB9jUMbhn-x9BjVIIfgcOmfWBjwOFk5SKMnroVpSR4CoXYAtR5brnw6LnrUh1W4AEhmwkvihv7YF0wss2lZ2f1E4HDvyV_55HuNVlMCR0d3CEc-OTvQZvlJqBImRuI6Fwu50Y-rZUqmXMPwtP3nEVKhM-ajyCRnAhsDl7-dxh2gCgH-Vibog8GHmBV5O3yKmyBq7iz09NvPmHfGeLdnD9HnAi5s8xRTQ_DJ59KMYYribw-cX9X8sf6iHQSUFvYcs7kWidEszkBkDlOwvErcQVcAfojA8qHah-Cti7Hnw5xMUdL2ZNW_xqtuTGzElc5HrQK1_HOGbYvXM7vvg6yh-4ol2ZP3lWjIrVYiMA1cdxt9KCvtG_vsm8bOR0fI5iM6ZYMCBNpduck-YEXUESdxxcqtHDUjV03gZ2jnSkL-XqgiCJvlT4M4SLUf9EJ4AVbeFPe-Pamk6awpcyJI12Bp_DDeW0COHK1h2433L3cQ1OreZnBFp6rumpi647zso1gRz2COLXFwGMdOlDu6iZxQNbsGrGoi3jR04cSCZ0bVpGEJKie_aAjXXvMiYnz_xywNTpbVej6by-CN-lhMQOf_EmueXS9ZDY8SqGA-7A_EXRdhG41G4VkU02nZUlT2ArVO8lVnnst1zn_KBHOb3ktbIvngD2T-7vV0a0vE7eXqfjH2QXvxdyDM-AqoXI-rzUAEbsvn0n7GKP3NW5ZB_ZiHtXQhKB_qP6_QXt1PYjT0kDnrcKgSMA4JfrstYoQMaluhflIsBkwe0H2uOCn8RHv7a8_yWk5mp6IsWl3mawbtVwqFQXIpTY2VimGLO4wKStmD0acatmo8Z3AjvIu4DxBtfkZiTpGEMm9_4Gsmz3Mm0ELrDId65WhwcoOdzBYkPNm_HHbinYTbCzionuF6aXcOykvD4iJjdZ57kLG6hsyIApat9tmrJAIZ2NNB8NSp6O2AZpZpCZOqzUxNs1-DYBsCQTyq97dnhczzSjEA_JYbSFWSIUNCK_nX2kET4kcJEwq4CffFihI25kyyoSnrZJ9EC3BhCbwzpQ9xlOwF5Iv0umehLrKm__dlwuYGG2qOXlxo4B6oFQXScrsfd2Awtf-QKUPNvkxKIqe9Msk531q6seDg48nghomV6H30s5Y6wbK3bRC6T2YamfG7c6mvT57dmh4OXfBRLmS4zday6UpI7HybZx5ZuZzsmQv3lYr_tOj5EplxZcaeLSlX_OGFegzKCQfJ-4jzy-lPwLdsAp1VXFsWaP97IO17TPE3d4CHZOyR3uYlFaamJ9Eb6a4QrvAYCm6Cj9cU8GAC5E_ZZdTGgYUOgx2996cK4MkEFn4nrGWnaF7vrHIeUPinwo3mD5jlcUtgP22ZusV9CRo80lx_r24JyiBUTUoN0dNlCTHbsgrO9O2Pq1C35jVHkLRGIouurJIFRM6vxkfAPNUQIALhifH_iObmwhj7JW5oTca5qlMAgBU0-qLOO5no4OPGk3CLtBGFDZi74iZqTtK0uUbKQ9-2-KwMebsI7hnFH9Jdl13UjkhMGwAWDypLs7T0DiOAClU-xNgNWoITxsvpB_I4cjGvOpfRVJvhARsSStQ0tuQZKAFmh-SELRFIj8BVCbWUzaZ9TH69coXIpQBbdLBYt25JorM0AT-kOVm_dersH7ECoiJ8L9omWBEGaeejhz6UFCN1kjzrFAsbKV823MesaQx8vZOZZCkqUKgzf07P_p0LpskJrXpaRO6ucFUPY2u_IcXUhla5rcnMvoTYXUoSpZfI4IzgsSlUbseWANBo9goMbaz5mt3nQ2jF9UTJA_i2DPZh0vgF3q5YfW7eE8KSxkGIAASVGjva6Mzwtl6vQQ9NDL_hW6jhl8ZyDkwaWSxcn3F9IjgQKUC8PPxROF8-qaS1UaJNNFZ3hQdA41IOvLxyRN30muNH0&cid=CAQSPADq26N9Jee0olqkCnYexCxgdrKogFvE5EuF1hJqXSwNVXUZjhZH-mpDCe_y3Odx4GfP560bpwmgUOyhUBgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

497a3056338daef53da6b895a73946243d686c7a6b9639790e357a78a9f4c99f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:56 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35035
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 48D7 42 B
64 B 277ms
276ms Image
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AVzzoB3g3jV0V58FPEoF9eevO-I8s4ddm6a5_UB4IAZZmPCTy_IndXjJ6-TGZ3bR8gIsmvRq8HT-f9SSzt1ymgPbyywscPbP-0f0KVxQMEPofWvpk

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame 48D7 3 KB
1 KB 275ms
274ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/window_focus_fy2021.js

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 07:15:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Jan 2023 07:15:11 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame 48D7 18 KB
7 KB 281ms
281ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 02:21:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7915
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Jan 2023 02:21:01 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 48D7 0
0 317ms
317ms Image
text/html 172.217.194.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSNZCrHHL1Ryk-D8czv2nfXu9269vG4dVJ8LXM-os_NJBdU7Z0y76nFGvg5SsIo3iNgLe8_1VDTwfPLIo_AodRedyjF1Q
Requested by: Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.194.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f106.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 48D7 153 KB
47 KB 456ms
456ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 25 Dec 2022 04:32:56 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BCE2 482 B
213 B 287ms
287ms Document
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYu8Do0gEwAQ&v=APEucNVfeFPvJXG0uzoAHSEbVn6iPc8l88_52pqqRB1C6yDVSo_9vD3VDfr2S9zLY5m9dpDj6QldGu4SGYBKHnsPkJY334tzAQ

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7599e0a5ce1ba2a12f036e998e19e60b6e982178e4363d4630ab3a91ca73bf62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 193
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 070F 80 KB
34 KB 384ms
383ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cc8b9vZMKgRBYrwQk8VVL48eZ0Lz7EOT-KwAoxCkj7Ty7Yk6yxsB_otBNMoVxVJYIJNtuEwXZ5nnmzIKH3seMVxrGbGCvSHMXNNaG-e66DPMsuvDErCgv4daJ3ZORHs3uL35-4y6WncxIP2FhzbTLKiRTfa_KbsOgetw4FIIug_zuEgx0&dbm_d=AKAmf-Aexl96Dj3DDlSlFlgd90j6l3J4RZEcxpDgPE3hUVb1WjKEgVAt9CqQjBRdMSvwiHf_rQU0SPsThMZXCTuN-Qk7VkigT0PddQvf4DpjUganb5IPOH2Nl6POQBpIqJTlC718kqVlTATqblZGuc5kk6OOJSJJUgswLXmhEDFDnw62YsjTmi7CZfqR8AWyl7nmgbp3zgTI8HnLtVkgStbDg8ugKqYNA4_yackDFUvgnJKU1OVxG5H4MNkCx1wwLVpuYpm1hmNZsk4ruuZcSgY231t_RNywzf3_lXyjMWZYT3TI2PDEmJD1u2ANw8Z-T9d5pEdbWtlGsJx5T5_JWPPuQWsdmC1-NUMI4bwpk6-bag26cHZR7qsgQ17Snc6GQOEV9ajxiAMe8lZSOve9C4aEIucPqwDIkhCm70-W6Yfs-g_nzMILtjG_OURVmLvG2llmkQcWGB-c4o1MSHmMTt6crxT0fkpjC61CIN3pAgQ0hSIcxVXFz5xV9ix9AOmgsRtWJ8lwfbrbArH3aZZY4UWA-_oI7XaX8jRws-3Xfx4gtH0ZcZSLaCnbvlbGjbC2HlfglE0SKUZxFzw92RiV7-iYrsfJbWXnOIqwF5mL4Kx6zogUfwQk0GfHVzw8QZuclcbZPoKfCL6QyIVqghGUbkMtlbobsh0Oc_zpdQeQ5n8sM9yndKyrA4YLi3BOHx1gTZayiyHc3sSlcQ-ozYxrku63cjhPb8mkB5eAraGNQCeI3xODpnXgB4Yoo406JsaPC_T3YEpOk_szt1eEXjg0tybgzqC07JNia8wJ2e4rvxFHuABx8lKlU8lrZlmWfys882OaiweEd3w579TcXAMdzRkBzOs-Q5yx4Zt_0lXAikQVmnLh2E1BWlA34B9LtdWFqfhUURa_dcW62K4CLpT70zLkKPczeZj1HBy_ZhJ2tzYt_RtbkxlLV04etAqjtW4yXLL9FYyAegAfx1RRkVdWJbMFpTmINt5oIoZGKJ4fBBh9vU5-r9aeA0klGIgj5uxlPJd-NP4OVvYRYhRlmwTxKzwHCFsywtokcY0a3iUdsAb2fa8raCX4A7z66Igf2ZUqWizjmctMqor2Qt_BQcol5aFg7w1BooI7B9ooO6gCROsPAnaFouEQVZDg6j_RLCnQo3URlntLyiWc_eslJbizqKyozAthVVbi3wByveAnd4rmNWa2G9rV1Te-zNBQhMKb2K-haeJlSdjLvDQF1Ov8DTPXM3kzB9-kV5zH9eH0kBUfxL-HNjhT7D_zhPiUYJY8_FA3VQiZHqcal2Pyc_vEw_kCATg5YrFlZUD95C0deGLkecZfjjrwwUdlwImd_9DCDQHy2e9d0iMWD1eX_HGaupFB-MlhYWQBuLHEcq_RaDZBefa1CNFCfzL0YhJ5BY9VX4gg0gUXV_FdWXLmRGPLhdM2z7KJWGk5myooFCFtdf2ROBHLCSOa4Id2DHxmhT0h6pL4rbjpaTmQAuPjlb3QGfoyVUflsPRU_yuBAxwzsdi5JSCHSsvgmevBglLZeRCBjVgIy1F0-pIdY2dhgRCZwg1fV-2gsvtnYxL2zQZPhlr0LNEjYq-k-eAcp-XjbKfupzEbNIGDt6gjVvUSiF2ssID2MkaH0wWuYL-xfQ788rExJC-KehNTOmKL3gRvLDrM-9sp92tKLYfBKAadlSH9vgXBPMh275NceMBFK-MhDjPwL-UGuBzCaUnxebQP5KIuDJLOEyzZOpVuV6I2OwhV6ZvBNB7JzMsBN5MOXW03r4sU-dP0Ljn14jTUZ1_FlllSRWGljce8jhPLwYFR9LugTuLkKXCM8Rt4HGXDScn0eTU9NTR1arKmr61Y8YpFE-wxuOokbfxpgcr0FTk93uiKvluWfaTe_5Yw0HyIPYHEEBJlWFw5O7tZddJv2a7NJlG4f4XwpDIdZmDk0fTYKB4IaJwN757CaPLcfSV2gXKJnq45HG2j5fVZEGuvh1kDkAs7Bff91dUPAA9WaCJp5T3HMrUqG7AwBGQh9rJloDkgTiqAxBrCsZ1dgCZxE2xpsufmIJ-xRNskRI5lIhUWIjbfsrW606BASJyl080ZarmVz0IGCQnQUn5uT3lmUmCZhyjQcJxR_BzkBm48karHfzVAoLCXbhjoBnmGeOF5TPC66HmqCPRF2kENrjQLNzeq1DV2I2WJj75hllrmRQ3f0eVO0UwX--QTaZM2vK69U1bohGnB8Pcyh8un9TyzFeXc_bJQi1p02gSg1l0WdR9vPiKfvZ52NYAzV0D7Qdw8C82Ul5S60RhZdzb4SAqvSS4cYYH1kNGhDT41OXl9ghxyfUJ-O5zzmD5sludpAE60iwuXxyb-pg77X4hmgbikUT6kzToZNgPRaD3TNrN-wwuNqLXTUUm8qK4lBLEGEzG0cA_gzafhW2_eN6f0mbFaO_mrW1mezwucsry-cUjXT1U22O1Hu6tZJFlrz374hJdLtHz4KlzeMEkJDBczm4cK2GcPriV4O20Un59LPeWQDNBfw_iWU-cCnDVhf2tE81y-joOWng6SIId-h50_rQLmqLk814CKCKHCYaUzczJiORXWDPra9KmfYZkdwvqqmhSusta3W93oZmzk6zGYopJ4Jt83QSkV6apzgLeQrG0KGDTS_JOQKB4zjTSBwebnhjVfagr3q4za1u1vi6bNQAr6hoWKn-EpEREc-eRhZO1xQJH93ipZZ3--ZoiETZHmJ_z8jgMDtZVr1U_SgIEI-zlhmQRyR7nhpFMlFbiUppphgYvGjNkhk6NfIgAoZSnaTxDxosx3oDVt5YW7AKY_6so-lRLlgXGG3G2twJgJA4OXhSfegdu7BmzS4ysHJ53dMZQoeU3glgMdrPhal9rh_Qg0nvQGhFf_V8785MY4aDrFEvYJDVkv9H95_CNB-ISuxnRjUq8r7o2aT5APLoQp3qTj8vtAVUBezSYR7fUdaR4zMnTWXFI6-ML1_rkIxXpni2cwrvJ6f7nU0xY5bQNEWGfmTd6EmxiyIVKF2CMN7rtAKxm4a3hGqsxPuK4gRUyNwgxXxLJZRUO0VbyCnlzFqT8IpJevrj1NxH2zFfGfglAs3BzYbAG6xvuzWNAOHs9hKbrunw2wpZxsXazO5ZhUmebDZ-WjLLhCRCPLVvLeEnbF_iGusrQoRuwFzt3ENcbeDvEOeZdMhXM75aCUyMarYAkl6NEzTlvqR0dwXyKuQVNrKJZuPlfgTIAH4ya0AYD_52js2xaV3UJSmJYi2cie-cM-Dk0scPJA8LsRGd1ecKB5S6yOVRtc1msHRB4ac5MdyI3pIHu2s-aNgD2B9HjGKj9ZdovccrwBz_ftht8gF1t1yBK00t7hWjtZuKIAM2k9WtW3BhkmXbrkffkvZSSjNOKUHIViaqUhteQB80OolTV1oZmpcMRTJONbiS3NMXeOiPrwuOxhj4WwrtIpDPkWGLYT7fNJI-2mZ5wFKoneNrpLlH6do3hsDhh_DzFNp0ovlji3nLlMy-vJpqUytwxPwjpV2bDyxN-z8ZiU0P0ASgc1emyLBHnsFjpbw4dCE3KTB0nBPw2_QHi6YOSte9JzrEPDYZ_dSY4_ECe5iaX6mIRXmBFJhqCpCHhjrhPXSokwoAs3aU7V4CMmPc0s4C3bcgc&cid=CAQSPADq26N9Jee0olqkCnYexCxgdrKogFvE5EuF1hJqXSwNVXUZjhZH-mpDCe_y3Odx4GfP560bpwmgUOyhUBgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3197520e3a57127fbde310eda7d7730d4b6d78dfab7910c3cedbcfe027be2e0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:56 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34732
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 070F 42 B
64 B 274ms
274ms Image
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AXN85IumeQ8xmD4Tr-pOTkwhmBfrY3E2mqZaOSHl03wKiCr6g_ncFjNzwizDzZCPEL_-1hF61wh2j9XBP94k7wLugShKToPhPBbCP9iOF05cwjFuo

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame 070F 3 KB
1 KB 357ms
356ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/window_focus_fy2021.js

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 07:15:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Jan 2023 07:15:11 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame 070F 18 KB
7 KB 311ms
311ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 02:21:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7915
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Jan 2023 02:21:01 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 070F 0
0 318ms
318ms Image
text/html 172.217.194.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQpfAKx2srzd3Hd1DimtI3aJjdtaAt6qfOBNR_K8uWe_dNj4Lio6SmiDcBkbu1vmXQwnAbtn7zJxck5OamjMHhmMvsz_A
Requested by: Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.194.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f106.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 070F 153 KB
47 KB 668ms
668ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 25 Dec 2022 04:32:56 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 71F4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGGAqEL26bi_MYZiyUCHh-8&google_cver=1

43 B
61 B

387ms
239ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGGAqEL26bi_MYZiyUCHh-8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIYkLfgxgEwAQ&v=APEucNVBGA_mBxJvP8Hqhel_Q0gfCRTCS3_L2hA1KnRGk2AX5ThoLoO6Flki5G7A-QrMl4zIz3dDMTMvbyJ_QzS10gtEs-hsyQ
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:56 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGGAqEL26bi_MYZiyUCHh-8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 71F4
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWQzOWMzMmMtZTBhYi0yMDA5LWNmMmQtNmQ0NWQ2Yzg1ZmE3

170 B
188 B

276ms
276ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWQzOWMzMmMtZTBhYi0yMDA5LWNmMmQtNmQ0NWQ2Yzg1ZmE3

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIYkLfgxgEwAQ&v=APEucNVBGA_mBxJvP8Hqhel_Q0gfCRTCS3_L2hA1KnRGk2AX5ThoLoO6Flki5G7A-QrMl4zIz3dDMTMvbyJ_QzS10gtEs-hsyQ

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 25 Dec 2022 04:32:56 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWQzOWMzMmMtZTBhYi0yMDA5LWNmMmQtNmQ0NWQ2Yzg1ZmE3
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

um
sync.teads.tv/ Frame 71F4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEM90pRF5iHPL_t4vEBMdOic&google_cver=1

23 B
172 B

1234ms
442ms

Image
image/gif

69.192.221.72
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEM90pRF5iHPL_t4vEBMdOic&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQi4Dw4AIYkLfgxgEwAQ&v=APEucNVBGA_mBxJvP8Hqhel_Q0gfCRTCS3_L2hA1KnRGk2AX5ThoLoO6Flki5G7A-QrMl4zIz3dDMTMvbyJ_QzS10gtEs-hsyQ
Protocol: H2
Server: 69.192.221.72 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-221-72.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

expires: Sun, 25 Dec 2022 04:32:57 GMT
pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEM90pRF5iHPL_t4vEBMdOic&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 71F4
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YWQ1M2U4YmMtYjkwMC00ZDZkLWI1MWQtNjgzMmZkYzZmZjVk

170 B
188 B

278ms
276ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YWQ1M2U4YmMtYjkwMC00ZDZkLWI1MWQtNjgzMmZkYzZmZjVk

Requested by

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
server: akka-http/10.2.9
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YWQ1M2U4YmMtYjkwMC00ZDZkLWI1MWQtNjgzMmZkYzZmZjVk
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Sun, 25 Dec 2022 04:32:57 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame E07D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGGAqEL26bi_MYZiyUCHh-8&google_cver=1

43 B
61 B

368ms
242ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGGAqEL26bi_MYZiyUCHh-8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLuEFBCarKQBGMjD5NsBMAE&v=APEucNWjTDg2SGQztJwNQaQmwOih33jAX-lMxQvpkilOHmR490qCyHCNoO9ePHxlEym-hePAM3S-eVk5Fp0eVTaLbVY8sn_onA
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:56 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGGAqEL26bi_MYZiyUCHh-8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E07D
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWQzOWMzMmMtZTBhYi0yMDA5LWNmMmQtNmQ0NWQ2Yzg1ZmE3

170 B
188 B

277ms
277ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWQzOWMzMmMtZTBhYi0yMDA5LWNmMmQtNmQ0NWQ2Yzg1ZmE3

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLuEFBCarKQBGMjD5NsBMAE&v=APEucNWjTDg2SGQztJwNQaQmwOih33jAX-lMxQvpkilOHmR490qCyHCNoO9ePHxlEym-hePAM3S-eVk5Fp0eVTaLbVY8sn_onA

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 25 Dec 2022 04:32:56 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWQzOWMzMmMtZTBhYi0yMDA5LWNmMmQtNmQ0NWQ2Yzg1ZmE3
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

um
sync.teads.tv/ Frame E07D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEM90pRF5iHPL_t4vEBMdOic&google_cver=1

23 B
172 B

1191ms
420ms

Image
image/gif

69.192.221.72
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEM90pRF5iHPL_t4vEBMdOic&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLuEFBCarKQBGMjD5NsBMAE&v=APEucNWjTDg2SGQztJwNQaQmwOih33jAX-lMxQvpkilOHmR490qCyHCNoO9ePHxlEym-hePAM3S-eVk5Fp0eVTaLbVY8sn_onA
Protocol: H2
Server: 69.192.221.72 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-221-72.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

expires: Sun, 25 Dec 2022 04:32:57 GMT
pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEM90pRF5iHPL_t4vEBMdOic&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E07D
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YWQ1M2U4YmMtYjkwMC00ZDZkLWI1MWQtNjgzMmZkYzZmZjVk

170 B
188 B

277ms
276ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YWQ1M2U4YmMtYjkwMC00ZDZkLWI1MWQtNjgzMmZkYzZmZjVk

Requested by

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
server: akka-http/10.2.9
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YWQ1M2U4YmMtYjkwMC00ZDZkLWI1MWQtNjgzMmZkYzZmZjVk
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Sun, 25 Dec 2022 04:32:57 GMT

GET
H2

200

sync
partners.tremorhub.com/ Frame BCE2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm
https://partners.tremorhub.com/sync?UIGL=CAESEIT-g-_zucNuCLVkCr2ksWQ&google_cver=1

43 B
183 B

1010ms
335ms

Image
image/gif

52.200.195.253
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIGL=CAESEIT-g-_zucNuCLVkCr2ksWQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYu8Do0gEwAQ&v=APEucNVfeFPvJXG0uzoAHSEbVn6iPc8l88_52pqqRB1C6yDVSo_9vD3VDfr2S9zLY5m9dpDj6QldGu4SGYBKHnsPkJY334tzAQ
Protocol: H2
Server: 52.200.195.253 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-200-195-253.compute-1.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Sun, 25 Dec 2022 04:32:57 GMT
server: Apache-Coyote/1.1
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://partners.tremorhub.com/sync?UIGL=CAESEIT-g-_zucNuCLVkCr2ksWQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 283
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame BCE2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEFjZuLPZBxL7kKKvKd4cw4Y&google_cver=1
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEFjZuLPZBxL7kKKvKd4cw4Y&google_cver=1&__user_check__=1&sync_id=34c00dae-840d-11ed-bafb-165a26370107

43 B
548 B

236ms
236ms

Image
image/gif

103.71.26.126
SPOTX-AS-AP SpotX...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEFjZuLPZBxL7kKKvKd4cw4Y&google_cver=1&__user_check__=1&sync_id=34c00dae-840d-11ed-bafb-165a26370107
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYu8Do0gEwAQ&v=APEucNVfeFPvJXG0uzoAHSEbVn6iPc8l88_52pqqRB1C6yDVSo_9vD3VDfr2S9zLY5m9dpDj6QldGu4SGYBKHnsPkJY334tzAQ
Protocol: HTTP/1.1
Server: 103.71.26.126 , Singapore, ASN132134 (SPOTX-AS-AP SpotXchange, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:57 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 58
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Sun, 25 Dec 2022 04:32:57 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: /partner?adv_id=7025&uid=CAESEFjZuLPZBxL7kKKvKd4cw4Y&google_cver=1&__user_check__=1&sync_id=34c00dae-840d-11ed-bafb-165a26370107
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 2
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BCE2
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MzRiYjA1MTYtODQwZC0xMWVkLTk2NTEtMTgzZTQ4YzIwNTA3

170 B
188 B

276ms
276ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MzRiYjA1MTYtODQwZC0xMWVkLTk2NTEtMTgzZTQ4YzIwNTA3

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CInSVRCfg1YYu8Do0gEwAQ&v=APEucNVfeFPvJXG0uzoAHSEbVn6iPc8l88_52pqqRB1C6yDVSo_9vD3VDfr2S9zLY5m9dpDj6QldGu4SGYBKHnsPkJY334tzAQ

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sun, 25 Dec 2022 04:32:57 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MzRiYjA1MTYtODQwZC0xMWVkLTk2NTEtMTgzZTQ4YzIwNTA3
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 90
Connection: keep-alive
Content-Length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 931A 0
0 277ms
277ms Image
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221207&jk=1843228990856770&bg=!0tGl0ZXNAAYgquz3AKo7ACkAdvg8WmScAsbBe9LxYBUHQAKwuAl5-daguVoF0TO5mX5Ti-UChkAoEQIAAABKUgAAAANoAQeZAuRubmdpqwL3rDqVm6L-e_DRrhZt1jpPNwSYpToBEMYmDy-UYGVJ38l0lOucROqItMypP4OZJ8mryIn1m_QVE8B2c3KOXUY8BgQID8VrT8AETaxYUXny91qi_HjEjrUeOP0m9BW3Qz_ssEamGiA3CFaIM4TC-O-EIxREuKAe-HihvlWboXbSmvuQIwojvfqkj64AY1k6khV6GWe4mHdhSx4a2IULk2hQK9hK_7h32Pbkb6KW1IJYK2MlXu-wdWzoz2MTajp7TQuFUzu26_WGepYV74RjApfkx9IcfWtXxwM3sEzd9OSV7GPFyd_hSTiOWddWJ0tnlDkptblG1hOQ7ERCC1TpfEHqrV5CXz-dpL4fs8wZ_qexZXu294NknIRnDssP1Zx_rp8358LmiGYFjvXNwsioSOR3v6D4UhaQ_nkdvyQcdNiXgXAJB7UJUJkyLAekShrKZxZAZwRO1HeQwpknZlJSfLUeoPGEBpMOT3aTe5vi_N1jDmej0w0xbk3FaZUEcdDIVPXGM_GNvrf3TC9k_o3XM87M-Tn40Yw4B704kHw3HcLsctrN5EpVz4XziX_wvB7Ng7ItrniHPXAkfhFDLA4YDBVmHy6PD6A3ZlU51xL1nW3vA0r2SA-N4bJFAPcnpQmzT55_lCKHdZn6TAp7sTLTdBywBq57-86wRaeyklUqeEKqkus2aIKyuHc0Gj3euu9yAuMsmZi2rmc12sWlOAhwJDxd2ijjSCc1t1TTyC3427lneYafSVQzxnw4869_jSEYBjBOxkY15Ut3N1EtQsTYcrKiDrDvgmCXqo-CzmjdGoZtq7zLcMjcNvG8cQ7bPg2Jez7tMC29bPanY-WvmBOsb1jdNGZwoSKTtg7lLYV3udTtwa-LBsxKB2V4C28BlyIZ--0DBu0pOBUPEl16OHT15b7liYBsiZ_BGhrpWLv7Pjsyx7ljIKYgER0PEnhWz5vx2PkOHL9t9bCYPci66mBY6w
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://adx.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C984 41 KB
15 KB 272ms
272ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BkyPtBOG2R2NGXZOXHMHMUi1-Ny9jEF_SVTFzlOEep8LnMqWwDj6lDO1YNRkeuFGAx6BAkbLKKyxQOSXSVSRf3XR_Kn41vJOHPaikxoN99ojIXLkBUDqHTVhnXjH4O5rTtN_qvlUujg4JABtFFxKJWkU9UahM4nZQeul4mz1s9lM-wIZs&cry=1&dbm_d=AKAmf-DShUy4bN5mV7cTvm81HHrItY5sdKFYEcEQYsZDLSz4Y1SV0piEAwQAyRRdw3JxOBhbB3o2P7d8PfXZBZixtFMPMF-5wQtu5g-XgvcV4jt6FFy31mWxEDKPjA8JDi0_mMUB6gqkpzd14QFyDj1cxX1LADlSc6td5m0N-FippDzb2EQ9IgBfa8ZD6sEqimKemrgMJuvjIKaBqM2B6Fe-G2mK05vLWLmW3gJGbJK7NuKgcsT-9epf9VWaKPft82YhkepWfoyP1GLyceG77mBLF6teUxXzeomYiYCId1AKKylkyNm-upH-e4ora_mx8ZCfnz2Ts2iwC6_-Ij2YwVGGiHVm43bDS9s35aWTmV1YFvtY8mv308Pg91--4w0YqFvWdzc5QXFULCJZJcw6Gh9AwqhqkWTUdWxOAksYNRMup8OHkLvO_IhT3feRNN3LXWp3j8-eQSW_zmKnsITmdTcvz22qvq-RlEAm5hVcG0v0OuBAq6vyfyqQWQTuFx_lC7yd3ZIQ4x_D7G3_Ao0epwvwlyGRgmeGlOFGp-_vzjTYVfadWtCeUTydD_0F8tONXf9dzWTXoxNQwIqgJJk59GLNVgS29O8Q6sgm99DUUnk3zWSvprdS9BwsoTQc9sM6YRGdq9jajdWUXx4kdqrUcBKQRE4JpmHAdKH9JQX1tf0qF5wfPovOQz49Q36j1NYgMg2IxJOW8oRR1-7xl7QJGuyA66frID1_4yBZRtJkBcL34yNFNt-PdYijSR0IEGbJarMeoxKQ4iGZAhC4V0W0PHoESaaRY6dfTvy6jpUUwF1z-_RJqTGA7nx6D8FXcTA4hKG-fVjGFiwOZK5yxPZUpSJK5_4r8iaFknmZbEMsygKDZTuxtwi9tOFp6YkQR0CMx8WjBqcfrCuIF7uKlm_aVM1P9sQ-NZDU5Fr2AbypllpfYeYMdOFU0X7m6rE7MedBpWdOxMSE0kF51lzktajN-6TzJRAxlfRqy5iufyEvktwVFnqQoE0LshkTlSi_j9dvZYb46-6TVpXwsiqm3RSvj4ekykY_55ohViM2rB_gCVIbnXxLxDTyKoJzZQhdgjKCFuDZN9FaC1uOQeuvIFL_CKAa9US1FZzTKvlXxSsTTWuc2b2YC_aJ3DzeLg6Ru4pewKE_o4w9wlqdytTepLSQcBxdufwsXWw6nZFid_9b1RD0IYaA5uIiWLKxcVcekUorb50jnXnJzrnyaUxtSUlRh79gRpVRk_AHl4XDX_ME_W7YoX9XUBgPmsWsNgXXk3xAywGHh2Z4rCBLfDkL3a1KcWTBTmQcLxBRs5zIEbUEz1P4Ax-J9xU2beASZ4rcEW--J-gMYZ4aF8OSXAv3Y5VaHonw5fZH8OWbfFFspfZYeTULO0aigSJG2dNApEugZuZd205UbjHYlwVEt0hpHcHTTau7gd13qsPFssED2EkJqWYg8-B_UIWm5qWtYNdJzL8w9d9JGNrAjie6k_Rg6XrK6HoThryCxCgEt2BIjfXNHzeTIunk6LqZKE1-EjJJj9O3Zu27IB3iKyZzg61Yr1ITKVZhbChi7kOvk8fKJNCIpY3I8PmEjjfv_d_A1r5hhko3Epp5Pr7g70-oqY1zUQKE-dYiiatKk9r77H-eTclHIscnROxcTUuRbihJObvviuDIm3r9Z1qFyHQZaXRnwlUp-qdkVzZATRYlpbCaVf4-5K8DJ_0MR48f2CTjuXyhFJ6nVVE2nO-3CfpoKBmG_8GpXrMSTAzVQMw3hgOgUqbUK2yLKhs_4f1dPo9ry8sUKNjfKx_3bptVAo6ucQBsKw968XfYO6xBTofS1mklh7aun6jaKOsiwTsCp9avHkq5z67O69m4CPOPM2KR6IZ8iCaDFEI4IcrdPBLfu80FO9vDoHRNukmzFNu6we5MzzL0R8oWa0rCCNVHgkr9m5sfXIZ5U5rCr11HX4gBDBhoa8YaocOXvpJMEINPK72qpzpVbP64w8v2J66-DFRQ0l_DxCkS4_bX3rvGUp4cZ1nxv9T9OBF2h5uxP_3tl7BjujjiZ_RAPSnHtZ7x-oQ_OwQ-XHvZ77SqFU5mHoUgxx7KXJqHG--wQ76rcn5qfUXj93f7OYwUQMfs9Gd9WO0rAMR7StP7JpSz2iwWFg0TGyhrGM0I_S4GmARe0GkmxL5T7I_qv3Uk799_uoCp33TLcqWizHGizmenoizAa-eWkj-UZZ4-v_rf00A-L6VpsLnnb7p6BsGXDyk1GjYP4sPOte6HA6DVJV3XN66GdrkJEaHbeoH0vjbMoUi9Gi33TRMbhDY7UR-gEvRES433SmC9w05sgK2M5vSoMfQvyOPFYP5agt_BOaVQXY5oXkE6tpzPgRjZYXC4ip7XDjf9aF7xr0UzrO05SCh9ZSxTPvG0GdCxNB9iRqql8xGpchjO1lE5qQJqMtCxpB2hdXX_OHftxU6RWepYnZ_XbG9s3ujTLhWziUBq3ShGGdK9yOMypR2RdnzNa7_7CLA2VMLIwJf3jpy5AZ_-6H47BtwIAWbHUJsEVlIuMftF5lAhZuE69Y7O3THMqhc7pwOcJR5TOxDevSKij9WvIGgXQIXYz6Vx9jW-XRbuFHr2HJSYZ4v07xtJnxANiUP5l0wyHu1NoL1WwgsOUePkXtCyjO22WfxSGkOF5VAyAzFTqFQfWq_-jbyfukg7_PEB8FQJpX1AXf2eIQ1GMkVMcKf9EA2WwDOHrFXStVJtXA6sKoFOdTC3tb1OsBWWYBk9j1nUgKyFiFB2K_eBJSoVzZ8WCT-TQepP1gNcB1Jo7m2a0zfqIE_sB0GnLKK7SIbpzkMgYcPZkz3yPAt1UB-B-Q_CxSXrjxKSDUUF_IAXSNAWvJtZsPyU9JJMWiGvbEkqETH9vB59GbE1L1iKKjAkyB4QjWYvSM6TBUsP98gCq9nE1aIkYT_fCmGsIlJJ9TB-GetyYPOOaIryhCtBEYdMIC9c8uoAMc1fwtOUZaJda8hwtB2hmmHbsgGfKV0H5KAwv_BlHgon_cPhOuX5dJPbIkAyF0dMXKIuvnzSCOfZ-G3NdgWFAjRbbwYRjDDF98sHtk3R8ITYHTlmZfE8ByL7y4KkRb1nwDCnL7EGRa7Qk750px2FbAOyCkyVaL_KoTvalhL06BJYQjZj06q4qgmARQfpX_-E9r6hm93keL7DXk4iZx9znhMebT28F22krL2Q-1KeUwdwACs-LvqQtI6yU96_1nma5lM2UbU8FlZvPaSgXmiKC_yyL_CQsG_KSYyeoilFI4UfdmhU1k3s09tlkb8sNUTVaZr3UId7zOkXs-0esDrJftpdhIPN2nZRf49svO7LeC1rPrGSrm6d3s5by8dGNE0isZhw_rBjTvcKCjY4QftjeQESmlI-zI35k53p4d7mvQwCAUK2jpWhXzw026aeGbNa5Kcy3suGKN_jESbr_41FPPUNYuvWIJ2rDNLgubTOlMa6QWQhVE4pwtLUFLlpNQWRKJryPALW7EuxwvZJ0e3F9QwTSOn_FUGNh1Fp5JSAQIi1kWkvsMasIyZNOlmrdtgDQx0q0vWL01TcM-2HTJ4EXeviyTlQsk3ueFH9UMRYbD__JQY77KcJJASUBQTzxcSH5qkH5w&cid=CAQSPADq26N9Jee0olqkCnYexCxgdrKogFvE5EuF1hJqXSwNVXUZjhZH-mpDCe_y3Odx4GfP560bpwmgUOyhUBgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Dec 2022 20:16:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202587
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:16:29 GMT

GET
H/1.1 200
OK dvbs_src_internal115.js Show response
cdn.doubleverify.com/ Frame C984 59 KB
19 KB 277ms
276ms Script
application/javascript 23.50.117.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal115.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115843&plc=6419358&sid=18330&dvregion=0&unit=300x250&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0jjEdrLbI5D-dLfjSzFmk8T&DVP_DBM_1=3060631&DVP_DBM_2=23009949&DVP_DBM_3=16740933992&DVP_DBM_4=416816016&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=881479034793&turl=https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&DVP_PP_BUNDLE_ID=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.117.184 Jakarta, Indonesia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-50-117-184.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 4804c2aedacd4aeaa883f9ee68a46db16fca0019e321d2991ccc16531d57f7aa

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:56 GMT
Content-Encoding: gzip
Last-Modified: Tue, 20 Dec 2022 11:38:02 GMT
Server: Microsoft-IIS/10.0
ETag: "096c846714d91:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19510

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4C8E 0
0 278ms
278ms Image
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221207&jk=2435376668215380&bg=!i4iliMzNAAYgquz3AKo7ACkAdvg8WnyoKuYVFaN1VSH6Bv2os3bbWtMXpjzE-dg_TSG0TtEvKbToagIAAABPUgAAAAJoAQeZAvl_SUUGgEUFGTpadX7puIT9gtE0JKbMxBg871wertIoq5Dn4mbVcqzzVC6spvhZVudx3kVr1EKE6VPFV71c_oTwpvUMbniy4QTa76mzHCDIsR7pzyhjbh-sMP-PVamfW5ry6BVv_MqYI7abCwOIVIYivBpdh8Grpy-yy8DaI3mNbRbAVOctNGDnzHTSNFzHs4ybu5mxo7oZd14XEmYlzdvKRpwt3Yr77AtMgAZOyA7ZYbPg-0-aCgaeiOy-fxyfneXhPWMT6HxFYdOUh6DPfwa_JCvAc1IpHVYTGBZnarGXywaNcVPGzz9UW5HC7Hjo5pu5uq0Fcai_dwQSEJdH7rIi3jsQwUkQMAB_SDwsbIzmAvZCmFarn3vb8gUBW9a4bLP9IO2szup4L0DzFOPjDLkGZHoYEbjiPlI6FCCGDPAs5whs_-NXQFux5_JfQNv2DxRTpFAbiu8Ggp9YPgwwxM2pTGgyMg5kW23s-QYAd_-ZgDGk_NPI0RjvYm4BCitt4bigaUa207KZOOSJLB9SF5tPhF5GdmORYBOgbr9urnFfyf5Ktko1xdd1BraQp5_CxZWYPRMLLSRd55V8xUHtEXlv1DefHnusq-lHdXmiyXiokaJ0QNHBc-NtiUtABxK2O0xK4h6RVsqwGjn0xUmOSlvfGQn5_BxK8mOiZf-d99ZWOOD3P9-EfI1n27wKv9jLDe7jmbhNKh9KoSn68tJ0dagBIL4hBpazDmzgs4VKcNZMiJ2-4E0roTxhtNV5JYP4smKURMjR0YCQ6m8nXg7cUDwpmvIq4gDA3fl-u9DqgEngX0I6TJJ30lY10xKiNGQjR3YgepfRAWWNjuRHM3wGlT7GLFEEoWJFh9nvcUzeGFDuDZxHiFX7dJ-JcG1mVaKi0BFiKpcPQEub3xT50r3ERx0duksCE4nI-w3NphH1Pe37uklupRmFQkailvf7wios8gH29qQ-MnQMMarPk0F0RX7X9QDC4ublOOHzFfDQlTz-6s0zwoa1X6ltDA
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://adx.holmesmind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/ Frame A384 8 KB
3 KB 273ms
273ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=92.271;sz=300x250;u_sd=1;dc_adk=521587881;ord=6qwbd4;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=2,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=KEl.e8fSsW;stc=1;chaa=1;sttr=335;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 20:16:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29770
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Jan 2023 20:16:46 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A384 0
0 826ms
277ms Fetch
image/gif 74.125.68.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssfdm9KMY1qy8FoeHslJEoFMsELxR2cpa9dyL8zsup_zK9Mdz9wuOty4moytpmr18TGGUS5mOZdeClPFqPxRNC59NIBtrADcG6QRybuIeK5Viy6j7OvXuZRjsQtyB1vz9avHuiWKEAR34mNUVSlNk30lg&sai=AMfl-YSGDpaAaTXda0nsefr7Dndy6jg_Py3NMnCFcosxawtORqLGVjGGu06eAWu-9MC_wHnCbhjL5-vunPPBLOHORbiEHEqd8g5A36FEewJ0&sig=Cg0ArKJSzCENi4fWK1DvEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20221207.18813&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:57 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 25 Dec 2022 04:32:57 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A384 41 KB
15 KB 272ms
272ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Dec 2022 20:16:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202587
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:16:29 GMT

GET
H2 200 2418735279377567735
s0.2mdn.net/simgad/ Frame A384 47 KB
47 KB 275ms
272ms Image
image/jpeg 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/2418735279377567735

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

d22ae6bbaa3c79a6d31667177a7bf1b209536858fe3caf1a95a21af65d76f15b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Dec 2022 16:24:21 GMT
x-content-type-options: nosniff
age: 389315
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48252
x-xss-protection: 0
last-modified: Thu, 26 May 2022 20:28:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Dec 2023 16:24:21 GMT

GET
H/1.1 200
OK dv-measurements3326.js Show response
cdn.doubleverify.com/ Frame FF59 552 KB
106 KB 277ms
276ms Script
application/javascript 23.50.117.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements3326.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.117.184 Jakarta, Indonesia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-50-117-184.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: e23d1ed62c982ac7ccbdbf25ce5289b23facf4631028e662b1b092f62332f4cd

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:56 GMT
Content-Encoding: gzip
Last-Modified: Tue, 13 Dec 2022 08:24:20 GMT
Server: Microsoft-IIS/10.0
ETag: "052474ccced91:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 108149

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C8B8 1 KB
646 B 273ms
273ms Document
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 13239
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 00:52:17 GMT
etag: 48472445140208031
expires: Mon, 26 Dec 2022 00:52:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A384 153 KB
47 KB 421ms
420ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 25 Dec 2022 04:32:56 GMT

GET
DATA 200
OK truncated
/ Frame A384 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ad369b96756d3f3c3821c50c0cd2e6fc45a2c3c3deef32e36da91556b08049b9

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame C984 1 KB
903 B 242ms
241ms Script
text/javascript 34.149.43.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=0&jsCallback=__verify_callback_912536761905&jsTagObjCallback=__tagObject_callback_912536761905&num=6&ctx=1828362&cmp=115843&plc=6419358&sid=18330&advid=&adsrv=&unit=300x250&isdvvid=&uid=912536761905&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&nav_pltfrm=Win32&dvp_strhd=0.20&dvpx_strhd=0.20&brid=3&brver=89&bridua=3&dup=null&turl=https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&srcurlD=0&ssl=1&refD=1&htmlmsging=1&tstype=128&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0jjEdrLbI5D-dLfjSzFmk8T&DVP_DBM_1=3060631&DVP_DBM_2=23009949&DVP_DBM_3=16740933992&DVP_DBM_4=416816016&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=881479034793&DVP_PP_BUNDLE_ID=&prr=1&aUrlD=-1&m1=13&noc=4&fcifrms=10&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=163&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D38b%5D4%40TauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D38b%5D4%40Tar9EEADTbpTauTau_g_fhg7hfceg%602f__%60c7gaf4gd2d2%603b%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauHHH%5D38b%5D4%40Tau2TauJ%3A%3F8%5CE%3A%5C%3B%3A2%3F%5CK%3A%5CHF%5CDF%5CK2%40%5CH2%3F%5C%3E6%3A%5CD96%3F%5C42%3A%5CD92%40%5C%3FF%5CD9%3A%5C52%3A%5C52%5CI%3AF%5CI%3AF%5C492%3F8%5C%3E6%3A%5CEF%3A%5D9E%3E%3D&dvp_exetime=4.00&callbackName=__verify_callback_912536761905
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal115.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.43.113 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 113.43.149.34.bc.googleusercontent.com
Software: /
Resource Hash: a71edc9ea5b9a92c88496a7df009ba3c1a204332209f7e5033c88779a678199a

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:56 GMT
Content-Encoding: br
X-DV-Response: 1
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Expires: 12/24/2022 04:32:56

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9A6E 22 KB
8 KB 274ms
273ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 341070
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Dec 2022 05:48:26 GMT
expires: Thu, 21 Dec 2023 05:48:26 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame C8B8
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEI-T7kXQIixPSms10lpP4ms&google_cver=1&google_push=AavPq0N82vkCv8eI5TbC4jsyTRlJmQ15U1aXK86LS3PiSFJyr0Gb9W3mtYPGZAvdOlFS5SYSDcVGGar6vMwhaP74Qk7rI9Q43AJoe...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mzg3OTYwNzc2NDYxMDMzNDEzOA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEI-T7kXQIixPSms10lpP4ms&google_cver=1

43 B
398 B

265ms
264ms

Image
image/gif

50.116.239.135
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEI-T7kXQIixPSms10lpP4ms&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3216231935713038&format=400x250&w=400&h=250&ptt=12&adk=90073500&output=html&bc=7&to=ampa&pv=1&wgl=1&asnt=0-39904443701284981326&dff=sans-serif&prev_fmts=1600x96&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&ifi=2&pfx=0&pwprc=1037897477&adf=16789255&nhd=0&adx=1000&ady=3290&oid=2&is_amp=5&amp_v=2211302304002&d_imp=1&c=553004350&ga_hid=393509541&dt=1671942770306&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&bdt=5921&dtd=3&__amp_source_origin=https%3A%2F%2Fwww.bg3.co
Protocol: H2
Server: 50.116.239.135 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEI-T7kXQIixPSms10lpP4ms&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C8B8
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEO5hjz_-XDwd8RJ1wZhIBFY&google_cver=1&google_push=AavPq0O2qIEbRv_tTqTuGnTW3zPKZJMSER3ijhJdpjkYV6ZWhxvvkMKvsYQzzOt7gilaA45B9kh91SUMI9wKZQ38...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AavPq0O2qIEbRv_tTqTuGnTW3zPKZJMSER3ijhJdpjkYV6ZWhxvvkMKvsYQzzOt7gilaA45B9kh91SUMI9wKZQ387qzDoBXFKOui3Zr1eT5Ro0LeEzLU_D...

170 B
188 B

280ms
280ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AavPq0O2qIEbRv_tTqTuGnTW3zPKZJMSER3ijhJdpjkYV6ZWhxvvkMKvsYQzzOt7gilaA45B9kh91SUMI9wKZQ387qzDoBXFKOui3Zr1eT5Ro0LeEzLU_Dn8siJC46vGquEJxsljceXLMiP5H0Hp_llbkKmJ

Requested by

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sun, 25 Dec 2022 04:32:57 GMT
Server: MT3 277 3f0ad7a master hkg-pixel-x23 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AavPq0O2qIEbRv_tTqTuGnTW3zPKZJMSER3ijhJdpjkYV6ZWhxvvkMKvsYQzzOt7gilaA45B9kh91SUMI9wKZQ387qzDoBXFKOui3Zr1eT5Ro0LeEzLU_Dn8siJC46vGquEJxsljceXLMiP5H0Hp_llbkKmJ
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sun, 25 Dec 2022 04:32:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C8B8
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEDSXx6-lnRXdpRUkTICiQa8&google_cver=1&google_push=AavPq0OTuGyUoQNXh8DethXb_vE4t4FxTfgHUXKWA3NYneIwalTAIBNZr-wW25BFHjSJvx6ruihth6mR5UzsRYu1lr...
https://match.adsrvr.org/track/cmb/google?google_gid=CAESEDSXx6-lnRXdpRUkTICiQa8&google_cver=1&google_push=AavPq0OTuGyUoQNXh8DethXb_vE4t4FxTfgHUXKWA3NYneIwalTAIBNZr-wW25BFHjSJvx6ruihth6mR5UzsRYu1lr...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OWU0MzU2NzQtODFlNi00NWY3LTg5NzAtYzhjMzM3N2RlN2Vh&google_push&gdpr=0&gdpr_consent=&ttd_tdid=9e435674-81e6-45f7-8970-c8c3377de7ea

170 B
188 B

278ms
278ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OWU0MzU2NzQtODFlNi00NWY3LTg5NzAtYzhjMzM3N2RlN2Vh&google_push&gdpr=0&gdpr_consent=&ttd_tdid=9e435674-81e6-45f7-8970-c8c3377de7ea

Requested by

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OWU0MzU2NzQtODFlNi00NWY3LTg5NzAtYzhjMzM3N2RlN2Vh&google_push&gdpr=0&gdpr_consent=&ttd_tdid=9e435674-81e6-45f7-8970-c8c3377de7ea
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C8B8
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEPaSNnQT61fE8LOxWQ75Ejk&google_cver=1&google_push=AavPq0Pk_B2Oa8Gkj5YiOeuSLDQP7at6_nEOvN8_UXIiFiqRalg6w07XoM7TmY9kpHbrzhQ_RoTmx9ceP_vKfRb...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=DuzF68nfSE9cqWqPoIGDFXRaStA&google_push=AavPq0Pk_B2Oa8Gkj5YiOeuSLDQP7at6_nEOvN8_UXIiFiqRalg6w07XoM7TmY9kpHbrzhQ_RoTmx9ceP_vKfR...

170 B
189 B

277ms
277ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=DuzF68nfSE9cqWqPoIGDFXRaStA&google_push=AavPq0Pk_B2Oa8Gkj5YiOeuSLDQP7at6_nEOvN8_UXIiFiqRalg6w07XoM7TmY9kpHbrzhQ_RoTmx9ceP_vKfRbldURTuzv_vOccfueL2Kp2KOql3xeHxIbKR7vKvTwfvjx642Iel8oSFoP17Grxzuj-jxDgEA

Requested by

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=DuzF68nfSE9cqWqPoIGDFXRaStA&google_push=AavPq0Pk_B2Oa8Gkj5YiOeuSLDQP7at6_nEOvN8_UXIiFiqRalg6w07XoM7TmY9kpHbrzhQ_RoTmx9ceP_vKfRbldURTuzv_vOccfueL2Kp2KOql3xeHxIbKR7vKvTwfvjx642Iel8oSFoP17Grxzuj-jxDgEA
Date: Sun, 25 Dec 2022 04:32:57 GMT
Connection: keep-alive
Content-Length: 300
Content-Type: text/html; charset=utf-8

GET
H2

200

spacer.gif
an.yandex.ru/resource/ Frame C8B8
Redirect Chain

https://an.yandex.ru/mapuid/google/CAESEOWygUHWqSKNiLBKm6xqt_I?ext-param=AavPq0OHB7HCw21LihFTluszwDIA6PeoTGbcvZLUq28fLZOBlYT0S3Ac5QIBuh-btNIwXlkVkH_DTjVGaaGgNRUcavFSuNTKJve7yz6IBr27pnHbPfi6pf0AuSLb...
https://an.yandex.ru/mapuid/google/CAESEOWygUHWqSKNiLBKm6xqt_I?redir-setuniq=1&ext-param=AavPq0OHB7HCw21LihFTluszwDIA6PeoTGbcvZLUq28fLZOBlYT0S3Ac5QIBuh-btNIwXlkVkH_DTjVGaaGgNRUcavFSuNTKJve7yz6IBr27...
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESEOWygUHWqSKNiLBKm6xqt_I&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
https://an.yandex.ru/resource/spacer.gif

43 B
78 B

434ms
433ms

Image
image/gif

213.180.193.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/resource/spacer.gif

Requested by

Protocol

Server

213.180.193.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:58 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 18 Apr 2001 10:28:03 GMT
content-type: image/gif
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 10 Dec 2023 04:32:58 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://an.yandex.ru/resource/spacer.gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C8B8 0
12 B 275ms
273ms Image
text/html 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Kj0v_udc0HFF9mGDpEbTySZ1P0ZTYO0tfmHfLSROF2bPPAsPhHjfH9kVN9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:56 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C3EB 22 KB
8 KB 273ms
272ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 341070
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Dec 2022 05:48:26 GMT
expires: Thu, 21 Dec 2023 05:48:26 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 070F 106 KB
37 KB 820ms
272ms Script
text/javascript 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
Origin: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 14:39:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49993
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 14:39:44 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/ Frame 070F 8 KB
3 KB 273ms
272ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cc8b9vZMKgRBYrwQk8VVL48eZ0Lz7EOT-KwAoxCkj7Ty7Yk6yxsB_otBNMoVxVJYIJNtuEwXZ5nnmzIKH3seMVxrGbGCvSHMXNNaG-e66DPMsuvDErCgv4daJ3ZORHs3uL35-4y6WncxIP2FhzbTLKiRTfa_KbsOgetw4FIIug_zuEgx0&dbm_d=AKAmf-Aexl96Dj3DDlSlFlgd90j6l3J4RZEcxpDgPE3hUVb1WjKEgVAt9CqQjBRdMSvwiHf_rQU0SPsThMZXCTuN-Qk7VkigT0PddQvf4DpjUganb5IPOH2Nl6POQBpIqJTlC718kqVlTATqblZGuc5kk6OOJSJJUgswLXmhEDFDnw62YsjTmi7CZfqR8AWyl7nmgbp3zgTI8HnLtVkgStbDg8ugKqYNA4_yackDFUvgnJKU1OVxG5H4MNkCx1wwLVpuYpm1hmNZsk4ruuZcSgY231t_RNywzf3_lXyjMWZYT3TI2PDEmJD1u2ANw8Z-T9d5pEdbWtlGsJx5T5_JWPPuQWsdmC1-NUMI4bwpk6-bag26cHZR7qsgQ17Snc6GQOEV9ajxiAMe8lZSOve9C4aEIucPqwDIkhCm70-W6Yfs-g_nzMILtjG_OURVmLvG2llmkQcWGB-c4o1MSHmMTt6crxT0fkpjC61CIN3pAgQ0hSIcxVXFz5xV9ix9AOmgsRtWJ8lwfbrbArH3aZZY4UWA-_oI7XaX8jRws-3Xfx4gtH0ZcZSLaCnbvlbGjbC2HlfglE0SKUZxFzw92RiV7-iYrsfJbWXnOIqwF5mL4Kx6zogUfwQk0GfHVzw8QZuclcbZPoKfCL6QyIVqghGUbkMtlbobsh0Oc_zpdQeQ5n8sM9yndKyrA4YLi3BOHx1gTZayiyHc3sSlcQ-ozYxrku63cjhPb8mkB5eAraGNQCeI3xODpnXgB4Yoo406JsaPC_T3YEpOk_szt1eEXjg0tybgzqC07JNia8wJ2e4rvxFHuABx8lKlU8lrZlmWfys882OaiweEd3w579TcXAMdzRkBzOs-Q5yx4Zt_0lXAikQVmnLh2E1BWlA34B9LtdWFqfhUURa_dcW62K4CLpT70zLkKPczeZj1HBy_ZhJ2tzYt_RtbkxlLV04etAqjtW4yXLL9FYyAegAfx1RRkVdWJbMFpTmINt5oIoZGKJ4fBBh9vU5-r9aeA0klGIgj5uxlPJd-NP4OVvYRYhRlmwTxKzwHCFsywtokcY0a3iUdsAb2fa8raCX4A7z66Igf2ZUqWizjmctMqor2Qt_BQcol5aFg7w1BooI7B9ooO6gCROsPAnaFouEQVZDg6j_RLCnQo3URlntLyiWc_eslJbizqKyozAthVVbi3wByveAnd4rmNWa2G9rV1Te-zNBQhMKb2K-haeJlSdjLvDQF1Ov8DTPXM3kzB9-kV5zH9eH0kBUfxL-HNjhT7D_zhPiUYJY8_FA3VQiZHqcal2Pyc_vEw_kCATg5YrFlZUD95C0deGLkecZfjjrwwUdlwImd_9DCDQHy2e9d0iMWD1eX_HGaupFB-MlhYWQBuLHEcq_RaDZBefa1CNFCfzL0YhJ5BY9VX4gg0gUXV_FdWXLmRGPLhdM2z7KJWGk5myooFCFtdf2ROBHLCSOa4Id2DHxmhT0h6pL4rbjpaTmQAuPjlb3QGfoyVUflsPRU_yuBAxwzsdi5JSCHSsvgmevBglLZeRCBjVgIy1F0-pIdY2dhgRCZwg1fV-2gsvtnYxL2zQZPhlr0LNEjYq-k-eAcp-XjbKfupzEbNIGDt6gjVvUSiF2ssID2MkaH0wWuYL-xfQ788rExJC-KehNTOmKL3gRvLDrM-9sp92tKLYfBKAadlSH9vgXBPMh275NceMBFK-MhDjPwL-UGuBzCaUnxebQP5KIuDJLOEyzZOpVuV6I2OwhV6ZvBNB7JzMsBN5MOXW03r4sU-dP0Ljn14jTUZ1_FlllSRWGljce8jhPLwYFR9LugTuLkKXCM8Rt4HGXDScn0eTU9NTR1arKmr61Y8YpFE-wxuOokbfxpgcr0FTk93uiKvluWfaTe_5Yw0HyIPYHEEBJlWFw5O7tZddJv2a7NJlG4f4XwpDIdZmDk0fTYKB4IaJwN757CaPLcfSV2gXKJnq45HG2j5fVZEGuvh1kDkAs7Bff91dUPAA9WaCJp5T3HMrUqG7AwBGQh9rJloDkgTiqAxBrCsZ1dgCZxE2xpsufmIJ-xRNskRI5lIhUWIjbfsrW606BASJyl080ZarmVz0IGCQnQUn5uT3lmUmCZhyjQcJxR_BzkBm48karHfzVAoLCXbhjoBnmGeOF5TPC66HmqCPRF2kENrjQLNzeq1DV2I2WJj75hllrmRQ3f0eVO0UwX--QTaZM2vK69U1bohGnB8Pcyh8un9TyzFeXc_bJQi1p02gSg1l0WdR9vPiKfvZ52NYAzV0D7Qdw8C82Ul5S60RhZdzb4SAqvSS4cYYH1kNGhDT41OXl9ghxyfUJ-O5zzmD5sludpAE60iwuXxyb-pg77X4hmgbikUT6kzToZNgPRaD3TNrN-wwuNqLXTUUm8qK4lBLEGEzG0cA_gzafhW2_eN6f0mbFaO_mrW1mezwucsry-cUjXT1U22O1Hu6tZJFlrz374hJdLtHz4KlzeMEkJDBczm4cK2GcPriV4O20Un59LPeWQDNBfw_iWU-cCnDVhf2tE81y-joOWng6SIId-h50_rQLmqLk814CKCKHCYaUzczJiORXWDPra9KmfYZkdwvqqmhSusta3W93oZmzk6zGYopJ4Jt83QSkV6apzgLeQrG0KGDTS_JOQKB4zjTSBwebnhjVfagr3q4za1u1vi6bNQAr6hoWKn-EpEREc-eRhZO1xQJH93ipZZ3--ZoiETZHmJ_z8jgMDtZVr1U_SgIEI-zlhmQRyR7nhpFMlFbiUppphgYvGjNkhk6NfIgAoZSnaTxDxosx3oDVt5YW7AKY_6so-lRLlgXGG3G2twJgJA4OXhSfegdu7BmzS4ysHJ53dMZQoeU3glgMdrPhal9rh_Qg0nvQGhFf_V8785MY4aDrFEvYJDVkv9H95_CNB-ISuxnRjUq8r7o2aT5APLoQp3qTj8vtAVUBezSYR7fUdaR4zMnTWXFI6-ML1_rkIxXpni2cwrvJ6f7nU0xY5bQNEWGfmTd6EmxiyIVKF2CMN7rtAKxm4a3hGqsxPuK4gRUyNwgxXxLJZRUO0VbyCnlzFqT8IpJevrj1NxH2zFfGfglAs3BzYbAG6xvuzWNAOHs9hKbrunw2wpZxsXazO5ZhUmebDZ-WjLLhCRCPLVvLeEnbF_iGusrQoRuwFzt3ENcbeDvEOeZdMhXM75aCUyMarYAkl6NEzTlvqR0dwXyKuQVNrKJZuPlfgTIAH4ya0AYD_52js2xaV3UJSmJYi2cie-cM-Dk0scPJA8LsRGd1ecKB5S6yOVRtc1msHRB4ac5MdyI3pIHu2s-aNgD2B9HjGKj9ZdovccrwBz_ftht8gF1t1yBK00t7hWjtZuKIAM2k9WtW3BhkmXbrkffkvZSSjNOKUHIViaqUhteQB80OolTV1oZmpcMRTJONbiS3NMXeOiPrwuOxhj4WwrtIpDPkWGLYT7fNJI-2mZ5wFKoneNrpLlH6do3hsDhh_DzFNp0ovlji3nLlMy-vJpqUytwxPwjpV2bDyxN-z8ZiU0P0ASgc1emyLBHnsFjpbw4dCE3KTB0nBPw2_QHi6YOSte9JzrEPDYZ_dSY4_ECe5iaX6mIRXmBFJhqCpCHhjrhPXSokwoAs3aU7V4CMmPc0s4C3bcgc&cid=CAQSPADq26N9Jee0olqkCnYexCxgdrKogFvE5EuF1hJqXSwNVXUZjhZH-mpDCe_y3Odx4GfP560bpwmgUOyhUBgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 20:16:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29770
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Jan 2023 20:16:46 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/ Frame 070F 30 KB
11 KB 273ms
273ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4d60e53476012ab254ca2f3f479903a6be9ead3cb39a9ea353c51ec75c618c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 22:50:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 20551
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11387
x-xss-protection: 0
server: cafe
etag: 8197878782792770439
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Jan 2023 22:50:25 GMT

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame C984 28 KB
11 KB 274ms
273ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal115.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9406a92f81fad251295cd64386a8bb62ee7503f589ae1b96893faae2f4fcb18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:01:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1885
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10900
x-xss-protection: 0
last-modified: Wed, 09 Nov 2022 17:19:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Sun, 25 Dec 2022 05:01:31 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/ Frame 48D7 30 KB
11 KB 273ms
272ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DK2CAdgpjwBkKo0eBkm1VUeY7nxU6n3PXjtQ7j1NGNSyc6oxkGkA53d9Ft1TWZGaRSWmxQDYGi5BtjvQ55dpwGL-nqrQ&cry=1&dbm_d=AKAmf-AEPVqZVE4lWWl3kac06yt7wElBTIiNRnNOw60D69zxb9E8OJ2JeQb1JL8iRux7Vj9mRCKZAGkBtfRA13qrjR4hF842ZRJ5P2PB4bhrtfGiLMk2JO8ugwSpCeQDfuJd2tx8WH-tDdIvwWtIjbrXxRmsa8oq89dcaG5MvJnTkPXmfRhJd-Y5qZQgFyQG3ZJnKOndfF1ArtbYzTqpxdnVGs8gtX-mjxo-wVxjAKU_S4QpdcOAEjtST0yJ2fgc8XtNKz0pTIv6RQwOMv_UOrL0uZWTVz9ePjkvVvzSEVn5ZBfbSSM7qKBPLzvkU4qnv8RJcTzd4ivFix9qIHGdYJJAy-fmS9-5igpQWGdGBc6044s4ldOVZv-0Gn3WW7P-rI9QRF5GHwm9O_Qo8Voch7ft0Z3peY8u5lIIrNAM4ZKxhY75d9Fn2yL2lCteNyeURAJ0uT2_o2PDUQfwkoCArfx1jR8FHhfLi-nnr5rDia65AH4_EqaZmPmSbyCuUE72psVHZCNzfBh5AlNR6t-ujLOIGQus3lroyAQkNxIyGIUhd37il-q7q_S12OvjyCc_ycuRO-mLnFFY4cbHfY1yXhHliqJey8cNXM4NKc6Pqq3Xv8w3COHTQvh-Bnf55-qLYY_SW_z9c2_vLPzhMy2OFBYNKZLu6ihZLfHL8RzGpRMOfRfC9IRLTYltkI4ZSUatoA17ZTTXhI-XRybeq11ztf7RfJDktGRyNCq3lc5TSuB9vr6zQekrlQRRJLiS45KRxl_y9rz2HOGBs-52Bz5CChP2hzmUIiR-0p_WwnY4UzP0qbtAOZqYCrLeDL96q5_BO93f-PiFOFp9puaawNQZpKQhE1Cvv_i8AlnyPfXE4SHM0fU6PhEDm3UQek6fFsTtTKrDZceo5YJ4VHdNhBrALbTX6jnhKIpoQCuMEjYaho1Bgm9s43iXo3Cxz9ZfEiYzVSIDgoep5RjGdxtIKvDB02m-4ZGj9m6U4eu3aQc32kBmuQQjbOYnGq6r3VCL5AEnI_hLtQxhnkkQo3l8g5HfqzZeAYyhy51cu96iMoBZ_I9oaBHl9PW6XxSesSBJ2kiAfkepHSEku9rNcFVT2rvwaNIqpfcyqK1ic82Ej-tsYS9T9-lApZHq1yvv3ZT4OVsFYhc0a8Yllhkf8RbQIBRCuCsVPehFvX7mGdZsFi-K3VSdeovaYs6n2bC-sQGfxD5caMMpTXhXQRhPmYcfS1U9JvS6jEWv6GCYXNgp5-vhkQ4sfZWin41AQd0Ukufzowrc0Iz4YDNOvlvtWPQRjbu_3nYQTpqBZEAIeRW2jAWCbVQMn8lhDEK27UA3O3kT65QtkhIxEbk3VPJXeV7u4pBwHa3KDn5aXoisYfwWd2KntEKApDkCGKQjTCAnv76qd1ge_79Khl91GxOlyi5VZK8DBPoxbG1Ouhj-VBcCZjuR_e2GbLZCSIipx2HKaCKlqrOCp8PeDKwfLfuGCd_LEQDgTQQonxDw58Zo8aPy2BsvfIIf7uDLz2uzUbJ98fjH5LM6Zyk8WjYDjDFt5inA78eWs8OBqnNLFSAaNpC5Ezm1qWKSdusRjAfw6vRmm9UVVZe855YDsXJeB0tVTnYENaaNX3_EHTg0d9gUu6oI650LzsdJRlURB9jUMbhn-x9BjVIIfgcOmfWBjwOFk5SKMnroVpSR4CoXYAtR5brnw6LnrUh1W4AEhmwkvihv7YF0wss2lZ2f1E4HDvyV_55HuNVlMCR0d3CEc-OTvQZvlJqBImRuI6Fwu50Y-rZUqmXMPwtP3nEVKhM-ajyCRnAhsDl7-dxh2gCgH-Vibog8GHmBV5O3yKmyBq7iz09NvPmHfGeLdnD9HnAi5s8xRTQ_DJ59KMYYribw-cX9X8sf6iHQSUFvYcs7kWidEszkBkDlOwvErcQVcAfojA8qHah-Cti7Hnw5xMUdL2ZNW_xqtuTGzElc5HrQK1_HOGbYvXM7vvg6yh-4ol2ZP3lWjIrVYiMA1cdxt9KCvtG_vsm8bOR0fI5iM6ZYMCBNpduck-YEXUESdxxcqtHDUjV03gZ2jnSkL-XqgiCJvlT4M4SLUf9EJ4AVbeFPe-Pamk6awpcyJI12Bp_DDeW0COHK1h2433L3cQ1OreZnBFp6rumpi647zso1gRz2COLXFwGMdOlDu6iZxQNbsGrGoi3jR04cSCZ0bVpGEJKie_aAjXXvMiYnz_xywNTpbVej6by-CN-lhMQOf_EmueXS9ZDY8SqGA-7A_EXRdhG41G4VkU02nZUlT2ArVO8lVnnst1zn_KBHOb3ktbIvngD2T-7vV0a0vE7eXqfjH2QXvxdyDM-AqoXI-rzUAEbsvn0n7GKP3NW5ZB_ZiHtXQhKB_qP6_QXt1PYjT0kDnrcKgSMA4JfrstYoQMaluhflIsBkwe0H2uOCn8RHv7a8_yWk5mp6IsWl3mawbtVwqFQXIpTY2VimGLO4wKStmD0acatmo8Z3AjvIu4DxBtfkZiTpGEMm9_4Gsmz3Mm0ELrDId65WhwcoOdzBYkPNm_HHbinYTbCzionuF6aXcOykvD4iJjdZ57kLG6hsyIApat9tmrJAIZ2NNB8NSp6O2AZpZpCZOqzUxNs1-DYBsCQTyq97dnhczzSjEA_JYbSFWSIUNCK_nX2kET4kcJEwq4CffFihI25kyyoSnrZJ9EC3BhCbwzpQ9xlOwF5Iv0umehLrKm__dlwuYGG2qOXlxo4B6oFQXScrsfd2Awtf-QKUPNvkxKIqe9Msk531q6seDg48nghomV6H30s5Y6wbK3bRC6T2YamfG7c6mvT57dmh4OXfBRLmS4zday6UpI7HybZx5ZuZzsmQv3lYr_tOj5EplxZcaeLSlX_OGFegzKCQfJ-4jzy-lPwLdsAp1VXFsWaP97IO17TPE3d4CHZOyR3uYlFaamJ9Eb6a4QrvAYCm6Cj9cU8GAC5E_ZZdTGgYUOgx2996cK4MkEFn4nrGWnaF7vrHIeUPinwo3mD5jlcUtgP22ZusV9CRo80lx_r24JyiBUTUoN0dNlCTHbsgrO9O2Pq1C35jVHkLRGIouurJIFRM6vxkfAPNUQIALhifH_iObmwhj7JW5oTca5qlMAgBU0-qLOO5no4OPGk3CLtBGFDZi74iZqTtK0uUbKQ9-2-KwMebsI7hnFH9Jdl13UjkhMGwAWDypLs7T0DiOAClU-xNgNWoITxsvpB_I4cjGvOpfRVJvhARsSStQ0tuQZKAFmh-SELRFIj8BVCbWUzaZ9TH69coXIpQBbdLBYt25JorM0AT-kOVm_dersH7ECoiJ8L9omWBEGaeejhz6UFCN1kjzrFAsbKV823MesaQx8vZOZZCkqUKgzf07P_p0LpskJrXpaRO6ucFUPY2u_IcXUhla5rcnMvoTYXUoSpZfI4IzgsSlUbseWANBo9goMbaz5mt3nQ2jF9UTJA_i2DPZh0vgF3q5YfW7eE8KSxkGIAASVGjva6Mzwtl6vQQ9NDL_hW6jhl8ZyDkwaWSxcn3F9IjgQKUC8PPxROF8-qaS1UaJNNFZ3hQdA41IOvLxyRN30muNH0&cid=CAQSPADq26N9Jee0olqkCnYexCxgdrKogFvE5EuF1hJqXSwNVXUZjhZH-mpDCe_y3Odx4GfP560bpwmgUOyhUBgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4d60e53476012ab254ca2f3f479903a6be9ead3cb39a9ea353c51ec75c618c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 22:50:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 20551
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11387
x-xss-protection: 0
server: cafe
etag: 8197878782792770439
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Jan 2023 22:50:25 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/ Frame 48D7 8 KB
3 KB 279ms
278ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 20:16:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29770
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Jan 2023 20:16:46 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 48D7 0
0 410ms
286ms Fetch
image/gif 74.125.68.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssCygYfIwCEKEbnZ9WtW_-oeNonM6jxjMbjCFRTpUsVTR2tl3t4LavUGEVaYM4vnyktASVf2RI0n_IgNo5ojLZiPUNySxG9zHHFUn-vtNbTHY77HqG3cJwMosbUFUkUIufPHc7WdYti8W30A-xGN3olHMxkx70820GgsclOy33sC8DnJdMoIgZO35RquHiNjSPdzVoRSI71mSJj6raITxsxdurihmUS5spP37Wcze16jwDj9P0eHwhnbYMJSDO7f9upd-Ed3MUf5BIzVUBGQWZ-QeEoP-VuVhj3L8AsSWtNzrgouqCGYr_sgickLcaY0SmTUgPWsQdsLFde5_t6Ssv5VRFKgnGBYXmD8w9ZK9GG7OFEA5kM8CwTFTKfJLh5ZlJqb33TrTKPVk-3o1FCEb1uAuh6ygPuuQn5Ik2nGZH-PKGDNsGKb9ARZ1GAmjMiMjhStVV8OFFJZuc2Xfs6a7EgdjjHWBjNPuUxYFwFrTZcb3k-RJguBxkbzYdLFzdpgEONGnnINJAiOuTfmT4d4TnXpwy6Z3RvjT6_UyUOMPLt1GnbpcOuT0G9HZ69zCTYyVD44a7-ZtK-HaCxgnbumoer7b0GF5XYavK9IND3d_13YTF2CC-daZ2ITF6WGQb8Rp3w_8IBWMSoTBbXCYBL_WQq1HZyGHG0zPCQZS3g2npsGzr33ylXirlviFQUAVzlLB-ozdgclnQ3uSQDVA1GLyGyjJWcETx_MrRxWEBwhaPzZZ0RcWtoA8npEIrmQg1eXBJQI9_EtaQbeqc_I4d44EJKh9YdjI5iwFpYfQg4lW5TqQW5pf8BZwDZfnqvAHA3YtR2ERAHHrPz9EQqSH5mGO2qxEVfyU4cXiM0cqTauvbXaFqk962UTn46PE1l4qvI-MBHj7NSWNq3LKgbu_cJg5V7WaaKtfVx7kaTC2VroQrPBBjrPhNT339n3kQNO3h37LnDp0SRegDspudhCNhq1lkpb7NLkvqh6KDubuNePjjdym_wMbe2XPfQPrFXhHzKNTKz7-xs03r4M6PANdnNjRw7S2MQclPSkxyhX_MM5-nvRPKPUp8TUB53qa0RkrRaMFW9Hf1_7Ryobe0R7p5j-a2aAd4EPfyxcQBeWZtXTjWFmrxZoM7xsmvpn4QpHkEeeFYCV1DcX1UyKjMgKayUZ8hd76nIWUzfpVZ3TLLXrqyxfA2dmAKt0JZbhwhBBWCU4yKlvbo_w_MTLS0VS206CkyQ9uStWGtWPzckX81CSdk3_kHMruzyCq1DOhElQp2AYV4j4i2peEeqluyY7YRPfBW-P-CUt9pGuOj13luseJkWnP-GkcOX92V8hflYqMzWduxjOb7wYHr8xk-opGofeagmL8ytLe6dqLkV8BpiQvT-1Qa0IooayxhSKaY&sai=AMfl-YTMNiCAu8WQFdolBQy90m3yG_4DBpk5S5oIBNDOq4s4aUgm4NRwuAiYzOHXJs0PTO1QgLIRiQuMIa-tMgyk3Bh6xqADOCpqULqYyuRxF-pJeYvSRt9Q65wKALAVfMg2fGBKeTWsV1InfbG1G1hbOvW57r2zXKGxj8KSrByG437SiQErhjxkWg9p7byCNYbBQZIcWJ5q7CUsdgptegv3pL0eRQDFixI4BCmDcZpsvhpmSR5kcpNRLoeFPwuWS59DCncf85CEdredmvWgI16_MsOkTyrK2mluZjYn-PA&sig=Cg0ArKJSzKYz-OObpnCFEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20221207.49691&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 25 Dec 2022 04:32:57 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 25 Dec 2022 04:32:57 GMT

GET
H2 200 amt.js Show response
attentionxyz.com/55-15e40ad0/ Frame 48D7 107 KB
107 KB 748ms
269ms Script
binary/octet-stream 13.33.88.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://attentionxyz.com/55-15e40ad0/amt.js?tagLabel=MBM_NZ_cm360&attrAdvertiser=8643303&attrCampaign=28056354&attrSite=1589324&attrPlacement=353930039&attrCreative=183727314&attrAd=545167118&attr1=%edclid!&attr2=j
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DK2CAdgpjwBkKo0eBkm1VUeY7nxU6n3PXjtQ7j1NGNSyc6oxkGkA53d9Ft1TWZGaRSWmxQDYGi5BtjvQ55dpwGL-nqrQ&cry=1&dbm_d=AKAmf-AEPVqZVE4lWWl3kac06yt7wElBTIiNRnNOw60D69zxb9E8OJ2JeQb1JL8iRux7Vj9mRCKZAGkBtfRA13qrjR4hF842ZRJ5P2PB4bhrtfGiLMk2JO8ugwSpCeQDfuJd2tx8WH-tDdIvwWtIjbrXxRmsa8oq89dcaG5MvJnTkPXmfRhJd-Y5qZQgFyQG3ZJnKOndfF1ArtbYzTqpxdnVGs8gtX-mjxo-wVxjAKU_S4QpdcOAEjtST0yJ2fgc8XtNKz0pTIv6RQwOMv_UOrL0uZWTVz9ePjkvVvzSEVn5ZBfbSSM7qKBPLzvkU4qnv8RJcTzd4ivFix9qIHGdYJJAy-fmS9-5igpQWGdGBc6044s4ldOVZv-0Gn3WW7P-rI9QRF5GHwm9O_Qo8Voch7ft0Z3peY8u5lIIrNAM4ZKxhY75d9Fn2yL2lCteNyeURAJ0uT2_o2PDUQfwkoCArfx1jR8FHhfLi-nnr5rDia65AH4_EqaZmPmSbyCuUE72psVHZCNzfBh5AlNR6t-ujLOIGQus3lroyAQkNxIyGIUhd37il-q7q_S12OvjyCc_ycuRO-mLnFFY4cbHfY1yXhHliqJey8cNXM4NKc6Pqq3Xv8w3COHTQvh-Bnf55-qLYY_SW_z9c2_vLPzhMy2OFBYNKZLu6ihZLfHL8RzGpRMOfRfC9IRLTYltkI4ZSUatoA17ZTTXhI-XRybeq11ztf7RfJDktGRyNCq3lc5TSuB9vr6zQekrlQRRJLiS45KRxl_y9rz2HOGBs-52Bz5CChP2hzmUIiR-0p_WwnY4UzP0qbtAOZqYCrLeDL96q5_BO93f-PiFOFp9puaawNQZpKQhE1Cvv_i8AlnyPfXE4SHM0fU6PhEDm3UQek6fFsTtTKrDZceo5YJ4VHdNhBrALbTX6jnhKIpoQCuMEjYaho1Bgm9s43iXo3Cxz9ZfEiYzVSIDgoep5RjGdxtIKvDB02m-4ZGj9m6U4eu3aQc32kBmuQQjbOYnGq6r3VCL5AEnI_hLtQxhnkkQo3l8g5HfqzZeAYyhy51cu96iMoBZ_I9oaBHl9PW6XxSesSBJ2kiAfkepHSEku9rNcFVT2rvwaNIqpfcyqK1ic82Ej-tsYS9T9-lApZHq1yvv3ZT4OVsFYhc0a8Yllhkf8RbQIBRCuCsVPehFvX7mGdZsFi-K3VSdeovaYs6n2bC-sQGfxD5caMMpTXhXQRhPmYcfS1U9JvS6jEWv6GCYXNgp5-vhkQ4sfZWin41AQd0Ukufzowrc0Iz4YDNOvlvtWPQRjbu_3nYQTpqBZEAIeRW2jAWCbVQMn8lhDEK27UA3O3kT65QtkhIxEbk3VPJXeV7u4pBwHa3KDn5aXoisYfwWd2KntEKApDkCGKQjTCAnv76qd1ge_79Khl91GxOlyi5VZK8DBPoxbG1Ouhj-VBcCZjuR_e2GbLZCSIipx2HKaCKlqrOCp8PeDKwfLfuGCd_LEQDgTQQonxDw58Zo8aPy2BsvfIIf7uDLz2uzUbJ98fjH5LM6Zyk8WjYDjDFt5inA78eWs8OBqnNLFSAaNpC5Ezm1qWKSdusRjAfw6vRmm9UVVZe855YDsXJeB0tVTnYENaaNX3_EHTg0d9gUu6oI650LzsdJRlURB9jUMbhn-x9BjVIIfgcOmfWBjwOFk5SKMnroVpSR4CoXYAtR5brnw6LnrUh1W4AEhmwkvihv7YF0wss2lZ2f1E4HDvyV_55HuNVlMCR0d3CEc-OTvQZvlJqBImRuI6Fwu50Y-rZUqmXMPwtP3nEVKhM-ajyCRnAhsDl7-dxh2gCgH-Vibog8GHmBV5O3yKmyBq7iz09NvPmHfGeLdnD9HnAi5s8xRTQ_DJ59KMYYribw-cX9X8sf6iHQSUFvYcs7kWidEszkBkDlOwvErcQVcAfojA8qHah-Cti7Hnw5xMUdL2ZNW_xqtuTGzElc5HrQK1_HOGbYvXM7vvg6yh-4ol2ZP3lWjIrVYiMA1cdxt9KCvtG_vsm8bOR0fI5iM6ZYMCBNpduck-YEXUESdxxcqtHDUjV03gZ2jnSkL-XqgiCJvlT4M4SLUf9EJ4AVbeFPe-Pamk6awpcyJI12Bp_DDeW0COHK1h2433L3cQ1OreZnBFp6rumpi647zso1gRz2COLXFwGMdOlDu6iZxQNbsGrGoi3jR04cSCZ0bVpGEJKie_aAjXXvMiYnz_xywNTpbVej6by-CN-lhMQOf_EmueXS9ZDY8SqGA-7A_EXRdhG41G4VkU02nZUlT2ArVO8lVnnst1zn_KBHOb3ktbIvngD2T-7vV0a0vE7eXqfjH2QXvxdyDM-AqoXI-rzUAEbsvn0n7GKP3NW5ZB_ZiHtXQhKB_qP6_QXt1PYjT0kDnrcKgSMA4JfrstYoQMaluhflIsBkwe0H2uOCn8RHv7a8_yWk5mp6IsWl3mawbtVwqFQXIpTY2VimGLO4wKStmD0acatmo8Z3AjvIu4DxBtfkZiTpGEMm9_4Gsmz3Mm0ELrDId65WhwcoOdzBYkPNm_HHbinYTbCzionuF6aXcOykvD4iJjdZ57kLG6hsyIApat9tmrJAIZ2NNB8NSp6O2AZpZpCZOqzUxNs1-DYBsCQTyq97dnhczzSjEA_JYbSFWSIUNCK_nX2kET4kcJEwq4CffFihI25kyyoSnrZJ9EC3BhCbwzpQ9xlOwF5Iv0umehLrKm__dlwuYGG2qOXlxo4B6oFQXScrsfd2Awtf-QKUPNvkxKIqe9Msk531q6seDg48nghomV6H30s5Y6wbK3bRC6T2YamfG7c6mvT57dmh4OXfBRLmS4zday6UpI7HybZx5ZuZzsmQv3lYr_tOj5EplxZcaeLSlX_OGFegzKCQfJ-4jzy-lPwLdsAp1VXFsWaP97IO17TPE3d4CHZOyR3uYlFaamJ9Eb6a4QrvAYCm6Cj9cU8GAC5E_ZZdTGgYUOgx2996cK4MkEFn4nrGWnaF7vrHIeUPinwo3mD5jlcUtgP22ZusV9CRo80lx_r24JyiBUTUoN0dNlCTHbsgrO9O2Pq1C35jVHkLRGIouurJIFRM6vxkfAPNUQIALhifH_iObmwhj7JW5oTca5qlMAgBU0-qLOO5no4OPGk3CLtBGFDZi74iZqTtK0uUbKQ9-2-KwMebsI7hnFH9Jdl13UjkhMGwAWDypLs7T0DiOAClU-xNgNWoITxsvpB_I4cjGvOpfRVJvhARsSStQ0tuQZKAFmh-SELRFIj8BVCbWUzaZ9TH69coXIpQBbdLBYt25JorM0AT-kOVm_dersH7ECoiJ8L9omWBEGaeejhz6UFCN1kjzrFAsbKV823MesaQx8vZOZZCkqUKgzf07P_p0LpskJrXpaRO6ucFUPY2u_IcXUhla5rcnMvoTYXUoSpZfI4IzgsSlUbseWANBo9goMbaz5mt3nQ2jF9UTJA_i2DPZh0vgF3q5YfW7eE8KSxkGIAASVGjva6Mzwtl6vQQ9NDL_hW6jhl8ZyDkwaWSxcn3F9IjgQKUC8PPxROF8-qaS1UaJNNFZ3hQdA41IOvLxyRN30muNH0&cid=CAQSPADq26N9Jee0olqkCnYexCxgdrKogFvE5EuF1hJqXSwNVXUZjhZH-mpDCe_y3Odx4GfP560bpwmgUOyhUBgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.bg3.co%252F%240
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.88.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-88-34.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e7841380c5c4135f2d3d04e85969c1081f916995ab3b9b767f1f5c945fcf0719

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:02:48 GMT
via: 1.1 d349739893df3b59b8ea4953ff21a5e8.cloudfront.net (CloudFront)
last-modified: Sun, 25 Dec 2022 04:00:51 GMT
server: AmazonS3
x-amz-cf-pop: SIN2-P2
age: 1810
etag: "3e34ac3b9c13e32f5bc926351d2f2757"
x-cache: Hit from cloudfront
content-type: binary/octet-stream
accept-ranges: bytes
content-length: 109091
x-amz-cf-id: W9bibAy5Xz6q4MIN7AFzTHBxyEYLiAAUJHESTyAJHv2xujL-_7qerw==

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 48D7 41 KB
15 KB 272ms
272ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Dec 2022 20:16:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202588
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:16:29 GMT

GET
H2 200 17338607499348329757
s0.2mdn.net/simgad/ Frame 48D7 14 KB
14 KB 597ms
296ms Image
image/png 74.125.24.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/17338607499348329757

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f148.1e100.net

Software

sffe /

Resource Hash

f399441869c730b2765ee77efac88cbee848982887346cd32b4f550fb4ba913f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:57 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14321
x-xss-protection: 0
last-modified: Wed, 07 Dec 2022 01:03:47 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 25 Dec 2023 04:32:57 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A384 0
0 386ms
278ms Fetch
image/gif 74.125.68.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssfdm9KMY1qy8FoeHslJEoFMsELxR2cpa9dyL8zsup_zK9Mdz9wuOty4moytpmr18TGGUS5mOZdeClPFqPxRNC59NIBtrADcG6QRybuIeK5Viy6j7OvXuZRjsQtyB1vz9avHuiWKEAR34mNUVSlNk30lg&sai=AMfl-YSGDpaAaTXda0nsefr7Dndy6jg_Py3NMnCFcosxawtORqLGVjGGu06eAWu-9MC_wHnCbhjL5-vunPPBLOHORbiEHEqd8g5A36FEewJ0&sig=Cg0ArKJSzCENi4fWK1DvEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=442&vt=11&dtpt=441&dett=2&cstd=0&cisv=r20221207.18813&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:57 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 25 Dec 2022 04:32:57 GMT

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 9A6E 36 KB
16 KB 273ms
273ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 15:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48273
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 15:08:24 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 070F 41 KB
15 KB 272ms
272ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Dec 2022 20:16:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202588
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:16:29 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4E3D 1 KB
649 B 273ms
273ms Document
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 13240
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 00:52:17 GMT
etag: 48472445140208031
expires: Mon, 26 Dec 2022 00:52:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 070F 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 180803180482bff32a9817fb85e76d3eb49fe516596ec736765eb864e44f9a43

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame C3EB 36 KB
16 KB 273ms
273ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 15:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48273
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 15:08:24 GMT

GET
H3 200 impl_v92.js Show response
www.googletagservices.com/dcm/ Frame C984 60 KB
23 KB 274ms
273ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v92.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8acf96115cb55ad61bfdc24b7918a946d1b983ac14062a584dbbe8744021430a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 19:37:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32125
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23563
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 16:32:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 19:37:32 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 7F71 1 KB
649 B 273ms
272ms Document
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 13240
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 00:52:17 GMT
etag: 48472445140208031
expires: Mon, 26 Dec 2022 00:52:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 48D7 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d46c5fa61e61caa538f7b94e8133ab89358bf9675220a683140be6ecaebbf720

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9A6E 0
25 B 279ms
278ms Image
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BRtkfeNKnY_g3h9a_BNb8vMgGAAAAADgB4AQC&bg=!ZGelZyPNAAYgquz3AKo7ACkAdvg8WtnB1lxaBIuO6U_LIqCpW599Rjlc9yW7l9POQhiQGQd2Dky_0AIAAABUUgAAAAJoAQcKADgXwoBg_F-uUkyL-e3db9-kxPjukMRvE79ZMmV_ea_evWErmjueqBLSbj2DeaMQd76bvc0rq1-6CJkC7Es49Jhm2lEGvlODYtKTmYR5bOyEfdSZWxeUNAn9YOhAQ0Tl1YWIlPHTH2RcQZ2RrhEXbGkqXeZyy6nTxlTjjFb-0BEdimGuTeJdpVp7k85p2RiChryrtRa5ZDnUUCs3kdIjGc_Uw3RlnB9to-zP7X3RsSx4bV7dkL__BL-sy1xpMIVZYL4wgQcmBmL8opjVPME4zNunp03QGN86P4W29OBxwYw-DoUec9E2PamizdAZeEm_9-CKiSYsStz-UZ9rjhVnivDfpP-Z-Z3rhxX_34qOsGV0rUnONNEUVsZWBvZinuuc1KUfWuzfRYU0wflqtg7n5ohu4M0zpqDO_S693CLb2_s--TTwsLlZ1pbi6e95njcuy73Y__aMOUdlBOEZtBYDi7W7cC_4Ri_25r7SlsJyL1M3LXHxYorOlqsMYS_cWTWptyK3s7rixqsM0hwO4-FuRwMmUmJo4K-VvlSri7cTanx4A3HJHTi94n9jvxaCpFVOvo4RHhl_IEl0FgLXhg3pwBAmGYdR4WhXIiB1VCuzu-KH25840f3kBCOtHaXxO9o5rngw77AHevu3iuKwi_IghbXFF1-3y8NCNjg5Fb8cxoUePzYqKmd5hbu0_bWh231l4634L4NyY7f-BT7bih0zs0WNIr1cMiMXKD5T8ixhMjDJSVoaP9MnF-Q_iZtjM3sLmDJ37kbh4Whi1RGsbTVFM7YiPCiMQgvSD86oaKxp-xKY9u1gvq7GuX6KIdUa6CFL5cTsEHfbUFD3dSAAdXHauT9sTC4N0jIC7gxn9yIZPlVvgHdL5kGsYa6TKuCURQOCCeI2C4M5C9CiKd7Di3_pu1ZJTcCCs9AKD-mnAJpunSWU4808N4YTBefrYrfLv3dQfVMNRS96ac6XMkYc0jcmkD6qCAO4RqFh5p_K4zsJCFvvse-ss-ECoZhS09LtT_EcfapewnKoTG1evXuxe530G_ksMMIBrPpe6lW0OrQrakWSvsYSP6ZmvhA

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E3D
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEHP7AP6JvpcPnqvXGNohwcQ&google_cver=1&google_push=AavPq0MRJYOEFy9J9gTKPx4sqInXWc8dlZAfHoTQWfRieqgA5BQYKcKJZp...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AavPq0MRJYOEFy9J9gTKPx4sqInXWc8dlZAfHoTQWfRieqgA5BQYKcKJZpB6LM89UTVQsJUu1rNksHB1KdO8nTGt-U3htsXaML0WWLWTxePgYljEne-mj...

170 B
188 B

281ms
281ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AavPq0MRJYOEFy9J9gTKPx4sqInXWc8dlZAfHoTQWfRieqgA5BQYKcKJZpB6LM89UTVQsJUu1rNksHB1KdO8nTGt-U3htsXaML0WWLWTxePgYljEne-mjn4dmwe2f6wq82oMdazO6fWyuQc&google_hm=bXU3CA_yBhJdGqaIuolGeQ

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AavPq0MRJYOEFy9J9gTKPx4sqInXWc8dlZAfHoTQWfRieqgA5BQYKcKJZpB6LM89UTVQsJUu1rNksHB1KdO8nTGt-U3htsXaML0WWLWTxePgYljEne-mjn4dmwe2f6wq82oMdazO6fWyuQc&google_hm=bXU3CA_yBhJdGqaIuolGeQ
pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E3D
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEO5hjz_-XDwd8RJ1wZhIBFY&google_cver=1&google_push=AavPq0NL39kU8jpoay_whJSrH5Up8Ntfov_aI449vXE6dzc_V_WaP1T7H4jdPKfPN9_AIhiWcjJ0e3EdJrDF_guN...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AavPq0NL39kU8jpoay_whJSrH5Up8Ntfov_aI449vXE6dzc_V_WaP1T7H4jdPKfPN9_AIhiWcjJ0e3EdJrDF_guNoKCcdqnPcGaURcdQ-GaskjV-Y7SNNe...

170 B
188 B

277ms
277ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AavPq0NL39kU8jpoay_whJSrH5Up8Ntfov_aI449vXE6dzc_V_WaP1T7H4jdPKfPN9_AIhiWcjJ0e3EdJrDF_guNoKCcdqnPcGaURcdQ-GaskjV-Y7SNNeEwAw8xGQmXi631C1_1WGwFzq4z

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sun, 25 Dec 2022 04:32:57 GMT
Server: MT3 277 3f0ad7a master hkg-pixel-x24 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AavPq0NL39kU8jpoay_whJSrH5Up8Ntfov_aI449vXE6dzc_V_WaP1T7H4jdPKfPN9_AIhiWcjJ0e3EdJrDF_guNoKCcdqnPcGaURcdQ-GaskjV-Y7SNNeEwAw8xGQmXi631C1_1WGwFzq4z
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sun, 25 Dec 2022 04:32:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E3D
Redirect Chain

https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESECJu4uTwh001y_-rNsq9Rgk&google_cver=1&google_push=AavPq0OeScWGnWWEju1pyjzItVtHu86DwNiuIwyKboVKVEMgHGNWq6aS6-qMEObZ8SrYztuFxxc7jgyOBSXy7P...
https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AavPq0OeScWGnWWEju1pyjzItVtHu86DwNiuIwyKboVKVEMgHGNWq6aS6-qMEObZ8SrYztuFxxc7jgyOBSXy7PNeHmgadv81gr-mANK8bjjLn8bb3La_MoZUhmfL_lLr...

170 B
188 B

277ms
277ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AavPq0OeScWGnWWEju1pyjzItVtHu86DwNiuIwyKboVKVEMgHGNWq6aS6-qMEObZ8SrYztuFxxc7jgyOBSXy7PNeHmgadv81gr-mANK8bjjLn8bb3La_MoZUhmfL_lLrKLQsk8V_BeYyhZf9&google_hm=hmOn0nJFqdkCj7mmIQ&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D63A7D27245A9D9028FB9A621BLIS

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AavPq0OeScWGnWWEju1pyjzItVtHu86DwNiuIwyKboVKVEMgHGNWq6aS6-qMEObZ8SrYztuFxxc7jgyOBSXy7PNeHmgadv81gr-mANK8bjjLn8bb3La_MoZUhmfL_lLrKLQsk8V_BeYyhZf9&google_hm=hmOn0nJFqdkCj7mmIQ&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D63A7D27245A9D9028FB9A621BLIS
date: Sun, 25 Dec 2022 04:32:57 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E3D
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEN0hEsgXsKJrvjGCxW1FZ0s&google_cver=1&google_push=AavPq0OYIEihkRNmY0LWfNZDDj4nX0G7x6a5NqbnnEukiVboCPtv2egLBgFIFA_8bW12HHjUOz0_9wPN423TU7oWjp7d...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEN0hEsgXsKJrvjGCxW1FZ0s&google_cver=1&google_push=AavPq0OYIEihkRNmY0LWfNZDDj4nX0G7x6a5NqbnnEukiVboCPtv2egLBgFIFA_8bW12HHjUOz0_9wPN423TU7...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AavPq0OYIEihkRNmY0LWfNZDDj4nX0G7x6a5NqbnnEukiVboCPtv2egLBgFIFA_8bW12HHjUOz0_9wPN423TU7oWjp7d9nn4-EVGblNK0ln2v6NC9np5ukW4m8RG-2Gd0sDnh_...

170 B
189 B

277ms
276ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AavPq0OYIEihkRNmY0LWfNZDDj4nX0G7x6a5NqbnnEukiVboCPtv2egLBgFIFA_8bW12HHjUOz0_9wPN423TU7oWjp7d9nn4-EVGblNK0ln2v6NC9np5ukW4m8RG-2Gd0sDnh_5V_KcHYRG6&google_hm=vESXqLjJQhi5bo5TEZdmgQ==

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AavPq0OYIEihkRNmY0LWfNZDDj4nX0G7x6a5NqbnnEukiVboCPtv2egLBgFIFA_8bW12HHjUOz0_9wPN423TU7oWjp7d9nn4-EVGblNK0ln2v6NC9np5ukW4m8RG-2Gd0sDnh_5V_KcHYRG6&google_hm=vESXqLjJQhi5bo5TEZdmgQ==
Date: Sun, 25 Dec 2022 04:32:58 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E3D
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEMV-9Vp6-qjuN9sZFEf7Ak8&google_cver=1&google_push=AavPq0P97jZpzOdA1gLxee1mOOhD0JvNnllc1dkmpMFuwV0XEH6iMmB52LPcip6r29K7gl9ZiSZHFF1a_QYKvyLnMIY-kLf...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AavPq0P97jZpzOdA1gLxee1mOOhD0JvNnllc1dkmpMFuwV0XEH6iMmB52LPcip6r29K7gl9ZiSZHFF1a_QYKvyLnMIY-kLfS5TtTHrT9I96RPm3s4iLBhQ4F6fEjZV3oz4lcq...

170 B
189 B

277ms
276ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AavPq0P97jZpzOdA1gLxee1mOOhD0JvNnllc1dkmpMFuwV0XEH6iMmB52LPcip6r29K7gl9ZiSZHFF1a_QYKvyLnMIY-kLfS5TtTHrT9I96RPm3s4iLBhQ4F6fEjZV3oz4lcqOXReJHZsbg&google_hm=eS05MmNIb3U1RTJwR3JJMDlPZzBfc0VUTkpEMC5nLmwxUH5B

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 25 Dec 2022 04:32:57 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AavPq0P97jZpzOdA1gLxee1mOOhD0JvNnllc1dkmpMFuwV0XEH6iMmB52LPcip6r29K7gl9ZiSZHFF1a_QYKvyLnMIY-kLfS5TtTHrT9I96RPm3s4iLBhQ4F6fEjZV3oz4lcqOXReJHZsbg&google_hm=eS05MmNIb3U1RTJwR3JJMDlPZzBfc0VUTkpEMC5nLmwxUH5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E3D
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEPaSNnQT61fE8LOxWQ75Ejk&google_cver=1&google_push=AavPq0MMXWeJECJpNZ_7uIvnxCqKjRGCnxqBX1lZTVJwjgRA9SLJT6G39l74BHA1Khc2Bk2ER-r2SAGQbFauQxG...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=Ti21CDOyQhdyRMYs7irslnRaStA&google_push=AavPq0MMXWeJECJpNZ_7uIvnxCqKjRGCnxqBX1lZTVJwjgRA9SLJT6G39l74BHA1Khc2Bk2ER-r2SAGQbFauQx...

170 B
189 B

277ms
277ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=Ti21CDOyQhdyRMYs7irslnRaStA&google_push=AavPq0MMXWeJECJpNZ_7uIvnxCqKjRGCnxqBX1lZTVJwjgRA9SLJT6G39l74BHA1Khc2Bk2ER-r2SAGQbFauQxG7pHVREBP0K_5AMVhgJTzMo4FL_54p0iiLTEj1VlhxPj4Sm8K_R64knUw

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=Ti21CDOyQhdyRMYs7irslnRaStA&google_push=AavPq0MMXWeJECJpNZ_7uIvnxCqKjRGCnxqBX1lZTVJwjgRA9SLJT6G39l74BHA1Khc2Bk2ER-r2SAGQbFauQxG7pHVREBP0K_5AMVhgJTzMo4FL_54p0iiLTEj1VlhxPj4Sm8K_R64knUw
Date: Sun, 25 Dec 2022 04:32:58 GMT
Connection: keep-alive
Content-Length: 285
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E3D
Redirect Chain

https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEJ7SVQ3g6rUFAlIeR6XDy3U&google_cver=1&google_push=AavPq0PD0xnqdu8HSwB97rUEjRKF0QJbgFah3klJb_u0O67VwVF7BPYeG-sTOmi7N_y6L6Y2XaFcofhX...
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.e-volution.ai%2Fsync%3Fexchange%3D193%26google_gid%3DCAESEJ7SVQ3g6rUFAlIeR6XDy3U%26google_cver%3D1%26google_push%3DAavPq0PD0xnqdu8HSwB97r...
https://rtb2-useast.e-volution.ai/sync?adkuid=A900185678054796525&exchange=193&google_gid=CAESEJ7SVQ3g6rUFAlIeR6XDy3U&google_cver=1&google_push=AavPq0PD0xnqdu8HSwB97rUEjRKF0QJbgFah3klJb_u0O67VwVF7B...
https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTkwMDE4NTY3ODA1NDc5NjUyNQ&google_push=AavPq0PD0xnqdu8HSwB97rUEjRKF0QJbgFah3klJb_u0O67VwVF7BPYeG-sTOmi7N_y6L6Y2XaFcofhX...

170 B
192 B

277ms
277ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTkwMDE4NTY3ODA1NDc5NjUyNQ&google_push=AavPq0PD0xnqdu8HSwB97rUEjRKF0QJbgFah3klJb_u0O67VwVF7BPYeG-sTOmi7N_y6L6Y2XaFcofhX0yLy-mux1WHipffezaN7BM-u0-TZd2xyhRSxry-ky236BWXNrgpVzy1YY42vMqQjBg

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTkwMDE4NTY3ODA1NDc5NjUyNQ&google_push=AavPq0PD0xnqdu8HSwB97rUEjRKF0QJbgFah3klJb_u0O67VwVF7BPYeG-sTOmi7N_y6L6Y2XaFcofhX0yLy-mux1WHipffezaN7BM-u0-TZd2xyhRSxry-ky236BWXNrgpVzy1YY42vMqQjBg
Date: Sun, 25 Dec 2022 04:32:59 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4E3D 0
12 B 276ms
274ms Image
text/html 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K5_nmB5BvTnxBUXF4TN1TH8ZFJ3K7DTJZWt1wSIN_KBu-H8DtvhqP81u9n9AT7TnCZp1L7vQ

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:57 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 B9689862.280410797;dc_ver=92.271;sz=300x250;u_sd=1;dc_adk=2857193491;ord=0r15sy;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=bS2EV... Show response
ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/ Frame C984 53 KB
25 KB 304ms
304ms Script
text/javascript 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=92.271;sz=300x250;u_sd=1;dc_adk=2857193491;ord=0r15sy;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=bS2EV(Sz0u;stc=1;chaa=1;sttr=308;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v92.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83580817cec1d368b506366ba5cec1c7b1905d0643b2d9653cf77300461985ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25780
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 95F1 22 KB
8 KB 273ms
272ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 341071
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Dec 2022 05:48:26 GMT
expires: Thu, 21 Dec 2023 05:48:26 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7F71
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEDSXx6-lnRXdpRUkTICiQa8&google_cver=1&google_push=AavPq0PS2eljR13Aoa-SBOvqY0UYAKOU7bpOtdehmVYg0O6m6pZpq_hdZJVCqeDlUstgMTw3Za4kRcyYazv4bQ4ZsF...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OWU0MzU2NzQtODFlNi00NWY3LTg5NzAtYzhjMzM3N2RlN2Vh&google_push&gdpr=0&gdpr_consent=&ttd_tdid=9e435674-81e6-45f7-8970-c8c3377de7ea

170 B
188 B

278ms
278ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OWU0MzU2NzQtODFlNi00NWY3LTg5NzAtYzhjMzM3N2RlN2Vh&google_push&gdpr=0&gdpr_consent=&ttd_tdid=9e435674-81e6-45f7-8970-c8c3377de7ea

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OWU0MzU2NzQtODFlNi00NWY3LTg5NzAtYzhjMzM3N2RlN2Vh&google_push&gdpr=0&gdpr_consent=&ttd_tdid=9e435674-81e6-45f7-8970-c8c3377de7ea
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 423

GET n
v9999.adv.admeme.net/drtb/ Frame 7F71 0
0

GET

pixel
cm.g.doubleclick.net/ Frame 7F71
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEN0hEsgXsKJrvjGCxW1FZ0s&google_cver=1&google_push=AavPq0NAVqK_idti8_-KvHkq2bfOA0NcUlGjNXHxWsF8gxDNuCDrbM5t-NscbwQ-NtvvvEBUJ16cp2Kf5_Q6Jb_8XHtY...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEN0hEsgXsKJrvjGCxW1FZ0s&google_cver=1&google_push=AavPq0NAVqK_idti8_-KvHkq2bfOA0NcUlGjNXHxWsF8gxDNuCDrbM5t-NscbwQ-NtvvvEBUJ16cp2Kf5_Q6Jb...
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=google&bsw_custom_parameter=9f60581a-57f5-43d5-928e-bbfd1f31b6d0
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google&bsw_custom_parameter=9f60581a-57f5-43d5-928e-bbfd1f31b6d0
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=ab0f1b2f-5c10-406b-ac16-51cdace76ac0&user_group=1&ssp=google&bsw_param=9f60581a-57f5-43d5-928e-bbfd1f31b6d0
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AavPq0NAVqK_idti8_-KvHkq2bfOA0NcUlGjNXHxWsF8gxDNuCDrbM5t-NscbwQ-NtvvvEBUJ16cp2Kf5_Q6Jb_8XHtYwDmmM_zgfQ&google_hm=n2BYGlf1Q9WSjrv9HzG20A==

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7F71
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEPlSG02aAdHFdVv_f9MXpCM&google_cver=1&google_push=AavPq0PRcgnAlWsY--2RAfE6Svvc0hFuCum-FyctjlbHbf86mV83Es-pJZXJtJRpY6lMvFsJsEOz56Jy...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEPlSG02aAdHFdVv_f9MXpCM&google_cver=1&google_push=AavPq0PRcgnAlWsY--2RAfE6Svvc0hFuCum-FyctjlbHbf86mV83Es-pJZXJtJRpY6lMvFsJsEO...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODk5MjE2Mjk5NTMwMTc1MDgwNw&google_push=AavPq0PRcgnAlWsY--2RAfE6Svvc0hFuCum-FyctjlbHbf86mV83Es-pJZXJtJRpY6lMvFsJsEOz56...

170 B
189 B

278ms
277ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODk5MjE2Mjk5NTMwMTc1MDgwNw&google_push=AavPq0PRcgnAlWsY--2RAfE6Svvc0hFuCum-FyctjlbHbf86mV83Es-pJZXJtJRpY6lMvFsJsEOz56JyUi22Pumrj0Q7HgTJ4NVzQQ

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODk5MjE2Mjk5NTMwMTc1MDgwNw&google_push=AavPq0PRcgnAlWsY--2RAfE6Svvc0hFuCum-FyctjlbHbf86mV83Es-pJZXJtJRpY6lMvFsJsEOz56JyUi22Pumrj0Q7HgTJ4NVzQQ
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7F71
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEPaSNnQT61fE8LOxWQ75Ejk&google_cver=1&google_push=AavPq0Obo1dMKsBBMYVMZEE9eGdeRX9j-hAqCnM9KvZXHBH7Y3Fw4Y442Ny39GfkMaxeMIM1JSKZSa3ZpUXyb14...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=dLyDWw4HSdtOO6VGJ5TyAHRaStA&google_push=AavPq0Obo1dMKsBBMYVMZEE9eGdeRX9j-hAqCnM9KvZXHBH7Y3Fw4Y442Ny39GfkMaxeMIM1JSKZSa3ZpUXyb1...

170 B
189 B

277ms
277ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=dLyDWw4HSdtOO6VGJ5TyAHRaStA&google_push=AavPq0Obo1dMKsBBMYVMZEE9eGdeRX9j-hAqCnM9KvZXHBH7Y3Fw4Y442Ny39GfkMaxeMIM1JSKZSa3ZpUXyb14bqQf8JWFyd1FgXw

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=dLyDWw4HSdtOO6VGJ5TyAHRaStA&google_push=AavPq0Obo1dMKsBBMYVMZEE9eGdeRX9j-hAqCnM9KvZXHBH7Y3Fw4Y442Ny39GfkMaxeMIM1JSKZSa3ZpUXyb14bqQf8JWFyd1FgXw
Date: Sun, 25 Dec 2022 04:32:58 GMT
Connection: keep-alive
Content-Length: 244
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7F71
Redirect Chain

https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEJ7SVQ3g6rUFAlIeR6XDy3U&google_cver=1&google_push=AavPq0OwlDfBp1HzLHUd62TECowtMxzkrP12RMXiF20y4ukROMGlGv7-TZKvXLWDWG-A62rU933S8JJs...
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.e-volution.ai%2Fsync%3Fexchange%3D193%26google_gid%3DCAESEJ7SVQ3g6rUFAlIeR6XDy3U%26google_cver%3D1%26google_push%3DAavPq0OwlDfBp1HzLHUd62...
https://rtb2-useast.e-volution.ai/sync?adkuid=A8907079498916590916&exchange=193&google_gid=CAESEJ7SVQ3g6rUFAlIeR6XDy3U&google_cver=1&google_push=AavPq0OwlDfBp1HzLHUd62TECowtMxzkrP12RMXiF20y4ukROMGl...
https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTg5MDcwNzk0OTg5MTY1OTA5MTY&google_push=AavPq0OwlDfBp1HzLHUd62TECowtMxzkrP12RMXiF20y4ukROMGlGv7-TZKvXLWDWG-A62rU933S8JJ...

170 B
192 B

278ms
277ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTg5MDcwNzk0OTg5MTY1OTA5MTY&google_push=AavPq0OwlDfBp1HzLHUd62TECowtMxzkrP12RMXiF20y4ukROMGlGv7-TZKvXLWDWG-A62rU933S8JJso-TEu00dzORAR7kYRNm7Tzs

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTg5MDcwNzk0OTg5MTY1OTA5MTY&google_push=AavPq0OwlDfBp1HzLHUd62TECowtMxzkrP12RMXiF20y4ukROMGlGv7-TZKvXLWDWG-A62rU933S8JJso-TEu00dzORAR7kYRNm7Tzs
Date: Sun, 25 Dec 2022 04:32:59 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

spacer.gif
an.yandex.ru/resource/ Frame 7F71
Redirect Chain

https://an.yandex.ru/mapuid/google/CAESEOWygUHWqSKNiLBKm6xqt_I?ext-param=AavPq0OSkajNlBqAcMeXwm1sHAoMUEHop4ww8I29p3DamDfLtJ2OO1dPYQc_jWPjoKx-fPf3-R_2wA_CmK3xYzhWl9yYJ7pkJlNcBAE&partner-tag=yandex_a...
https://an.yandex.ru/mapuid/google/CAESEOWygUHWqSKNiLBKm6xqt_I?redir-setuniq=1&ext-param=AavPq0OSkajNlBqAcMeXwm1sHAoMUEHop4ww8I29p3DamDfLtJ2OO1dPYQc_jWPjoKx-fPf3-R_2wA_CmK3xYzhWl9yYJ7pkJlNcBAE&part...
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESEOWygUHWqSKNiLBKm6xqt_I&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
https://an.yandex.ru/resource/spacer.gif

43 B
144 B

434ms
433ms

Image
image/gif

213.180.193.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/resource/spacer.gif

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Server

213.180.193.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:58 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 18 Apr 2001 10:28:03 GMT
content-type: image/gif
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 10 Dec 2023 04:32:58 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://an.yandex.ru/resource/spacer.gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 7F71 0
12 B 276ms
274ms Image
text/html 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J5Hfu9cCUR0LWik2FHZh0MxbV2-r9P3yHPfuVnU-cd1Qlqb3GKKb4Cn-HWrzoVDgimPR_2mJk

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:57 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame FF59 694 B
688 B 2715ms
243ms Script
text/javascript 69.174.120.106

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=1039&ttfrms=28&brid=3&brver=89.0.4389.72&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D38b%5D4%40TauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D38b%5D4%40Tar9EEADTbpTauTau8%40%408%3D625D%5D8%5D5%40F3%3D64%3D%3A4%3C%5D%3F6ETar9EEADTbpTauTau8%40%408%3D625D%5D8%5D5%40F3%3D64%3D%3A4%3C%5D%3F6EU2%26C%3Dl9EEADTbpTauTauHHH%5D38b%5D4%40Tau2TauJ%3A%3F8%5CE%3A%5C%3B%3A2%3F%5CK%3A%5CHF%5CDF%5CK2%40%5CH2%3F%5C%3E6%3A%5CD96%3F%5C42%3A%5CD92%40%5C%3FF%5CD9%3A%5C52%3A%5C52%5CI%3AF%5CI%3AF%5C492%3F8%5C%3E6%3A%5CEF%3A%5D9E%3E%3D&srcurlD=0&aUrlD=-1&ssl=https:&uid=1671942777426605&jsCallback=dvCallback_1671942777426217&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=3326&tgjsver=3326&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-3216231935713038%26format%3D400x250%26w%3D400%26h%3D250%26ptt%3D12%26adk%3D90073500%26output%3Dhtml%26bc%3D7%26to%3Dampa%26pv%3D1%26wgl%3D1%26asnt%3D0-39904443701284981326%26dff%3Dsans-serif%26prev_fmts%3D1600x96%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26ifi%3D2%26pfx%3D0%26pwprc%3D1037897477%26adf%3D16789255%26nhd%3D0%26adx%3D1000%26ady%3D3290%26oid%3D2%26is_amp%3D5%26amp_v%3D2211302304002%26d_imp%3D1%26c%3D553004350%26ga_hid%3D393509541%26dt%3D1671942770306%26biw%3D1600%26bih%3D1200%26u_aw%3D1600%26u_ah%3D1200%26u_cd%3D24%26u_w%3D1600%26u_h%3D1200%26u_tz%3D0%26u_his%3D2%26vis%3D1%26scr_x%3D0%26scr_y%3D0%26url%3Dhttps%253A%252F%252Fwww.bg3.co%252Fa%252Fying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html%26bdt%3D5921%26dtd%3D3%26__amp_source_origin%3Dhttps%253A%252F%252Fwww.bg3.co&fcifrms=10&brh=2&sdf=2&dvp_epl=451&noc=4&nav_pltfrm=Win32&ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&adsrv=0&advid=3398311&turl=https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVPX_PP_IMP_ID=ABAjH0jZfz7Qym3R8-D4MdQ-HZJK&DVP_DBM_1=3060631&DVP_DBM_2=23009949&DVP_DBM_3=14586208515&DVP_DBM_4=396394710&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=881479034793&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=389944675.8386197&dvp_tukv=2839953.959987063&dvp_uuid=125771857.72880052&dvp_strhd=0.19999980926513672&dvpx_strhd=0.19999980926513672&dvp_tuid=265353348909&jurtd=2327831618
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3326.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.174.120.106 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8073cc3bc09c4410637c0aee4fe630bcc2c827d29ae0c67ea199c19dbc5dbc09

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:33:00 GMT
Content-Encoding: br
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Expires: 12/24/2022 04:33:00

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 6F12 22 KB
8 KB 272ms
272ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 341071
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Dec 2022 05:48:26 GMT
expires: Thu, 21 Dec 2023 05:48:26 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 48D7 0
0 579ms
277ms Fetch
image/gif 74.125.68.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssCygYfIwCEKEbnZ9WtW_-oeNonM6jxjMbjCFRTpUsVTR2tl3t4LavUGEVaYM4vnyktASVf2RI0n_IgNo5ojLZiPUNySxG9zHHFUn-vtNbTHY77HqG3cJwMosbUFUkUIufPHc7WdYti8W30A-xGN3olHMxkx70820GgsclOy33sC8DnJdMoIgZO35RquHiNjSPdzVoRSI71mSJj6raITxsxdurihmUS5spP37Wcze16jwDj9P0eHwhnbYMJSDO7f9upd-Ed3MUf5BIzVUBGQWZ-QeEoP-VuVhj3L8AsSWtNzrgouqCGYr_sgickLcaY0SmTUgPWsQdsLFde5_t6Ssv5VRFKgnGBYXmD8w9ZK9GG7OFEA5kM8CwTFTKfJLh5ZlJqb33TrTKPVk-3o1FCEb1uAuh6ygPuuQn5Ik2nGZH-PKGDNsGKb9ARZ1GAmjMiMjhStVV8OFFJZuc2Xfs6a7EgdjjHWBjNPuUxYFwFrTZcb3k-RJguBxkbzYdLFzdpgEONGnnINJAiOuTfmT4d4TnXpwy6Z3RvjT6_UyUOMPLt1GnbpcOuT0G9HZ69zCTYyVD44a7-ZtK-HaCxgnbumoer7b0GF5XYavK9IND3d_13YTF2CC-daZ2ITF6WGQb8Rp3w_8IBWMSoTBbXCYBL_WQq1HZyGHG0zPCQZS3g2npsGzr33ylXirlviFQUAVzlLB-ozdgclnQ3uSQDVA1GLyGyjJWcETx_MrRxWEBwhaPzZZ0RcWtoA8npEIrmQg1eXBJQI9_EtaQbeqc_I4d44EJKh9YdjI5iwFpYfQg4lW5TqQW5pf8BZwDZfnqvAHA3YtR2ERAHHrPz9EQqSH5mGO2qxEVfyU4cXiM0cqTauvbXaFqk962UTn46PE1l4qvI-MBHj7NSWNq3LKgbu_cJg5V7WaaKtfVx7kaTC2VroQrPBBjrPhNT339n3kQNO3h37LnDp0SRegDspudhCNhq1lkpb7NLkvqh6KDubuNePjjdym_wMbe2XPfQPrFXhHzKNTKz7-xs03r4M6PANdnNjRw7S2MQclPSkxyhX_MM5-nvRPKPUp8TUB53qa0RkrRaMFW9Hf1_7Ryobe0R7p5j-a2aAd4EPfyxcQBeWZtXTjWFmrxZoM7xsmvpn4QpHkEeeFYCV1DcX1UyKjMgKayUZ8hd76nIWUzfpVZ3TLLXrqyxfA2dmAKt0JZbhwhBBWCU4yKlvbo_w_MTLS0VS206CkyQ9uStWGtWPzckX81CSdk3_kHMruzyCq1DOhElQp2AYV4j4i2peEeqluyY7YRPfBW-P-CUt9pGuOj13luseJkWnP-GkcOX92V8hflYqMzWduxjOb7wYHr8xk-opGofeagmL8ytLe6dqLkV8BpiQvT-1Qa0IooayxhSKaY&sai=AMfl-YTMNiCAu8WQFdolBQy90m3yG_4DBpk5S5oIBNDOq4s4aUgm4NRwuAiYzOHXJs0PTO1QgLIRiQuMIa-tMgyk3Bh6xqADOCpqULqYyuRxF-pJeYvSRt9Q65wKALAVfMg2fGBKeTWsV1InfbG1G1hbOvW57r2zXKGxj8KSrByG437SiQErhjxkWg9p7byCNYbBQZIcWJ5q7CUsdgptegv3pL0eRQDFixI4BCmDcZpsvhpmSR5kcpNRLoeFPwuWS59DCncf85CEdredmvWgI16_MsOkTyrK2mluZjYn-PA&sig=Cg0ArKJSzKYz-OObpnCFEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=674&vt=11&dtpt=673&dett=2&cstd=0&cisv=r20221207.49691&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:57 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 25 Dec 2022 04:32:57 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 2F94 0
0 277ms
277ms Image
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221207&jk=2150646398706856&bg=!wMOlw4fNAAYgquz3AKo7ACkAdvg8Wm70OF8LCuH9AChfHUffatx3KMgnULJIaV3s-JX5xlGpgv7NqQIAAACFUgAAAANoAQeZAsfkv6PYC59PHEZvvQyGDiTGk-dxe2mr8jH-twbQYlr41eQXJZot6j4iSgQEg80FzChHqcVjpF5niqKMY4uhC1YEQwmCjKwJIEbOxuRktF6l_nnV-EgX9AGwHJPVu-umTp1am_HnOvPBxRjcDeFaCf9rYnK4Y4ol2bNkIiGarD7j8paPhq-PwmZ08HuBambh_Q4uzYM8ruoQuyv4SfkdrmDGh0VJcN9WSzaUxUqvDRgqm7x5LlSfe4chEtvVhXrinDfPs84IzzCkfp_JB3YiMNJBB3cYbR_00niaLQlAAhYb4GcOLWdnlgKrYXjOTXYJgENic_juYFJ05vgRqukXoeQC3c5hnTTmqCOGsLOQboOd6PWxrZq0c82kP9YQnZU1Icx-uuUx4GExoAc0FgTaeRJcvKv1FxqTmYHqE6cEcfzzQ0PSkK0K5VA0p5K68ZjhgWvlUQiDA5fo4X3kONzSQWmoCWzwNat34-dT4h9ipbR2Hm3GHnr4govzIwmMrsYHmDnCIjm-M4iw7ysNuZIlnqKmfkWfF3hal3FrcU_tzAfuTKr9aeYRtnRnWwCmw9tZ0JqG_B1N7KdH4MUGsSePjq4wrWqoy7QhoNYj_IFHHvFTH5UsU49SFrFNryFSKwtPzddDSeaOYs6kC4Xc6MByXleigoR3cv6V2m9QAM5pHmu0GOekGAFt-KOGu6g96IV1JLZ78XxjODZoP_B_UxIgvIsKzsW6YNn0rksI1SNNltpv15wUvSJyebttgTpLuvi83yIocHtIH5vGNmkjH5ipRer7WS9yTT_izTNHwV1v9Bh55dpPAfnNkyPk6D8yQVDGr2kQwCTmDnY7MQqqWJMDoKNcjhUhLs1BCWkKPpROI4iE7qkRtdeJo70HIJWpYv2MWS8s-Ojmc3zjADz3vM3X8rh96dAqA1kWfKQXIlBiugbfBz2hhoWLf_M
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame E7F2 0
0 277ms
277ms Image
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221207&jk=4156723046863717&bg=!vr2lvfnNAAYgquz3AKo7ACkAdvg8Wo2tc3YnPAMksoBnRgPtaseWTfhb5DXCHkHLUjifJOexGftOxAIAAAB2UgAAAANoAQcKADrRt8N3oGB_FEhcXpZ1l87hTqViuZuVZj_6dGRzuPOncm8toPaolY3OudOOYPkvfqBjRYY7KHudGEeWmQLC4Cag6N9qBVqOyejWW3lObyVkfCpfRmb3DjXfDcOyD1pD0jboHoYOlmp5IZtVoud2mQwheNJ8Wd49qDTxvJn2jICe-6bsVVnvPwbUpIdRhnV2l5LPIsCJfeKQlTCriJDp6AtVsT9nnxWrmUBxL5JxFtlU--cwF4-5FwZ4VCuPnkKYw48Xs9hIRIsWxuvlKmVM3JH0zNyVXa_PZA8XLEIUtQgzH3N7HxTbHUDxeouG3alclu0c3R15TVK3d1N23GKywWUKCoovaCR1JQ2OdJrYH_DsbYYeqc8JadcqFvoyo4VLxfMVTSslPx8Se_D2Eprfayc4_Ise8PGGgWlvCGKojHpDIj3v4ioOq7iVz4pCRUOwVVHcSYFSvjuubCpSvL6xGeYIvRWNXinUEQpnLQ0US7z5Kc_q8g3jAbqJceOn1dZQsOHFroGQq7d14_oggOibAOgza4_7h40xr8a2sXBOFx7irvxLlpuYHn3HlFrflIhFXGOloR1_0Gdk7p5Vz0TFQ8Mxbsk9l0RTu7ecCjy3bz_bRjsVeJQ8n63KJuM3vH0jcS_ScaZzpUDRLOsPapqgdzMIXKvki9gw4Q0zmWi9o2yob_bW0BqgJ3n-5pRrLnWJpMZbq1ycVIjnNIwtXSu29SoQvn26UtXxGwlMPcUwYR2Yz5fYENdrjm9zLZ87P_9ZEyivw4i7rmc6JtsCjX_2qST9lvYwgiVwNbQN4xmNyg0qZRl0P0rKvZoXrV2Y2-rh9uN9NHatR7CkjC52m7QV1FNM4Q7U9_3QI2wahxQ_xdtXIoWjIzYVKO2GesI4Mmu5oQVLU3zyhTFTZGs3szpi9CpTNiYxzbSpe46uhUE9K3tFLBsTwhBEJ_b69697VYvK4Y_vw5PNKdkOyJzVsQ5bQ-oZP4ojoZIj_akuoaeYxHkNiSyPu2l3QBUUFeRcnBd2_g
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C3EB 0
25 B 283ms
282ms Image
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BGGjJd9KnY9HrOPC64t4P5tmTuAoAAAAAOAHgBAI&bg=!HR6lHlrNAAYgquz3AKo7ACkAdvg8WoIXeOI2xiyPpZ27VLnTAOi3JdmZRrmdlTxUZ8CxRPVBt2I-ywIAAAC7UgAAAAJoAQcKAJNHg1v5bzZ0Mmc47HifewbxIkf8olDdaroAoO4MfaLx1r6M1ZbnB0svxBDC10dGrrz85RHzvJNXGSTST9qB_lfrlfYV0Wt4NNyHWE68b4ExFaizGsnotDURH-pkNKDBZ4Q7d-VK4872eiKzq9agE77DLVs1Dp2gHi7aPixsc_0LWiT7liPiNGpemMtcVzVwhVzah1OZAueQ4t7Y3X8rzCqQtWieAaEqMmrh9GV7TU_6QDNr3PbEiAAkTlBUHaXdcwsNqbxKWljAKSsldGSKvR5HxXp60b-I2nas--X26ypZeiehaXJhELfF1G3tHAOyWbdSbEIMEOLzOmgxG8thkNzCEaxlJgC3BXONK1UD1n8iIXbWtnyoAu7VC9xBlXAZGeo5H3vLpDWaugTWdFL0KWcomfC8oaWn71EPtN9ll38QFzovxczPgALx2WbL9GdodPY5qoMhIu7-dM7Y-PwcLraHsywNz7VD7-mutGT46ckdBeoyJiDUhHJSMxxb38iIxxcaqOpi3zgE8iSsUwmmDiI7RoIKVMhVPEjf7uy5SqY4fGpB4hy1ETSNG_LNrK8IqsSxY4bLZkgZPLn3cw7MzyvV7FPGsH1ZTb4ygABXpReLot0XmLqKF5XCCCX0rihIkS_7lz9noSyqryxaHIXgtnnrsM84erBd46bT5Kmn3Hq6kf0ew6h3j3hLgS5YK8p1to48MJZtDxOkZXZAHQcYNESo6OdKx2pmPKnRqcBRBuPmyMVLLOt_sXQDdxMS7zbfUeXlQ3PiYq3DmW_kEejmn3Lxm7wtpXjxNxZh1vd3-YD8GxH9vGDdOGEMeBzk6ewHqmb9cPqE6PorPXT1aH1i_LQ-2sfEofyHr85JSeropr6XwCQ8wUDgGAWlUpjSpLx1YKY8AcW_Jyzocm4DaxW0gR1fqReSOt1wTkXMgQo-jckrhLrV_j3xNDN2MEPwINkEradMQxX8s5k7HB7k56IAPM0AdYyuZP6lLjoba_9xgqD3E4bYgCOmd950W9A_NQcF5rGIhKqGzrjNMApscPDt0qLkGk7t5nz35xoayNGixZUwES_sZiiUhoGdu2HY4zQJ9RwkM6Sjjia0sYaSh_eIhUr3boikThp_x4fXw-Sa_8UR9OExZf53adbPeOaSklXcmE1UWklY5zQYQWiAOwmr_4JPObVUJEBNAEmN-XmqVA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 709ms
235ms Preflight
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bg3.co%2F&domain=www.bg3.co&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.bg3.co
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sun, 25 Dec 2022 04:32:58 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 457270
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 json Show response
gum.criteo.com/sid/ 346 B
650 B 709ms
236ms XHR
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bg3.co%2F&domain=www.bg3.co&cw=1&pbt=1&lsw=1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

3ed0922095bc731d15794162907ae628ed85f665219b1fde5d6aa2a1b1881671

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1143406
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
673 B 144ms
143ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 17ffff02b513825e2993ae675a83b88c285738effbbe286b294ce9577f7a7a30

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 25 Dec 2022 04:32:57 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Tue, 24 Jan 2023 04:32:57 GMT

GET
H2 200 pd Show response
u.openx.net/w/1.0/ Frame 29EB 533 B
631 B 243ms
241ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: fdb0db22185f21ef584dd3defd9908c37dc554003927fe36469f89bbdc0103c3

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 320
content-type: text/html
date: Sun, 25 Dec 2022 04:32:57 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 39D5 52 KB
17 KB 1454ms
383ms Document
text/html 184.31.28.198

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.28.198 -, , ASN (),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sun, 25 Dec 2022 04:32:58 GMT
ETag: "623de86a-cf34"
Expires: Mon, 26 Dec 2022 04:33:00 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Unused62: 8096267
Vary: Accept-Encoding

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame F68C 8 KB
4 KB 1226ms
404ms Document
text/html 18.66.171.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.171.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-171-123.dub56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2e4a250ad3ac07b9adfce39197341a30bc1623902a753e8a7ae0324e7cb53731

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 66220
cache-control: max-age=86400
content-encoding: br
content-type: text/html
date: Sat, 24 Dec 2022 17:21:43 GMT
etag: W/"500c31eb3dcfb8f2a7dc0893b86a487a"
last-modified: Thu, 01 Dec 2022 19:37:41 GMT
server: AmazonS3
vary: Accept-Encoding Origin
via: 1.1 4ef5b810a61123a6a28e9f07ba613430.cloudfront.net (CloudFront)
x-amz-cf-id: G6MLqHLZbLRRD8vAxqyh8Wyn3qZuOIOe0G7SNiQgpARZrJOMbhBtEg==
x-amz-cf-pop: DUB56-P1
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:5838c8c3-64c9-4519-918a-548b86a0fef3
x-amz-meta-codebuild-content-md5: 86c7b5baa8ca6b64006191aa90b9f19a
x-amz-meta-codebuild-content-sha256: 7a0197b444a3c5a5c4f92ccd56438fcf44932f5518b7cae8f7a5ec6b1a094ad5
x-cache: Hit from cloudfront

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame BBCB 3 KB
2 KB 377ms
123ms Document
text/html 172.64.151.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 342
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 77eedb1a6e8a1c5f-AKL
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 25 Dec 2022 04:32:57 GMT
expires: Sun, 25 Dec 2022 08:32:57 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 1E3B 36 KB
12 KB 947ms
393ms Document
text/html 23.50.118.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.44 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

8b12d0784231c48f9c1b14c103b42ae6f48de739c600c308bdb920dde106a731

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11800
content-type: text/html; charset=UTF-8
date: Sun, 25 Dec 2022 04:32:58 GMT
expires: Tue, 27 Dec 2022 04:32:58 GMT
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2

200

sync Show response
eb2.3lift.com/ Frame EE91
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

1 KB
2 KB

235ms
235ms

Document
text/html

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: 35534e57f769c8df55bb53d8ffb3e4f82683097ae6aad510804090bf8d9fcffb

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1148
content-type: text/html; charset=utf-8
date: Sun, 25 Dec 2022 04:32:58 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Sun, 25 Dec 2022 04:32:58 GMT
location: /sync?&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 600E 2 KB
814 B 392ms
392ms Document
text/html 51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1671942772674

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.100 , Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 97A9 281 B
554 B 768ms
259ms Document
text/html 23.44.27.86
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.27.86 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-44-27-86.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 25 Dec 2022 04:32:58 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 95F1 36 KB
16 KB 275ms
274ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 15:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48273
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 15:08:24 GMT

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 6F12 36 KB
16 KB 274ms
273ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 15:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48273
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 15:08:24 GMT

GET
H3 200 index_120x600_google.html Show response
s0.2mdn.net/sadbundle/4942068020373019979/ Frame 8E31 6 KB
2 KB 282ms
281ms Document
text/html 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4942068020373019979/index_120x600_google.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c739ccbfad2a264757c1608cb342f9829a077fad87b0cc079540ab03aeb2412

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2200
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:57 GMT
expires: Mon, 25 Dec 2023 04:32:57 GMT
last-modified: Mon, 05 Sep 2022 15:11:23 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 070F 0
0 479ms
287ms Fetch
image/gif 74.125.68.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssDPLngyjI07NFrqnGQdkKodlQHvunXGlJY5iDJxeytbKjyQXZBVCdudf-8m116t6CDolgnzTQRVVUNFMcHDsGrMJMbSFHXdTnjeJ1nMFq7ObZWqSVIDcjnOnu02tEIk2vzHrY_8MKJzI7vWtNURpRKZfXRdXSMKjHa9Yj8x6ptgBLKAnEUXfPPN3JDHmqAwStQAmYDGZ0cyprEcLxUaV-oHV_08lv5JT_yCKv9VxhhnVnLUs72khWTB6S0w0mD-vp_xR5lYBchnwOYD3OkckO1At6lgnates_lNF7QOScmAB4qMPiYJS9MFxOG8Ya3LX1bnwDdNDxnJZJPwAH5BMnYEmFneaAYEsP0bTzbARj6l-U6b8eH9VIRqAWEPjSbijOVbc0Iab7AR7FbtQK2F4uhFjP1PWz29NwP0j6bChBCH1KqMdJmV39_2RfGUwkvRXKeCKcteFqCRNRBi5h7mhc2teBMqZwiKr1VVgCOhM7_aS5nwVFPN9nmYjhrjNMbwFzmX6N6pzLb6Osegh9L_25jb9L2yf3QxUbRcn7JxIM4ALM1x_9bAkdSmlpvhHupcWo0g_hseutww5mNDlmfPW62mcV3lSMdIWdQFpPC0TIE-yO7mUWM0SzK1ydvckUfjsI1HUxEFXPYvJ9H27OmrlgS4QAXjY0LNXGAjohinkklh6-mKit4GM63YwT8jFGAncQmQQOSNQJ4oxjgQq4xDKRvBYkhWwLumaba-Bm_QiOzY2XXnbcJ2YkZf8Hmc9ytoBmd9XLzr8_0wRxclewVEnUGYoCZipIKBWUEdpqLhUtjj6t8JuZPO11Z7aw6D8CrFhfI8Ml__1ng7PcIG-ebuZ6TDq0YxPwT6SYrSM8dhd4dh1pFlN6FpSe8fWK5HtVp4VbVA-hqCkJLvxizKFKrTfqKSnYMxwyUUqs5qgtM0Mm_vrt5hIj0bPjDn1r_ReU8crum5gYLh2TUEksTKfWJRimeBHZg-46AYMYEJiU3EWdT18nI6Yx_j_b-0R2H5O1BtU9K742Vy1UMJhWOQr8cn5xWM-OOW643nF1BQ-FccKbYzN1PrFJoV-yTlZrpkGpW7NaxvnMuqkW1PeRjsIdQbHTIsgf8JZfkVhgJoyFLOl2qFAzbm_x_Gg-can4Z59feHDGnVDP4oR9xmgYhwcJ8cVNCWQFUYIytxpcD1lj2BdBI6s0TUPlIFsatPtt2NxLlqt7lEAq0sNzZGDlsVys_9CanrjLojdHhEgdKCl7IOTcJe99HYqpa0SV-h7YgxnlxSintAu4_rKYZDK2-6DenytMhPFDWbLY07s4msQEb5sHRVs0yuXWrbbLCzsx77w&sai=AMfl-YTYjGqofy7UhTFPdItHFj4TO3EiQAjMpA6QAd0a9IPp3hxzZ7V8toQhPN6uNAK1Gt4ao8LobNU3YSXQsoU5Z2np-ZT-8oZ0NB6ATACeKUYp3kGSBhJtv64DlyP97Dvmj1JlqHO-8uJacJ07tk-Wtm8nnqqtw7H7mVsQi-jgia-D1j2IYLSI_HD9lWbsOqSCf_u5BVkw2O5WXwUjRu43c3woJNNfD9hDmlqXjTdATftzA2ktDgSBejs9y3HwOTZhgmOaDL2ArEGCFg&sig=Cg0ArKJSzIK70WkUZuJNEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1080&cbvp=1&cstd=1076&cisv=r20221207.79629&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 25 Dec 2022 04:32:58 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 25 Dec 2022 04:32:58 GMT

GET
H2 400 img;adv=11122207570744;ec=11122226302456;adv.a=6266241;c.a=28466995;s.a=3213511;p.a=345598515;a.a=537242143;cache=1388142104;
ad.atdmt.com/i/ Frame 070F 0
0 1169ms
517ms Image
text/html 157.240.235.12
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.atdmt.com/i/img;adv=11122207570744;ec=11122226302456;adv.a=6266241;c.a=28466995;s.a=3213511;p.a=345598515;a.a=537242143;cache=1388142104;
Requested by: Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.240.235.12 , Singapore, ASN32934 (FACEBOOK, US),
Reverse DNS: edge-atlas-shv-04-sin6.facebook.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 2418735279377567735
s0.2mdn.net/simgad/ Frame C984 47 KB
47 KB 274ms
274ms Image
image/jpeg 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/2418735279377567735

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=92.271;sz=300x250;u_sd=1;dc_adk=2857193491;ord=0r15sy;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=bS2EV(Sz0u;stc=1;chaa=1;sttr=308;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d22ae6bbaa3c79a6d31667177a7bf1b209536858fe3caf1a95a21af65d76f15b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Dec 2022 16:24:21 GMT
x-content-type-options: nosniff
age: 389316
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48252
x-xss-protection: 0
last-modified: Thu, 26 May 2022 20:28:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Dec 2023 16:24:21 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/ Frame C984 8 KB
3 KB 273ms
273ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=92.271;sz=300x250;u_sd=1;dc_adk=2857193491;ord=0r15sy;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=bS2EV(Sz0u;stc=1;chaa=1;sttr=308;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 20:16:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29771
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Jan 2023 20:16:46 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C984 0
0 454ms
278ms Fetch
image/gif 74.125.68.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvutqkl9jOI6wMqbNSP9B7kChnprQy2cBknXUIE-6kpRkvaV1eARLAUM_B0nrV1ifKWw6mBBjpCuGF-ZFdE9OezL78p3fSZl1JB6xdw76seI0s2WFgBWy8P-G7K38pWhidwzmwL4mnE5LsBjHHQiG9q6Q&sai=AMfl-YTNzULp1k5D7dMHzWIvsZlhKR4Mty4fbd7JlteyfPAbeHE2V7QA8WjtbpmCWDE9qJ3XV5DjgHcD5uMmW-U4uZCAHkSVBh7EjSZLrwKu&sig=Cg0ArKJSzKM-bqA4PdpOEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20221207.11903&arae=0&ftch=1&adurl=

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=92.271;sz=300x250;u_sd=1;dc_adk=2857193491;ord=0r15sy;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=bS2EV(Sz0u;stc=1;chaa=1;sttr=308;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:58 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 25 Dec 2022 04:32:58 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C984 41 KB
15 KB 273ms
272ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=92.271;sz=300x250;u_sd=1;dc_adk=2857193491;ord=0r15sy;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=bS2EV(Sz0u;stc=1;chaa=1;sttr=308;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Dec 2022 20:16:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202588
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:16:29 GMT

GET
H/1.1 200
OK dv-measurements3326.js Show response
cdn.doubleverify.com/ Frame 1304 552 KB
106 KB 273ms
272ms Script
application/javascript 23.50.117.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements3326.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.117.184 Jakarta, Indonesia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-50-117-184.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: e23d1ed62c982ac7ccbdbf25ce5289b23facf4631028e662b1b092f62332f4cd

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:58 GMT
Content-Encoding: gzip
Last-Modified: Tue, 13 Dec 2022 08:24:20 GMT
Server: Microsoft-IIS/10.0
ETag: "052474ccced91:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 108149

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8035 1 KB
649 B 273ms
272ms Document
text/html 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 13241
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 00:52:17 GMT
etag: 48472445140208031
expires: Mon, 26 Dec 2022 00:52:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C984 153 KB
47 KB 276ms
276ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 25 Dec 2022 04:32:58 GMT

GET
DATA 200
OK truncated
/ Frame C984 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 28f54fdd0b175abc78300dec1ac26e733c9ef89bcb7f1073c46a8228008b7f8f

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 29EB
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3879607764610334138&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

239ms
238ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3879607764610334138&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3879607764610334138&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 29EB
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=b15610e6-29dc-7ead-dacd-37fc1c2a91c7&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=9e435674-81e6-45f7-8970-c8c3377de7ea&ttd_puid=b15610e6-29dc-7ead-dacd-37fc1c2a91c7&gdpr=0&gdpr_consent=

43 B
62 B

242ms
242ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=9e435674-81e6-45f7-8970-c8c3377de7ea&ttd_puid=b15610e6-29dc-7ead-dacd-37fc1c2a91c7&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:57 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=9e435674-81e6-45f7-8970-c8c3377de7ea&ttd_puid=b15610e6-29dc-7ead-dacd-37fc1c2a91c7&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 335

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame 29EB
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=openx
https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y6fSesCo8XwAAOfrCssAAAAA

43 B
114 B

240ms
237ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y6fSesCo8XwAAOfrCssAAAAA
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

X-SO-Cluster-ID: 0
Date: Sun, 25 Dec 2022 04:32:58 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=openx","cluster_id":0,"gdpr":false,"ipv4":"116.90.74.208","key":"Y6fSesCo8XwAAOfrCssAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad121"}
X-SO-Key: Y6fSesCo8XwAAOfrCssAAAAA
Server: nginx
X-SO-Upstream-ID: m-ad121
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y6fSesCo8XwAAOfrCssAAAAA
Cache-Control: private
X-SO-HostName: m-ad121.dc4p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 5
Content-Length: 0
X-SO-LB-Hostname: m-tgng24.dc4p.scaleout.jp
X-SO-IP: 116.90.74.208

GET
H3

200

sd
jp-u.openx.net/w/1.0/ Frame 29EB
Redirect Chain

https://cr-p3.ladsp.com/cookiesender/3
https://cr-p3.ladsp.com/cookiesender/3?cr=true
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AUFawqsCyK7hks8ADzLRhiKo8s8AAAGFR44v9A

43 B
61 B

236ms
236ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AUFawqsCyK7hks8ADzLRhiKo8s8AAAGFR44v9A
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:59 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
via: 1.1 80432223a109fcf584967597d286e714.cloudfront.net (CloudFront)
server: Logicad
x-amz-cf-pop: SIN2-P2
x-cache: Miss from cloudfront
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
location: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AUFawqsCyK7hks8ADzLRhiKo8s8AAAGFR44v9A
cache-control: no-cache
content-length: 0
x-amz-cf-id: 7tHfzs-8zmsgwXfWsnHPjRl6YPFnwTw9Lt9VoyYQxfPqzTAEc1B9LA==
expires: -1

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 29EB 170 B
189 B 279ms
277ms Image
image/png 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OWQzOWMzMmMtZTBhYi0yMDA5LWNmMmQtNmQ0NWQ2Yzg1ZmE3

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 29EB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGGAqEL26bi_MYZiyUCHh-8&google_cver=1

43 B
61 B

237ms
237ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGGAqEL26bi_MYZiyUCHh-8&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGGAqEL26bi_MYZiyUCHh-8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 55-15e40ad0
api.attentionxyz.com/api/tag/config/ Frame 0
0 613ms
324ms Preflight 34.117.222.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.attentionxyz.com/api/tag/config/55-15e40ad0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.222.118 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 118.222.117.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: amt-event
Access-Control-Request-Method: GET
Origin: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: amt-event
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 25 Dec 2022 04:32:58 GMT
vary: Origin, Access-Control-Request-Headers
via: 1.1 google

GET
H3 200 55-15e40ad0 Show response
api.attentionxyz.com/api/tag/config/ Frame 48D7 115 B
132 B 603ms
319ms XHR
application/json 34.117.222.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.attentionxyz.com/api/tag/config/55-15e40ad0
Requested by: Host: attentionxyz.com
URL: https://attentionxyz.com/55-15e40ad0/amt.js?tagLabel=MBM_NZ_cm360&attrAdvertiser=8643303&attrCampaign=28056354&attrSite=1589324&attrPlacement=353930039&attrCreative=183727314&attrAd=545167118&attr1=%edclid!&attr2=j
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.222.118 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 118.222.117.34.bc.googleusercontent.com
Software: /
Resource Hash: c4e1a087d18639c1fbcfe9f8af011e58d16d5d6e94938d5444c630761230b58e

Request headers

Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
Amt-Event: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJhbXQtcHJvZCJ9.8dotrQPk6rXdTZUfYiTmmCx3BKBZ0ngS9huOY_9Rk9s
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:59 GMT
via: 1.1 google
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
cache-control: max-age=3600,s-max-age=43200,public
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 115

GET
H2 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame 6695 2 KB
1 KB 503ms
254ms Document
text/html 172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f79873ae9eb3167bf2a093536ddd3e67b593634490d9086cd55ff373a9ef70ed

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 77eedb1ce97c1c56-AKL
content-encoding: br
content-type: text/html
date: Sun, 25 Dec 2022 04:32:58 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cl74n6r1t4e7E%2BI2itWccxA26BjVQnv7IwIybqB5fj9KKevreAK2ogM70j0uRlhydJD2vQHQGLuyV4msLDFsVneiYbewcJawIAzw8OZl8wflwjsUrR2ahhNrbQXHyU83wr1Om2B1oFX1KA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 tweenmax_1.18.0_499ba64a23378545748ff12d372e59e9_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 8E31 105 KB
35 KB 274ms
273ms Script
text/javascript 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.18.0_499ba64a23378545748ff12d372e59e9_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4942068020373019979/index_120x600_google.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

001acbb15d9c69510c0817e6dde361bff098406fad182ab3c367f86ff3da8343

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4942068020373019979/index_120x600_google.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35824
x-xss-protection: 0
last-modified: Fri, 09 Oct 2015 14:01:28 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 04:32:58 GMT

GET
H3 200 easeljs_1.0.0_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 8E31 125 KB
35 KB 449ms
448ms Script
text/javascript 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/easeljs_1.0.0_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4942068020373019979/index_120x600_google.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25c06c024bfb192f5418b39ce069ebe46fda94e38b25ae781cc753fce98a2a24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4942068020373019979/index_120x600_google.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36116
x-xss-protection: 0
last-modified: Tue, 19 Nov 2019 16:51:38 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 04:32:58 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 8E31 236 KB
63 KB 512ms
510ms Script
text/javascript 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4942068020373019979/index_120x600_google.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4942068020373019979/index_120x600_google.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 04:32:58 GMT

GET
H3 200 index_120x600_google.js Show response
s0.2mdn.net/sadbundle/4942068020373019979/ Frame 8E31 50 KB
9 KB 564ms
563ms Script
application/x-javascript 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4942068020373019979/index_120x600_google.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4942068020373019979/index_120x600_google.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9524d8f1807bf488171ae337a05fd08898c2acfab1408df2e33b700f80ed9f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4942068020373019979/index_120x600_google.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Sep 2022 15:11:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 25 Dec 2023 04:32:58 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A398 22 KB
8 KB 273ms
272ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 341072
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Dec 2022 05:48:26 GMT
expires: Thu, 21 Dec 2023 05:48:26 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8035
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEHP7AP6JvpcPnqvXGNohwcQ&google_cver=1&google_push=AavPq0NIeF1B9ILBihcMQOiKLoDwrlvY3oPN0dg19Vz1bChqN-khpbn-wb...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AavPq0NIeF1B9ILBihcMQOiKLoDwrlvY3oPN0dg19Vz1bChqN-khpbn-wbchhz9djnDID3Ex_JQIpYfYodu3GWPwVlj5JLt9CRaEPMsrG3Dz_M30gZrOn...

170 B
189 B

279ms
278ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AavPq0NIeF1B9ILBihcMQOiKLoDwrlvY3oPN0dg19Vz1bChqN-khpbn-wbchhz9djnDID3Ex_JQIpYfYodu3GWPwVlj5JLt9CRaEPMsrG3Dz_M30gZrOnxJXGpvzD1h1uwcE3SmAI6v5xA4&google_hm=bXU3CA_yBhJdGqaIuolGeQ

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AavPq0NIeF1B9ILBihcMQOiKLoDwrlvY3oPN0dg19Vz1bChqN-khpbn-wbchhz9djnDID3Ex_JQIpYfYodu3GWPwVlj5JLt9CRaEPMsrG3Dz_M30gZrOnxJXGpvzD1h1uwcE3SmAI6v5xA4&google_hm=bXU3CA_yBhJdGqaIuolGeQ
pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8035
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEO5hjz_-XDwd8RJ1wZhIBFY&google_cver=1&google_push=AavPq0OX0N9elY6NAL7RKH62-UuFvA0k7AOGowFC9G-3z4K9__kCwXmH2oIm3EVu6hGiClzGZTf3VWYzvQHix9R6...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=B0xjp9J5SgCUjTMGpjAJzA&google_push=AavPq0OX0N9elY6NAL7RKH62-UuFvA0k7AOGowFC9G-3z4K9__kCwXmH2oIm3EVu6hGiClzGZTf3VWYzvQHix9R6cVGeJG5x...

170 B
189 B

276ms
276ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=B0xjp9J5SgCUjTMGpjAJzA&google_push=AavPq0OX0N9elY6NAL7RKH62-UuFvA0k7AOGowFC9G-3z4K9__kCwXmH2oIm3EVu6hGiClzGZTf3VWYzvQHix9R6cVGeJG5xHBmJ8XadpaFyUkzNeXmtl_6cHiB5ReOhcHBXTfb_xVYUIg

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sun, 25 Dec 2022 04:32:58 GMT
Server: MT3 277 3f0ad7a master hkg-pixel-x19 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=B0xjp9J5SgCUjTMGpjAJzA&google_push=AavPq0OX0N9elY6NAL7RKH62-UuFvA0k7AOGowFC9G-3z4K9__kCwXmH2oIm3EVu6hGiClzGZTf3VWYzvQHix9R6cVGeJG5xHBmJ8XadpaFyUkzNeXmtl_6cHiB5ReOhcHBXTfb_xVYUIg
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sun, 25 Dec 2022 04:32:57 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 8035
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEMXToZjK8GnkON-sZZ1BbRw&google_cver=1&google_push=AavPq0MgYsV3BDLMTwTEEE_82ROSS-RcOfPsIhW-jA9mRDUoX20oowPCMWNY7hQHj-weTEb2aSpLOsXV3RdLv5VfJEQsPojpZG2HV...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMXToZjK8GnkON-sZZ1BbRw&google_cver=1&google_push=AavPq0MgYsV3BDLMTwTEEE_82ROSS-RcOfPsIhW-jA9mRDUoX20oowPCMWNY7hQHj-weTEb2aSpLOsXV3RdLv5VfJEQsPojpZG2...

43 B
414 B

323ms
315ms

Image
image/gif

104.18.25.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMXToZjK8GnkON-sZZ1BbRw&google_cver=1&google_push=AavPq0MgYsV3BDLMTwTEEE_82ROSS-RcOfPsIhW-jA9mRDUoX20oowPCMWNY7hQHj-weTEb2aSpLOsXV3RdLv5VfJEQsPojpZG2HVhHN9HJB7MfCK-vy2bO_Jw6zrTuaDa6N4edq-9s8K68&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAavPq0MgYsV3BDLMTwTEEE_82ROSS-RcOfPsIhW-jA9mRDUoX20oowPCMWNY7hQHj-weTEb2aSpLOsXV3RdLv5VfJEQsPojpZG2HVhHN9HJB7MfCK-vy2bO_Jw6zrTuaDa6N4edq-9s8K68%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 104.18.25.173 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 77eedb1f381dee96-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 578
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMXToZjK8GnkON-sZZ1BbRw&google_cver=1&google_push=AavPq0MgYsV3BDLMTwTEEE_82ROSS-RcOfPsIhW-jA9mRDUoX20oowPCMWNY7hQHj-weTEb2aSpLOsXV3RdLv5VfJEQsPojpZG2HVhHN9HJB7MfCK-vy2bO_Jw6zrTuaDa6N4edq-9s8K68&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAavPq0MgYsV3BDLMTwTEEE_82ROSS-RcOfPsIhW-jA9mRDUoX20oowPCMWNY7hQHj-weTEb2aSpLOsXV3RdLv5VfJEQsPojpZG2HVhHN9HJB7MfCK-vy2bO_Jw6zrTuaDa6N4edq-9s8K68%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 77eedb1d8f90ee96-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8035
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEPlSG02aAdHFdVv_f9MXpCM&google_cver=1&google_push=AavPq0NvtIuT798yXm-qvpxy33vcXZjG25Qsxmh0uoSdFDp_zIYpv6mpUQUr2rf0V2hgMWI6SJPZS9bS...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEPlSG02aAdHFdVv_f9MXpCM&google_cver=1&google_push=AavPq0NvtIuT798yXm-qvpxy33vcXZjG25Qsxmh0uoSdFDp_zIYpv6mpUQUr2rf0V2hgMWI6SJP...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODQwOTczODM0ODQ4NDEyMTc1&google_push=AavPq0NvtIuT798yXm-qvpxy33vcXZjG25Qsxmh0uoSdFDp_zIYpv6mpUQUr2rf0V2hgMWI6SJPZS9bS...

170 B
189 B

277ms
276ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODQwOTczODM0ODQ4NDEyMTc1&google_push=AavPq0NvtIuT798yXm-qvpxy33vcXZjG25Qsxmh0uoSdFDp_zIYpv6mpUQUr2rf0V2hgMWI6SJPZS9bSft1jwDh4Dfzq39DCkRNSaG71OJUOXhg2gsWoLhNxkz86sLYTPw5VPFjm4mzcHpA

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODQwOTczODM0ODQ4NDEyMTc1&google_push=AavPq0NvtIuT798yXm-qvpxy33vcXZjG25Qsxmh0uoSdFDp_zIYpv6mpUQUr2rf0V2hgMWI6SJPZS9bSft1jwDh4Dfzq39DCkRNSaG71OJUOXhg2gsWoLhNxkz86sLYTPw5VPFjm4mzcHpA
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8035
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEPwv7p-W_sVV1E40ZarvuGI&google_cver=1&google_push=AavPq0Od9bdZzG-tgbGNZIcowvMv0upN30FN8VA9CRTG4LRn7QJfmn7Un85wLFIoKzuTA3OXGK25DfT2FtYhj...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEPwv7p-W_sVV1E40ZarvuGI&google_push=AavPq0Od9bdZzG-tgbGNZIcowvMv0upN30FN8VA9CRTG4LRn7QJfmn7Un85wLFIoKzuTA3OXGK25DfT2FtYhj...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AavPq0Od9bdZzG-tgbGNZIcowvMv0upN30FN8VA9CRTG4LRn7QJfmn7Un85wLFIoKzuTA3OXGK25DfT2FtYhjeOUrPKmb0IdMFv5AckHmFVsBAQMsfShkN4CedG_r5JaWGQ...

170 B
193 B

278ms
277ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AavPq0Od9bdZzG-tgbGNZIcowvMv0upN30FN8VA9CRTG4LRn7QJfmn7Un85wLFIoKzuTA3OXGK25DfT2FtYhjeOUrPKmb0IdMFv5AckHmFVsBAQMsfShkN4CedG_r5JaWGQ6YunnUd35Bjk&google_hm=Y1M0OVl4RUpaUEFQR1JYYVc4Ymk=

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:33:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:59 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AavPq0Od9bdZzG-tgbGNZIcowvMv0upN30FN8VA9CRTG4LRn7QJfmn7Un85wLFIoKzuTA3OXGK25DfT2FtYhjeOUrPKmb0IdMFv5AckHmFVsBAQMsfShkN4CedG_r5JaWGQ6YunnUd35Bjk&google_hm=Y1M0OVl4RUpaUEFQR1JYYVc4Ymk=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 279
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8035
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEPaSNnQT61fE8LOxWQ75Ejk&google_cver=1&google_push=AavPq0PCvesVENCxIqWpyOhXbjj70i4jqczGPPI9KCwwoDPOCp7ITL6ZNN8Fv1ygzh7u3OXRdMkblrcc-XJVLNl...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=DuzF68nfSE9cqWqPoIGDFXRaStA&google_push=AavPq0PCvesVENCxIqWpyOhXbjj70i4jqczGPPI9KCwwoDPOCp7ITL6ZNN8Fv1ygzh7u3OXRdMkblrcc-XJVLN...

170 B
189 B

280ms
279ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=DuzF68nfSE9cqWqPoIGDFXRaStA&google_push=AavPq0PCvesVENCxIqWpyOhXbjj70i4jqczGPPI9KCwwoDPOCp7ITL6ZNN8Fv1ygzh7u3OXRdMkblrcc-XJVLNlwFhXs09DKXWzOLywrKMW82mObkMSUFes_5xK1tfJG7iror3Eja-kzhzk

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=DuzF68nfSE9cqWqPoIGDFXRaStA&google_push=AavPq0PCvesVENCxIqWpyOhXbjj70i4jqczGPPI9KCwwoDPOCp7ITL6ZNN8Fv1ygzh7u3OXRdMkblrcc-XJVLNlwFhXs09DKXWzOLywrKMW82mObkMSUFes_5xK1tfJG7iror3Eja-kzhzk
Date: Sun, 25 Dec 2022 04:32:58 GMT
Connection: keep-alive
Content-Length: 285
Content-Type: text/html; charset=utf-8

GET
H2

200

spacer.gif
an.yandex.ru/resource/ Frame 8035
Redirect Chain

https://an.yandex.ru/mapuid/google/CAESEOWygUHWqSKNiLBKm6xqt_I?ext-param=AavPq0Pz0IQnkghbO-cjXrM1MBirpB7Y5Vh0Am7M8Zi96-iJGhKhqrKSr8QMsnB-k-owjfd0tuRSVbv8MEnJPZbjwgPcKuDK_54sosRQOUyzF4fb3GQtmv4m6_XT...
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESEOWygUHWqSKNiLBKm6xqt_I&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
https://an.yandex.ru/resource/spacer.gif

43 B
126 B

434ms
434ms

Image
image/gif

213.180.193.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/resource/spacer.gif

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

213.180.193.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:59 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 18 Apr 2001 10:28:03 GMT
content-type: image/gif
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 10 Dec 2023 04:32:59 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://an.yandex.ru/resource/spacer.gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 8035 0
12 B 276ms
274ms Image
text/html 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LYWRKqNFaPA5Dtuuh5ySs4RlQHVanwMkA_pc9XzxkrTlTP3tPfby9uQ4X3ITKJCQe_qK4LEg

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 95F1 0
25 B 281ms
278ms Image
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BB1ZEeNKnY5zOAsip1Ab7xJnIAQAAAAA4AeAEAg&bg=!mpmlmd3NAAYgquz3AKo7ACkAdvg8WmH40AtDkRKdsQFg0j7KkZ0TGfy1Vfdhu7gU2805Kjn4NMCtSQIAAACzUgAAAANoAQcKAI9hRUEPULxUwdS3zri5dlUDaLsK0KTY0nPitlO4KfFXUfyUkk0Pz-8rWupfVaVKHHKGBFQnTfix6gNxv-giAVdeFFyvWh9ZP4IUijxHrBow65O4MNoXKztJXzO437h_g68sQ-eWwChbsqEuGGkCZ9NT3ABn28q27CY9ujU6dvqg9ZPwjYuDJQ6B3codwCsxs5kC4QeeY_NbfWsHjYu-C_6I-NteptcPB5gr7J8LptOLolm3Q8qQOFmjVACO-PybWpQEKFncIGtiEISaRQ9gjQqUxwX2L-PSCsfkWndkK6NvWafshWE-B7XQHNRaQ4V9gxEz7Y114gqXSKnLfeZC-XkI29Lz9TjCGVNovY8c4QSXqDAFhCRI0_4D-EInPxt3Meo0kvnPbAhdsKR9AaE5fNdEV9tg69th5l6YF5yjB3fgwDECCIbEBrqwtrcq5m8BsNsSYGG8ydTnySkUvxTnUmuRK1Jw49g8oG5WBJFBICUhGIvepJCgBHlV-y8uB4OPzUt7fbNS8jJIlSdD014OwjUYsF48Q_WbCrqUD6EVuMO9iRXObHwGG0ARvaCzrUFgyAoHYPGZKJLy7TtKiU3s2hD9VPLy7OU3xHLNpNOiwUxUV_49FfudoifHc6YCXV-_RdMxRKc7falGEuFBN2FGfZWPtpK2o9P-_r4Tl7ZlioMkwJICRtlXzSRZCtAGMpEFy5laU0K24fysBshqF36PjKhNj8Q9HIE0SfyTKPktjuuSjgKlowG4L07GeOCGyRuVv52sY4deKQfozoBueCfReQWmDMIu0X262brOOM7FpGNFpFGn-eb1NuvDfKDSbSnCuXYaNW7rdQALj_cjrGBF2MdVeYIrbrLJvNNIk2-vhtx_h17_bIIFTO7FqcAyYTdqc4qzRG6aMTQRij9aWVo5EdnZk1qoG7hFOR49DDqc0goZUSOWTgahNaCStQY7kdbWb-praudsxeV8ULd730mx-m6PUuZiwBo03tsDaF3sUlsw35Y64L2jEYhZ1CZ24IdmmKyEiO1meAMwE5ob4OMzerCffqOuX-NDpKpoQLL7J3EASBbd_TB5zzezbxUxutCKJfJcm1_qJ1HrHJyZMt7mhM9qD0CydzmCG13zDuVReddpXcDSW70bpAJ04ZFgL8ktDuAS9-snM05IK4HNVtyO0XBfM_l3

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6F12 0
25 B 279ms
278ms Image
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BIym0eNKnY9i_AYev1AbL4a3oBQAAAAA4AeAEAg&bg=!DwylDEjNAAYgquz3AKo7ACkAdvg8WhquKqRbJIjiTfQk5FijjIb5ClGpBsYz9EbXMLe9TxPFe6TvWQIAAACyUgAAAAJoAQcKAGguAVHonkr8EHq0mlb4Y5hQk6khZSdkkYHDVyG5etWXMPyQfhiFoULeqd-KXKRLN2Vdf6cTllL-pWH4Jrc75ajxceCHyx2j4Wi8g5P2et-erdm9n1U2IiYjmjtJDRvm-MKJDZgWKdXy4JkC4qkOcsPrRt60dmfk2-_37uupEuxekW847croi6mPG9fRXY6XfHjtw1tbXTu4lEwAcOsn49Ir4q9YdXlo6eABbjM51sNJzPzFzWIPA9bOyzEGA_esu9UllAlFnynLvB-8Xk6ODSUg5h7eCl58x-HqxYAA1RYgMcmXCNDUREhYEvj1WYhiiR1A4UOXWlyJRCMOkHt5BuiXLPpRSCv1nJcWZVfGRH9Oa-GDKO04SpLuqRqeNwgLL3lfrrVdjEtG_eQ2e5_eV2Xo63ZXAjTcBTe5dMfHU2zpbyRkNcwqx-eTBWLXF15axa5apRJzZ5f-1DxS30jw3EJ5LEUwZU2uh4yDyRJtQthFBWr8to-KlkR9Q662eXZe9x2GZNop8TNQSpKyWzk7-pcHJQAVeu_fUXPerCu1Q3NDmUB1GteFHjsa1XZ25cLD6QRxqiQFgAaTESPdGPzkHB0irzxf1_OzxXYdYjs0vu0LUUmlALi-SYOkRG8suzpPtfuLBjjf4oTEkrjh7SzPtEW4zOhBosfl9X-hCZy5hG7grItYSbZJbBp82mZXNieVS2k6m4qFEjYG6XlZG20Mjfw6XPyQwnVU27m4VlNh_MispRWsKNH7-onjTB0WPE6PfEpGQZgUC-XHdDicY-gq45X2-hLPPS3gXL-Dk3YK471tnEG7FxavJBqMwQwC-oZibM2KHo6GosTnjXbbapehZtzJKPtLjfO8AfeVddK57tjNKZkn17G6aFMNi5MKpcEvDXrdWi45sV7Zsd4dME2KGk6Oy1z4x8ZYO08n5PgfAQLKu5KZ59vDdXxZ9q_G2EAI8K2vl-NptRpaEYJKI_4Kw_fh0ipAZCVNQ7tOyO-XENsfGKsIaLjXPyhM71je8sCu6MKq3pgdeoS98fZrb3mr2MHNARADKDOS3lzMICH8KR_0xakwS6bLC4z0uuplIavRv3xolr8su5454o5Faeo6XSodiq3TmKV6wx4kOhq6Yg

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C984 0
0 283ms
283ms Fetch
image/gif 74.125.68.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvutqkl9jOI6wMqbNSP9B7kChnprQy2cBknXUIE-6kpRkvaV1eARLAUM_B0nrV1ifKWw6mBBjpCuGF-ZFdE9OezL78p3fSZl1JB6xdw76seI0s2WFgBWy8P-G7K38pWhidwzmwL4mnE5LsBjHHQiG9q6Q&sai=AMfl-YTNzULp1k5D7dMHzWIvsZlhKR4Mty4fbd7JlteyfPAbeHE2V7QA8WjtbpmCWDE9qJ3XV5DjgHcD5uMmW-U4uZCAHkSVBh7EjSZLrwKu&sig=Cg0ArKJSzKM-bqA4PdpOEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=514&vt=11&dtpt=512&dett=2&cstd=0&cisv=r20221207.11903&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=92.271;sz=300x250;u_sd=1;dc_adk=2857193491;ord=0r15sy;uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd;dc_rfl=1,https%3A%2F%2Fwww.bg3.co%2F$0;xdt=1;crlt=bS2EV(Sz0u;stc=1;chaa=1;sttr=308;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:58 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 25 Dec 2022 04:32:58 GMT

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame A398 36 KB
16 KB 273ms
273ms Script
text/javascript 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 15:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48274
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Dec 2023 15:08:24 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 97A9 34 KB
10 KB 252ms
251ms Script
text/html 23.44.27.86
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.27.86 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-44-27-86.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 31c34f97d95bcda3029d64ab92e319fdfe0e52085f89cad9caf6ea4fc3e05e8d

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:58 GMT
Content-Encoding: gzip
Last-Modified: Sat, 24 Dec 2022 23:09:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66962
Connection: keep-alive
Content-Length: 10066
Expires: Sun, 25 Dec 2022 23:09:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 48D7 42 B
64 B 283ms
283ms Fetch
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst5IFZ14zTssX5Ip2rNLtXR5O9P5S9C6ECnYgE--OCN2L-I7vg0X0uvrG_MTIRxqlw7EoJrxoehsNf4OTJ_-A1J5e1_UpchLTYto-t1FEOwoA08d-h5oXa6kZHwbRfx113vNpc&sai=AMfl-YS4D5-iYs9AZtLooLXwbr3tqc_47cQV-0ZCLLkvRamATQ3hxjI5_ZbKYhwo3HI9m-6It0tlXySsKXmRP-eXZ3_dMDEyvtoqqNWRMARwDcbyEuuzKZdCgGPSdmvm1y0&sig=Cg0ArKJSzIVW84CwriZdEAE&cid=CAQSPADq26N9Jee0olqkCnYexCxgdrKogFvE5EuF1hJqXSwNVXUZjhZH-mpDCe_y3Odx4GfP560bpwmgUOyhUBgBIBM&id=lidar2&mcvt=1000&p=1110,436,1200,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221207&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2857874404&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1671942775291&rpt=2168&isd=0&lsd=0&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame EE91
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3658&xuid=9e435674-81e6-45f7-8970-c8c3377de7ea&dongle=0cfd

37 B
355 B

237ms
237ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=9e435674-81e6-45f7-8970-c8c3377de7ea&dongle=0cfd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Sun, 25 Dec 2022 04:32:58 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://eb2.3lift.com/xuid?mid=3658&xuid=9e435674-81e6-45f7-8970-c8c3377de7ea&dongle=0cfd
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 209

GET
H2

200

ebda
eb2.3lift.com/ Frame EE91
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzQ2NDEzNTYzNDk0Mjc1MjY3NDU2MQ%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

235ms
235ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:59 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame EE91
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEIs2jsQfyB6zKwNmGuQfPz4&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
355 B

239ms
237ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEIs2jsQfyB6zKwNmGuQfPz4&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Sun, 25 Dec 2022 04:32:58 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEIs2jsQfyB6zKwNmGuQfPz4&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EE91
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzQ2NDEzNTYzNDk0Mjc1MjY3NDU2MQ%3D%3D

170 B
189 B

277ms
276ms

Image
image/png

74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzQ2NDEzNTYzNDk0Mjc1MjY3NDU2MQ%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzQ2NDEzNTYzNDk0Mjc1MjY3NDU2MQ%3D%3D
date: Sun, 25 Dec 2022 04:32:58 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame EE91
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=3464135634942752674561&dbredirect=true&gdpr=0&consent=
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=3464135634942752674561&dbredirect=true&gdpr=0&consent=&cookiesTest=true

0
359 B

371ms
371ms

Image
text/plain

13.107.42.14

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=3464135634942752674561&dbredirect=true&gdpr=0&consent=&cookiesTest=true
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 13.107.42.14 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:59 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 4C001D05F875488CA0AF1B00F8CF6D9C Ref B: SYD03EDGE1521 Ref C: 2022-12-25T04:32:59Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXwn4N0BkII/lnB1E5/Fg==

Redirect headers

date: Sun, 25 Dec 2022 04:32:59 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: F5B97BC3111F4C8E869ECAF8BD61AA8D Ref B: SYD03EDGE1521 Ref C: 2022-12-25T04:32:58Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: /setuid?partner=tripleliftdbredirect&tlUid=3464135634942752674561&dbredirect=true&gdpr=0&consent=&cookiesTest=true
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXwn4NtnCIxzGxqUa+mWQ==

GET

v2
odr.mookie1.com/t/ Frame EE91
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=3464135634942752674561&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=9f60581a-57f5-43d5-928e-bbfd1f31b6d0&ssp=triplelift&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10521605010143626279&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vi...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2910&partner_device_id=10521605010143626279&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26...
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=ff1722a2-750e-48bf-902e-dee608889832&ssp=triplelift&gdpr_consent=&gdpr=0

0
0

GET
H2

200

xuid
eb2.3lift.com/ Frame EE91
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/3464135634942752674561?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-dJwbo.tE2oSqYEOD4prgehXlwQisMo5hfDIs4P30Ig--~A&dongle=0883

37 B
355 B

237ms
237ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-dJwbo.tE2oSqYEOD4prgehXlwQisMo5hfDIs4P30Ig--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Sun, 25 Dec 2022 04:32:58 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Sun, 25 Dec 2022 04:32:58 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-dJwbo.tE2oSqYEOD4prgehXlwQisMo5hfDIs4P30Ig--~A&dongle=0883
content-length: 0

GET

iu3
s.amazon-adsystem.com/ Frame EE91
Redirect Chain

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=0&gdpr_consent=&uid=3464135634942752674561
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=0&gdpr_consent=&uid=3464135634942752674561&dcc=t

0
0

GET
H2 200 c.gif
c.bing.com/ Frame EE91 42 B
667 B 807ms
287ms Image
image/gif 13.107.21.200

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=3464135634942752674561&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.21.200 -, , ASN (),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:59 GMT
last-modified: Tue, 13 Dec 2022 19:05:59 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 50DE8C1768444556870E88F97AC34F86 Ref B: SYD03EDGE1319 Ref C: 2022-12-25T04:32:59Z
etag: "66efadef25fd91:0"
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-type: image/gif
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

GET
H2

200

xuid
eb2.3lift.com/ Frame EE91
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent=
https://eb2.3lift.com/xuid?mid=3335&xuid=4130365497667016386&dongle=4d58&gdpr=0&gdpr_consent=

37 B
355 B

238ms
237ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3335&xuid=4130365497667016386&dongle=4d58&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Sun, 25 Dec 2022 04:32:59 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Date: Sun, 25 Dec 2022 04:32:59 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.208; 116.90.74.208; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 3be79684-7fc2-467a-abcb-7121e5acb554
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://eb2.3lift.com/xuid?mid=3335&xuid=4130365497667016386&dongle=4d58&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 1304 694 B
682 B 1551ms
242ms Script
text/javascript 69.174.120.106

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=723&ttfrms=9&brid=3&brver=89.0.4389.72&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D38b%5D4%40TauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D38b%5D4%40Tar9EEADTbpTauTau_g_fhg7hfceg%602f__%60c7gaf4gd2d2%603b%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauHHH%5D38b%5D4%40Tau2TauJ%3A%3F8%5CE%3A%5C%3B%3A2%3F%5CK%3A%5CHF%5CDF%5CK2%40%5CH2%3F%5C%3E6%3A%5CD96%3F%5C42%3A%5CD92%40%5C%3FF%5CD9%3A%5C52%3A%5C52%5CI%3AF%5CI%3AF%5C492%3F8%5C%3E6%3A%5CEF%3A%5D9E%3E%3D&srcurlD=0&aUrlD=-1&ssl=https:&uid=1671942778593368&jsCallback=dvCallback_1671942778593496&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=3326&tgjsver=3326&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2F080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&fcifrms=18&brh=2&sdf=2&dvp_epl=430&noc=4&nav_pltfrm=Win32&ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&adsrv=0&advid=3398311&turl=https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVPX_PP_IMP_ID=ABAjH0jjEdrLbI5D-dLfjSzFmk8T&DVP_DBM_1=3060631&DVP_DBM_2=23009949&DVP_DBM_3=16740933992&DVP_DBM_4=416816016&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=881479034793&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=38046598.17555688&dvp_tukv=1070969726.8576708&dvp_uuid=3603207397.6117086&dvp_strhd=0.3000001907348633&dvpx_strhd=0.3000001907348633&dvp_tuid=1262711400958&jurtd=2502493379
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3326.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.174.120.106 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d552082adeb4b05d72ccfafc49a94d1ab0e9b3bef769fdefdb5029d0d43d6bb0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:33:00 GMT
Content-Encoding: br
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Expires: 12/24/2022 04:33:00

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6695
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=9e435674-81e6-45f7-8970-c8c3377de7ea&expiration=1674534778&gdpr=0&gdpr_consent=

43 B
766 B

1069ms
352ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=9e435674-81e6-45f7-8970-c8c3377de7ea&expiration=1674534778&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:59 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=9e435674-81e6-45f7-8970-c8c3377de7ea&expiration=1674534778&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 6695
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y6fSdEsLo7_OJzESs7eqOQAAFMEAAAAB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEDSA3e9cRHKlUsTO-4mg16U&google_cver=1

43 B
838 B

500ms
378ms

Image
image/gif

172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEDSA3e9cRHKlUsTO-4mg16U&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H3
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:59 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iT5PdZiADyCQBhj0QJ7CaEmJbdicotzJTENUhhBEzmDwjs6eT6w75xXsy2kn1Qd1EqlAiu5G8lBMS39ofWWj0%2FL%2F1UulbHLkwqFeSgSEM7A3Wrkhq1ylxWQsXeJ1ueTs7PJi4s7oDDWr6w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 77eedb212a421c5a-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEDSA3e9cRHKlUsTO-4mg16U&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

dcm
s.amazon-adsystem.com/ Frame 6695
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y6fSdEsLo7_OJzESs7eqOQAAFMEAAAAB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y6fSdEsLo7_OJzESs7eqOQAAFMEAAAAB&dcc=t

0
0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6695
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=4130365497667016386

43 B
766 B

608ms
352ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=4130365497667016386
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:59 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Date: Sun, 25 Dec 2022 04:32:59 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.208; 116.90.74.208; 904.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 1f4e4aca-1863-4c66-98f4-f6cb53291f2c
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=4130365497667016386
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6695
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=index_exchange
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=206&external_user_id=Y6fSesCo8YMAAOAA2C8AAAAA

43 B
766 B

1015ms
343ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=206&external_user_id=Y6fSesCo8YMAAOAA2C8AAAAA
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:59 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

X-SO-Cluster-ID: 0
Date: Sun, 25 Dec 2022 04:32:58 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=index_exchange","cluster_id":0,"gdpr":false,"ipv4":"116.90.74.208","key":"Y6fSesCo8YMAAOAA2C8AAAAA","privacy_sensitive":false,"uid":"","upstream_id":"a-ad40293"}
X-SO-Key: Y6fSesCo8YMAAOAA2C8AAAAA
Server: nginx
X-SO-Upstream-ID: a-ad40293
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=206&external_user_id=Y6fSesCo8YMAAOAA2C8AAAAA
Cache-Control: private
X-SO-HostName: a-ad40293.dc2p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 2
Content-Length: 0
X-SO-LB-Hostname: m-tgng31.dc4p.scaleout.jp
X-SO-IP: 116.90.74.208

GET
H2

200

crum
dsum.casalemedia.com/ Frame 6695
Redirect Chain

https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e
https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=dd64879c-314f-6234-756c8e66

43 B
412 B

481ms
266ms

Image
image/gif

104.18.33.19

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=dd64879c-314f-6234-756c8e66
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Server: 104.18.33.19 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:59 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dc0eFj40YuR9%2BEIt9yNFq%2FFc8PpHmjxzu942HWVTrLr7l4nMhMxTQlOeYyvIcohAS2K%2FgURBfRz%2B0h5l4%2FmUqjCFw5BH%2Bfp6kyQrrfnc5gSBXhx9DR%2BVdZF1Gxf2ZsEaig3oObI8"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 77eedb240af1a8ad-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Sun, 25 Dec 2022 04:32:59 GMT
via: 1.1 google
server: nginx/1.22.1
p3p: CP='This is not a P3P policy!'
access-control-allow-origin: *
location: https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=dd64879c-314f-6234-756c8e66
content-type: text/html; charset=utf-8
cache-control: max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 119

GET
H2

200

crum
dsum.casalemedia.com/ Frame 6695
Redirect Chain

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=4130365497667016386

43 B
870 B

786ms
261ms

Image
image/gif

104.18.33.19

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=4130365497667016386
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Server: 104.18.33.19 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:59 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PrwyY8qIK43uxGcqYg2vL2NkKweiOsxbUC0nFDwZwZPLXvAlJ%2B2URcRbUptNlrWd1Lq7SVwxlF%2BbKOQbGDhj8ty1cVwACKPman8aGwsEJWUDcUPiJXJmC37ByWMZjPfQd0VuDgIl"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 77eedb240aefa8ad-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Date: Sun, 25 Dec 2022 04:32:58 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.208; 116.90.74.208; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: fd0cbb15-3996-4fc6-962b-012799d5d237
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=4130365497667016386
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET

crum
dsum-sec.casalemedia.com/ Frame 6695
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
https://pm.w55c.net/ping_match.gif?scc=1&ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=cazG9mwo1P9iH15

0
0

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 6695 43 B
353 B 381ms
127ms Image
image/gif 104.18.36.94

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?Y6fSdEsLo7-OJzESs7eqOQAA%265313
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.94 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:59 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 58528
etag: "902a3d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 77eedb251abf1c4d-AKL
content-length: 43
expires: Mon, 26 Dec 2022 04:32:59 GMT

GET
H2 200 sync Show response
gum.criteo.com/ Frame 1E3B 61 B
301 B 435ms
235ms Script
text/javascript 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?r=2&c=321&gdpr=0&gdpr_pd=0&gdpr_consent=&us_privacy=&j=window.advBidxc.mnetRtusId

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

f77f47058428a1c21dad5a75ac13fbfdeb9858947218fee2112fded5972a0b5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:58 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 280578
expires: 60

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 4E4C
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=medianet
https://eus.rubiconproject.com/usync.html?p=medianet

281 B
554 B

378ms
376ms

Document
text/html

23.44.27.86
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=medianet
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.27.86 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-44-27-86.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 25 Dec 2022 04:32:59 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sun, 25 Dec 2022 04:32:59 GMT
location: https://eus.rubiconproject.com/usync.html?p=medianet
server: AkamaiGHost

GET
H2

200

cksync.html Show response
contextual.media.net/ Frame 6429
Redirect Chain

https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3149443787444821000V10%26type%3Drkt%26refUrl%3D%26vid%3D194277864531494437874448210...
https://contextual.media.net/cksync.html?cs=8&vsid=3149443787444821000V10&type=rkt&refUrl=&vid=19427786453149443787444821000V10&ovsid=2020216287660865539

219 B
651 B

325ms
324ms

Document
text/html

23.50.118.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3149443787444821000V10&type=rkt&refUrl=&vid=19427786453149443787444821000V10&ovsid=2020216287660865539

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.118.44 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

85af3052d288ffd9157258dfe4daf5309f0b64d0067ab8221cd0c62909c18419

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 219
content-type: text/html;charset=UTF-8
date: Sun, 25 Dec 2022 04:33:00 GMT
expires: Sun, 25 Dec 2022 04:33:00 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

Redirect headers

Content-Length: 0
Date: Sun, 25 Dec 2022 04:32:59 GMT
Location: https://contextual.media.net/cksync.html?cs=8&vsid=3149443787444821000V10&type=rkt&refUrl=&vid=19427786453149443787444821000V10&ovsid=2020216287660865539
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame DFA9 16 KB
6 KB 1154ms
362ms Document
text/html 184.31.28.212

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3149443787444821000V10%26type%3Dpba%26refUrl%3D%26vid%3D19427786453149443787444821000V10%26ovsid%3DPM_UID
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.28.212 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=25152
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Sun, 25 Dec 2022 04:32:59 GMT
expires: Sun, 25 Dec 2022 11:32:11 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

cksync.php
contextual.media.net/ Frame 1E3B
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3149443787444821000V10%26type%3Dapx%26refUrl%3D%26vid%3D19427786453149443787444821000V10%26ovsid%3D%24UID
https://contextual.media.net/cksync.php?cs=8&vsid=3149443787444821000V10&type=apx&refUrl=&vid=19427786453149443787444821000V10&ovsid=4130365497667016386

45 B
453 B

320ms
320ms

Image
image/gif

23.50.118.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3149443787444821000V10&type=apx&refUrl=&vid=19427786453149443787444821000V10&ovsid=4130365497667016386

Requested by

Protocol

Server

23.50.118.44 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Sun, 25 Dec 2022 04:32:59 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Sun, 25 Dec 2022 04:32:59 GMT

Redirect headers

Date: Sun, 25 Dec 2022 04:32:58 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.208; 116.90.74.208; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 79c9930e-f8c9-41ed-8034-764bfadb3096
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3149443787444821000V10&type=apx&refUrl=&vid=19427786453149443787444821000V10&ovsid=4130365497667016386
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cksync.html
contextual.media.net/ Frame 1E3B
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=78e2dffc-bb89-4bb2-ae92-f592d006518b&ph=6a16560a-f6c6-4851-b7b5-0b2c0190166a&r=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3149443787444821...
https://contextual.media.net/cksync.html?cs=8&vsid=3149443787444821000V10&type=opx&refUrl=&vid=19427786453149443787444821000V10&ovsid=797a7979-82dc-444d-b982-4992aec5031b

219 B
219 B

323ms
323ms

Image
text/html

23.50.118.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3149443787444821000V10&type=opx&refUrl=&vid=19427786453149443787444821000V10&ovsid=797a7979-82dc-444d-b982-4992aec5031b

Requested by

Protocol

Server

23.50.118.44 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Sun, 25 Dec 2022 04:32:59 GMT
server: Apache
vary: Accept-Encoding
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: text/html;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
content-length: 219
x-mnet-hl2: E
expires: Sun, 25 Dec 2022 04:32:59 GMT

Redirect headers

date: Sun, 25 Dec 2022 04:32:58 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://contextual.media.net/cksync.html?cs=8&vsid=3149443787444821000V10&type=opx&refUrl=&vid=19427786453149443787444821000V10&ovsid=797a7979-82dc-444d-b982-4992aec5031b
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

cksync.php
contextual.media.net/ Frame 1E3B
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3149443787444821000V10%26type%3Dmma%26refUrl%3D%26vid%3D194277864531494437874448...
https://contextual.media.net/cksync.php?cs=8&vsid=3149443787444821000V10&type=mma&refUrl=&vid=19427786453149443787444821000V10&ovsid=074c63a7-d279-4a00-948d-3306a63009cc

45 B
465 B

331ms
330ms

Image
image/gif

23.50.118.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3149443787444821000V10&type=mma&refUrl=&vid=19427786453149443787444821000V10&ovsid=074c63a7-d279-4a00-948d-3306a63009cc

Requested by

Protocol

Server

23.50.118.44 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Sun, 25 Dec 2022 04:32:59 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Sun, 25 Dec 2022 04:32:59 GMT

Redirect headers

Date: Sun, 25 Dec 2022 04:32:58 GMT
Server: MT3 277 3f0ad7a master hkg-pixel-x17 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://contextual.media.net/cksync.php?cs=8&vsid=3149443787444821000V10&type=mma&refUrl=&vid=19427786453149443787444821000V10&ovsid=074c63a7-d279-4a00-948d-3306a63009cc
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sun, 25 Dec 2022 04:32:57 GMT

GET

9e435674-81e6-45f7-8970-c8c3377de7ea
sync.1rx.io/usersync/tradedesk/ Frame 1E3B
Redirect Chain

https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3149443787444821000V10%26type%3Dr1%26refUrl%3D%26vid%3D19427786453149443787...
https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&zcc=1&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3149443787444821000V10%26type%3Dr1%26refUrl%3D%26vid%3D19427786453149...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=1299906263
https://sync.1rx.io/usersync/tradedesk/9e435674-81e6-45f7-8970-c8c3377de7ea

0
0

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 1E3B
Redirect Chain

https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MzE0OTQ0Mzc4NzQ0NDgyMTAwMFYxMA%3D%3D&google_sc=1
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEHVY34dicj7_GltnFJd8sbM&google_cver=1

45 B
610 B

1071ms
374ms

Image
image/gif

184.50.20.24

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEHVY34dicj7_GltnFJd8sbM&google_cver=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Server: 184.50.20.24 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:59 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 45
X-MNET-HL2: E
Expires: Sun, 25 Dec 2022 04:32:59 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEHVY34dicj7_GltnFJd8sbM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 1E3B
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3149443787444821000V10%26type%3Ddxu%26refUrl%3D%26vid%3D19427786453149443787444...
https://pm.w55c.net/ping_match.gif?scc=1&ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3149443787444821000V10%26type%3Ddxu%26refUrl%3D%26vid%3D19427786453149443...
https://contextual.media.net/cksync.php?cs=8&vsid=3149443787444821000V10&type=dxu&refUrl=&vid=19427786453149443787444821000V10&ovsid=nm4lvodr1P9iH15

45 B
451 B

305ms
304ms

Image
image/gif

23.50.118.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3149443787444821000V10&type=dxu&refUrl=&vid=19427786453149443787444821000V10&ovsid=nm4lvodr1P9iH15

Requested by

Protocol

Server

23.50.118.44 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Sun, 25 Dec 2022 04:33:00 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Sun, 25 Dec 2022 04:33:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:59 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/4da9b91#4da9b91e1fcbbaec3beafc6ce8a7393d26d4f693 i-073b79ef04ecf1c9e@ap-southeast-1b@dxedge-app-ap-southeast-1-prod-asg
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3149443787444821000V10&type=dxu&refUrl=&vid=19427786453149443787444821000V10&ovsid=nm4lvodr1P9iH15
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 1E3B
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=115&p=226&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=28b1d8ed-53cf-47ae-b2f1-5663a8af6759

45 B
616 B

347ms
346ms

Image
image/gif

23.50.118.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=28b1d8ed-53cf-47ae-b2f1-5663a8af6759

Requested by

Protocol

Server

23.50.118.44 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Sun, 25 Dec 2022 04:32:59 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Sun, 25 Dec 2022 04:32:59 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=28b1d8ed-53cf-47ae-b2f1-5663a8af6759
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1000180
content-length: 0
expires: Sun, 25 Dec 2022 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 1E3B
Redirect Chain

https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
https://sync.mathtag.com/sync/img?mt_exid=46&redir=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D80%26user_id%3D%5BUUID%5D%26expires%3D30%26ssp%3Dmedianet%26bsw_param%3D9f60581a-57f5-43d5-928e-bbfd1f31b6...
https://x.bidswitch.net/sync?dsp_id=80&user_id=074c63a7-d279-4a00-948d-3306a63009cc&expires=30&ssp=medianet&bsw_param=9f60581a-57f5-43d5-928e-bbfd1f31b6d0&gdpr=0&gdpr_consent=
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=9f60581a-57f5-43d5-928e-bbfd1f31b6d0&gdpr=0&gdpr_consent=&gdpr_pd=

45 B
465 B

310ms
310ms

Image
image/gif

23.50.118.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=9f60581a-57f5-43d5-928e-bbfd1f31b6d0&gdpr=0&gdpr_consent=&gdpr_pd=

Requested by

Protocol

Server

23.50.118.44 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Sun, 25 Dec 2022 04:33:00 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Sun, 25 Dec 2022 04:33:00 GMT

Redirect headers

Location: //contextual.media.net/cksync.php?cs=1&type=bs&ovsid=9f60581a-57f5-43d5-928e-bbfd1f31b6d0&gdpr=0&gdpr_consent=&gdpr_pd=
Date: Sun, 25 Dec 2022 04:32:59 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET

23178
stags.bluekai.com/site/ Frame 1E3B
Redirect Chain

https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3149443787444821000V10%26type%3Dzem%26refUrl%3D%26vid%3D19427786453149443787444821...
https://stags.bluekai.com/site/23178?id=yEoLZgmt366HzZFQBTwo&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...

0
0

GET sync
rtb.mfadsrvr.com/ Frame 1E3B 0
0

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 1E3B
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent=
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=9e435674-81e6-45f7-8970-c8c3377de7ea

45 B
621 B

874ms
378ms

Image
image/gif

184.50.20.24

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=9e435674-81e6-45f7-8970-c8c3377de7ea
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Server: 184.50.20.24 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:33:00 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 45
X-MNET-HL2: E
Expires: Sun, 25 Dec 2022 04:33:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:59 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=9e435674-81e6-45f7-8970-c8c3377de7ea
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET dcm
aax-eu.amazon-adsystem.com/s/ Frame 97A9 0
0

GET

ECvwgfdioVScxdgI8GdBqw
pr-bh.ybp.yahoo.com/sync/rubicon/ Frame 97A9
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/ECvwgfdioVScxdgI8GdBqw?csrc=

0
0

GET

pixel
cm.g.doubleclick.net/ Frame 97A9
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YzIwNWJmMDVjM2I1Mjk0MmU1NmE4M2NkNDQ4M2ZhNzU2OGY0YjAxMA

0
0

GET

setuid
px.ads.linkedin.com/ Frame 97A9
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LC2VK46N-W-5OS3

0
0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 97A9
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=9e435674-81e6-45f7-8970-c8c3377de7ea&gdpr=0&gdpr_consent=&expires=30

42 B
678 B

1245ms
237ms

Image
image/gif

69.173.158.64

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=9e435674-81e6-45f7-8970-c8c3377de7ea&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: HTTP/1.1
Server: 69.173.158.64 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: c80248407eff6cf595ce43a76c04e23f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=9e435674-81e6-45f7-8970-c8c3377de7ea&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 97A9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELRz6nrZgoWKKiBJAYKwBm4&google_cver=1

42 B
678 B

1113ms
237ms

Image
image/gif

69.173.158.64

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELRz6nrZgoWKKiBJAYKwBm4&google_cver=1
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html
Protocol: HTTP/1.1
Server: 69.173.158.64 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: dedf7fc216a5bbc739a54325e875a79f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELRz6nrZgoWKKiBJAYKwBm4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

pixel
cm.g.doubleclick.net/ Frame 97A9
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEMyVks0Nk4tVy01T1Mz

0
0

GET

dcm
s.amazon-adsystem.com/ Frame 97A9
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t

0
0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 070F 42 B
64 B 284ms
282ms Fetch
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsufkX0GoDuxuUgLMxEkRAOpyxCbjIdsAuDo4FRdVPjinb6PdQNHNFriCHYS4Qpicz0fK2LHdmTvvISB3UhNcR3PMDnQOCMz7NArRwScjYrEnyDUmElrg0Qq1vHCYYlDd8mx0nA&sai=AMfl-YSK-U8tH9LOtOz6aYgEySAq4OsQ10lasW2QudRq3QNiogw_UnRwTmJ9NO_hwSC_etSxEcoXPBWueyfgwQf_aYSH58RrhFPnUXgfV9Tx41Nf5otswEDcgTCABM9IQPE&sig=Cg0ArKJSzKryN5yUfM44EAE&cid=CAQSPADq26N9Jee0olqkCnYexCxgdrKogFvE5EuF1hJqXSwNVXUZjhZH-mpDCe_y3Odx4GfP560bpwmgUOyhUBgBIBM&id=lidar2&mcvt=1005&p=300,84,340,125&mtos=1005,1005,1005,1005,1005&tos=1005,0,0,0,0&v=20221207&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=4082231052&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1671942775294&rpt=1735&isd=0&lsd=0&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A398 0
25 B 278ms
276ms Image
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BGn0OedKnY6PDHcGyvgSU-6eoBQAAAAA4AeAEAg&bg=!h4SlhMDNAAYgquz3AKo7ACkAdvg8WuGd7sMLNllXUgFkzOQQplF32soUB7hh7pIK7Ksw41C1rClWawIAAABaUgAAAAJoAQeZAuGm0IvSUtFZTzc3I1IwMbEV1AekxWPbNK20vWwjDQcvqo7NYC6GDx6H-ATn_EuX1RDP_5Iuvk2j54MMescsRJreT5QB3yCNWtj1iZrU7vS0npr5Agu_vD00JB_EPUzFSvQsk_NLa9e1xc6Kor663o8zblnJ3xq5k0yqK-6kUofQdv-RQPCzqHHl96QuUtsc82au2JT_dRhQY7N55lHHAdu8vi5xCog_Zjk5_ssfC4AlUOTEDXjakNky1HTdMYriAnuZJh-8H6e2SkXk2nu3_UExua26irLukvu-3n1Q-wWrlmlgyIZI7XvWDl4e87aSx8N3GSxuwj2Heg7f9EjamOSe3XE4y8y0ER_9wp5zaQQ-qCBugWIT6O7DKHNQv9x5HdQjk50g6DZkJ5bLpmSgm6XnfVSWwNvFBOpbawhIHzYby9WETXfJATWw0HpJM9XZQhkqv0BJYC7SagE3TmJuwQxgquBAXR2FCMSlzFlBtTWXyd5a42yfwfoKUCIHnCb4TcdPx5Z51i04qSScr-CsTJPPw8HfBVcbJlw8GodB9LXka-M3Y_YmkhXnPZcupcIQ_LKwaUqEy-fVxJWlsMWM-0ay2wtIk4GIXSTOWvV-3GaEXNPZCu4Zg0BSO2-45WJpWLAxoIE_B5oSIQdG2OYUsRXU64qX0s5MS6JIBk2bh4SVxXQS4wUmy2Iw5wwVjA4Wh0vALuMuTrsht-2tHWVMMq44ou1lf3I9pNO8XbJj94TezoKZcdCjaGWLCU53XX1DBzv4AGhYAAzjLHvnYZbDeVUIsKpH9PPwleD6Mk_P1SuVsAeRJxpCIifoPCl8vP0T8VJiKQSAqAXhZulrJjZ4nwuVWnBlBYQ1qp4XU7NI9maE89TLB1DQQxkYsosYkl_aNXzHL0X5fYzwvtG1m9uslu5LHtB202wiHGe891bPEfcfNYCPFdK8EaG7eOro8Y6CR9DURFjitIaTaN_SCaOXBMOwfQ

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame 9F0D 5 KB
2 KB 826ms
271ms Document
text/html 52.192.213.151

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.192.213.151 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 8467015195771436c8f2ee440b88258c342422779119594ab24d859bd4603cd6

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Sun, 25 Dec 2022 04:32:59 GMT
etag: W/"06aa9244d80b206722b482cc25df047b9"
server: nginx
timing-allow-origin: *

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 82F3 2 KB
814 B 393ms
391ms Document
text/html 51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.100 , Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame 4357 782 B
1 KB 1359ms
236ms Document
text/html 23.106.127.52

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.106.127.52 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ba6073e5c626a591d563bb0a34337863b952efbcc0ed4114fea43c277c85d243

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

content-length: 782
content-type: text/html
date: Sun, 25 Dec 2022 04:32:59 GMT

GET
H3 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame C3D9 2 KB
1 KB 459ms
365ms Document
text/html 172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 249726bfd9c81753340c7fbe3253f829728e58dc1bdd046fb09e2e7e5b735b9b

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 77eedb212a431c5a-AKL
content-encoding: br
content-type: text/html
date: Sun, 25 Dec 2022 04:32:59 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SxgSugAwSJ9MDc8Cx4R6zRj%2BVArwbN0oeVPOD77X0F8WaoMrcNwZ9BUUdVgZdPilu8Dv3OhqJQhd9%2FEa7%2FTgVWDkB9Cu31QmEfRpBh9ZiJolO4enmpPeA8L15hZY5JvadDNb%2FI%2B9PdRZsA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame D64C
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=duration_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east

281 B
554 B

264ms
261ms

Document
text/html

23.44.27.86
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.27.86 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-44-27-86.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 25 Dec 2022 04:32:59 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sun, 25 Dec 2022 04:32:59 GMT
location: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
server: AkamaiGHost

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 7F21 16 KB
6 KB 898ms
360ms Document
text/html 184.31.28.212

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.28.212 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=25152
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Sun, 25 Dec 2022 04:32:59 GMT
expires: Sun, 25 Dec 2022 11:32:11 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 sync-iframe Show response
cs-rtb.minutemedia-prebid.com/ Frame 5232 4 KB
5 KB 997ms
463ms Document
text/html 13.33.88.48

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.88.48 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 40a3e0dec23d4744e9b4444c9feb545263cd43c2b0eee2d90cce0b22c9fa1c93

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://public.servenobid.com/
content-type: text/html
date: Sun, 25 Dec 2022 04:32:59 GMT
via: 1.1 9f7a987f61c1e9f7d25cd5462f22a14a.cloudfront.net (CloudFront)
x-amz-cf-id: jgTHFr7Y35k54Kbuup_1tnXPYi848FcHZv4vgVa5Rbb-ru0HA7tYmA==
x-amz-cf-pop: SIN2-P2
x-cache: Miss from cloudfront

GET
H2

200

sync
ads.servenobid.com/ Frame F68C
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=4130365497667016386

0
344 B

406ms
406ms

Image
image/avif

52.16.72.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=4130365497667016386
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.16.72.231 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-72-231.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:59 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Date: Sun, 25 Dec 2022 04:32:59 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.208; 116.90.74.208; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 8e633cdb-4448-491f-92d4-16d85a190756
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://ads.servenobid.com/sync?pid=312&uid=4130365497667016386
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET

sync
ads.servenobid.com/ Frame F68C
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=F34wDRZHyyMgvh8gTH-TPCjD

0
0

GET

sync
ads.servenobid.com/ Frame F68C
Redirect Chain

https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID&sovrn_retry=true
https://ads.servenobid.com/sync?pid=310&uid=F34wDLZHQPM730iMQM2SzaDh

0
0

GET

9e435674-81e6-45f7-8970-c8c3377de7ea
sync.1rx.io/usersync/tradedesk/ Frame F68C
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1671942779569
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=6634544322
https://sync.1rx.io/usersync/tradedesk/9e435674-81e6-45f7-8970-c8c3377de7ea

0
0

GET

sync
ads.servenobid.com/ Frame F68C
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=1978557980675384727

0
0

GET usa
sync.go.sonobi.com/ Frame F68C 0
0

GET

usermatchredir
ssum.casalemedia.com/ Frame F68C
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F1257%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3D3216f05a-67f5-408c-9cd7-3cdf7180ba2e%26bidder%3Dappnexus%26cbx%3...
https://prebid.a-mo.net/cchain/0/1257?gdpr=0&gdpr_consent=&us_privacy=1YN-&A=3216f05a-67f5-408c-9cd7-3cdf7180ba2e&bidder=appnexus&cbx=aHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%3D&...
https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=1&gdpr_consent=&us_privacy=1YN-&cb=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F1%2F1257%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3...

0
0

GET
H2

200

sync
ads.servenobid.com/ Frame F68C
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ads.servenobid.com/sync?pid=337&uid=y-j6xKA.VE2uEcDgqio.C8M_15.2HFzIySqhl.FP8-~A

0
367 B

408ms
408ms

Image
image/avif

52.16.72.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-j6xKA.VE2uEcDgqio.C8M_15.2HFzIySqhl.FP8-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.16.72.231 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-72-231.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:59 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-j6xKA.VE2uEcDgqio.C8M_15.2HFzIySqhl.FP8-~A
date: Sun, 25 Dec 2022 04:32:59 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET redirectuser
ssp.disqus.com/ Frame F68C 0
0

GET

sync
ads.servenobid.com/ Frame F68C
Redirect Chain

https://ups.analytics.yahoo.com/ups/58632/occ
https://ads.servenobid.com/sync?pid=339&uid=y-j6xKA.VE2uEcDgqio.C8M_15.2HFzIySqhl.FP8-~A

0
0

GET
H3 200 index_120x600_google_atlas_P_1.png
s0.2mdn.net/sadbundle/4942068020373019979/images/ Frame 8E31 62 KB
62 KB 289ms
289ms Image
image/png 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4942068020373019979/images/index_120x600_google_atlas_P_1.png

Requested by

Host: 080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com
URL: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

650b2e3c7f96518f35734bd65759ad5522702bea1cca8b5b658af9428c4c3f84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4942068020373019979/index_120x600_google.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:59 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63681
x-xss-protection: 0
last-modified: Mon, 05 Sep 2022 15:11:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 25 Dec 2023 04:32:59 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 070F 0
0 279ms
279ms Fetch
image/gif 74.125.68.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssDPLngyjI07NFrqnGQdkKodlQHvunXGlJY5iDJxeytbKjyQXZBVCdudf-8m116t6CDolgnzTQRVVUNFMcHDsGrMJMbSFHXdTnjeJ1nMFq7ObZWqSVIDcjnOnu02tEIk2vzHrY_8MKJzI7vWtNURpRKZfXRdXSMKjHa9Yj8x6ptgBLKAnEUXfPPN3JDHmqAwStQAmYDGZ0cyprEcLxUaV-oHV_08lv5JT_yCKv9VxhhnVnLUs72khWTB6S0w0mD-vp_xR5lYBchnwOYD3OkckO1At6lgnates_lNF7QOScmAB4qMPiYJS9MFxOG8Ya3LX1bnwDdNDxnJZJPwAH5BMnYEmFneaAYEsP0bTzbARj6l-U6b8eH9VIRqAWEPjSbijOVbc0Iab7AR7FbtQK2F4uhFjP1PWz29NwP0j6bChBCH1KqMdJmV39_2RfGUwkvRXKeCKcteFqCRNRBi5h7mhc2teBMqZwiKr1VVgCOhM7_aS5nwVFPN9nmYjhrjNMbwFzmX6N6pzLb6Osegh9L_25jb9L2yf3QxUbRcn7JxIM4ALM1x_9bAkdSmlpvhHupcWo0g_hseutww5mNDlmfPW62mcV3lSMdIWdQFpPC0TIE-yO7mUWM0SzK1ydvckUfjsI1HUxEFXPYvJ9H27OmrlgS4QAXjY0LNXGAjohinkklh6-mKit4GM63YwT8jFGAncQmQQOSNQJ4oxjgQq4xDKRvBYkhWwLumaba-Bm_QiOzY2XXnbcJ2YkZf8Hmc9ytoBmd9XLzr8_0wRxclewVEnUGYoCZipIKBWUEdpqLhUtjj6t8JuZPO11Z7aw6D8CrFhfI8Ml__1ng7PcIG-ebuZ6TDq0YxPwT6SYrSM8dhd4dh1pFlN6FpSe8fWK5HtVp4VbVA-hqCkJLvxizKFKrTfqKSnYMxwyUUqs5qgtM0Mm_vrt5hIj0bPjDn1r_ReU8crum5gYLh2TUEksTKfWJRimeBHZg-46AYMYEJiU3EWdT18nI6Yx_j_b-0R2H5O1BtU9K742Vy1UMJhWOQr8cn5xWM-OOW643nF1BQ-FccKbYzN1PrFJoV-yTlZrpkGpW7NaxvnMuqkW1PeRjsIdQbHTIsgf8JZfkVhgJoyFLOl2qFAzbm_x_Gg-can4Z59feHDGnVDP4oR9xmgYhwcJ8cVNCWQFUYIytxpcD1lj2BdBI6s0TUPlIFsatPtt2NxLlqt7lEAq0sNzZGDlsVys_9CanrjLojdHhEgdKCl7IOTcJe99HYqpa0SV-h7YgxnlxSintAu4_rKYZDK2-6DenytMhPFDWbLY07s4msQEb5sHRVs0yuXWrbbLCzsx77w&sai=AMfl-YTYjGqofy7UhTFPdItHFj4TO3EiQAjMpA6QAd0a9IPp3hxzZ7V8toQhPN6uNAK1Gt4ao8LobNU3YSXQsoU5Z2np-ZT-8oZ0NB6ATACeKUYp3kGSBhJtv64DlyP97Dvmj1JlqHO-8uJacJ07tk-Wtm8nnqqtw7H7mVsQi-jgia-D1j2IYLSI_HD9lWbsOqSCf_u5BVkw2O5WXwUjRu43c3woJNNfD9hDmlqXjTdATftzA2ktDgSBejs9y3HwOTZhgmOaDL2ArEGCFg&sig=Cg0ArKJSzIK70WkUZuJNEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2205&vt=11&dtpt=1125&dett=3&cstd=1076&cisv=r20221207.79629&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.68.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 25 Dec 2022 04:32:59 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 39D5 0
859 B 288ms
287ms Script
text/html 104.254.148.252
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.148.252 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:32:59 GMT
AN-X-Request-Uuid: 04877c72-d72f-49c9-bf2f-c8442a33319e
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 116.90.74.208; 116.90.74.208; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 index_120x600_google_atlas_NP_1.jpg
s0.2mdn.net/sadbundle/4942068020373019979/images/ Frame 8E31 68 KB
68 KB 294ms
294ms Image
image/jpeg 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4942068020373019979/images/index_120x600_google_atlas_NP_1.jpg

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/ying-ti-jian-zi-wu-su-zao-wan-mei-shen-cai-shao-nu-shi-dai-da-xiu-xiu-chang-mei-tui.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dfb214630e6f0052e27cfaaeaedf20b7014e06ddebc4ee50148b5bcc4d648a55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4942068020373019979/index_120x600_google.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:59 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69447
x-xss-protection: 0
last-modified: Mon, 05 Sep 2022 15:11:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 25 Dec 2023 04:32:59 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C984 42 B
64 B 275ms
274ms Fetch
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssjbcJpQ0odQZA9QW9HSY282V6-ISba2VDo4mzz7447oL-QoT-TEYmi4JwdZgqWAA0eqjx9eT4VqMwA4lh4P6wNk9rtckT7&sig=Cg0ArKJSzHkr2mXhnaBTEAE&id=lidar2&mcvt=1001&p=0,0,250,300&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20221207&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=32&adk=2857193491&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1671942775281&rpt=3062&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C984 42 B
64 B 282ms
282ms Fetch
image/gif 74.125.130.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuxH9HP4IidYyMunJCW5atwufnwxxBPXtqUyBpAwlgM0wg_jl1KaFLiSkx5VTqLQrlrX4-yyLOszSkg6YBgwvQyiLthgcAtr5z0t4rCSJtIRhjJeT5s05nCb1JFEtN05pFtqHg&sai=AMfl-YSp83O9q7K5mczEi3U7Y_acgO0Kw9nO2XT8fbBkNU5cYmwCTSvsr1e9lOVkpAdMiNV6WEIO9s1rOCqiT1djA7QMucauVai55ljtP0hNMK0XVgPc2yJRaTp-e1GYtNQ&sig=Cg0ArKJSzEXYJ1_vLPfdEAE&cid=CAQSPADq26N9Jee0olqkCnYexCxgdrKogFvE5EuF1hJqXSwNVXUZjhZH-mpDCe_y3Odx4GfP560bpwmgUOyhUBgBIBM&id=lidar2&mcvt=1003&p=60,450,314,750&mtos=0,1003,1003,1003,1003&tos=0,1003,0,0,0&v=20221207&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&vu=1&app=0&itpl=20&adk=1420297610&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1671942775281&rpt=3060&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-13-215-211-23.ap-southeast-1.compute.amazonaws.com

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://080798f974681a70014f827c85a5a1b3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Dec 2022 04:32:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Y6fSdEsLo7_OJzESs7eqOQAAFMEAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame C3D9 43 B
602 B 243ms
242ms Image
image/gif 13.215.211.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y6fSdEsLo7_OJzESs7eqOQAAFMEAAAAB?gdpr_consent=&us_privacy=&gdpr=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.215.211.23 , Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:59 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

Y6fSdEsLo7_OJzESs7eqOQAAFMEAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame C3D9
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Y6fSdEsLo7_OJzESs7eqOQAAFMEAAAAB&gdpr_consent=&us_privacy=&gdpr=
https://pr-bh.ybp.yahoo.com/sync/casale/Y6fSdEsLo7_OJzESs7eqOQAAFMEAAAAB

43 B
602 B

241ms
240ms

Image
image/gif

13.215.211.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y6fSdEsLo7_OJzESs7eqOQAAFMEAAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

Server

13.215.211.23 , Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-215-211-23.ap-southeast-1.compute.amazonaws.com

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:59 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/Y6fSdEsLo7_OJzESs7eqOQAAFMEAAAAB
date: Sun, 25 Dec 2022 04:32:59 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET ie
match.prod.bidr.io/cookie-sync/ Frame C3D9 0
0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame C3D9
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=074c63a7-d279-4a00-948d-3306a63009cc

43 B
766 B

446ms
352ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=074c63a7-d279-4a00-948d-3306a63009cc
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:33:00 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Date: Sun, 25 Dec 2022 04:32:59 GMT
Server: MT3 277 3f0ad7a master hkg-pixel-x20 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=074c63a7-d279-4a00-948d-3306a63009cc
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sun, 25 Dec 2022 04:32:58 GMT

GET

dcm
s.amazon-adsystem.com/ Frame C3D9
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y6fSdEsLo7_OJzESs7eqOQAAFMEAAAAB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y6fSdEsLo7_OJzESs7eqOQAAFMEAAAAB&dcc=t

0
0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame C3D9
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=4130365497667016386

43 B
766 B

629ms
339ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=4130365497667016386
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Dec 2022 04:33:00 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Date: Sun, 25 Dec 2022 04:32:59 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 116.90.74.208; 116.90.74.208; 904.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: c56b7951-689a-4e85-a4a2-7499282e3e93
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=4130365497667016386
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET ibs:dpid=23728&dpuuid=Y6fSdEsLo7-OJzESs7eqOQAA%265313
dpm.demdex.net/ Frame C3D9 0
0

GET ZMAwryCI
sync-tm.everesttech.net/upi/pid/ Frame C3D9 0
0

GET
H2 200 sync
ads.servenobid.com/ Frame C3D9 0
356 B 406ms
406ms Image
image/avif 52.16.72.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=Y6fSdEsLo7_OJzESs7eqOQAAFMEAAAAB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.16.72.231 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-72-231.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Dec 2022 04:32:59 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame D64C 34 KB
10 KB 290ms
290ms Script
text/html 23.44.27.86
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.27.86 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-44-27-86.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 31c34f97d95bcda3029d64ab92e319fdfe0e52085f89cad9caf6ea4fc3e05e8d

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:59 GMT
Content-Encoding: gzip
Last-Modified: Sat, 24 Dec 2022 23:09:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66961
Connection: keep-alive
Content-Length: 10066
Expires: Sun, 25 Dec 2022 23:09:00 GMT

GET

usersync
usersync.gumgum.com/ Frame 9F0D
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=4130365497667016386

0
0

GET

sync
x.bidswitch.net/ Frame 9F0D
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=a_08597e53-631d-43d3-a87b-a6fef238d728&gdpr=0&gdpr_consent=&us_privacy=1---
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=9f60581a-57f5-43d5-928e-bbfd1f31b6d0
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=ab0f1b2f-5c10-406b-ac16-51cdace76ac0&user_group=1&ssp=gumgum2&bsw_param=9f60581a-57f5-43d5-928e-bbfd1f31b6d0

0
0

GET

usersync
usersync.gumgum.com/ Frame 9F0D
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-74bc835b-0e07-49db-4e3b-a5462794f200$ip$116.90.74.208

0
0

GET

23178
stags.bluekai.com/site/ Frame 9F0D
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=a_08597e53-631d-43d3-a87b-a6fef238d728&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=cS49YxEJZPAPGRXaW8bi&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...

0
0

GET

floor6
sync.1rx.io/usersync2/ Frame 9F0D
Redirect Chain

https://sync.1rx.io/usersync2/floor6?gdpr=0&gdpr_consent=&dspret=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/floor6?zcc=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D&cb=1671942779869

0
0

GET rtset
bh.contextweb.com/bh/ Frame 9F0D 0
0

GET redirectObuid
sync.outbrain.com/ Frame 9F0D 0
0

GET

usersync
usersync.gumgum.com/ Frame 9F0D
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=466bb496-01c9-46fb-bdb6-2711d47a9081

0
0

GET gumgum
pr-bh.ybp.yahoo.com/sync/ Frame 9F0D 0
0

GET generic
sync.ipredictive.com/d/sync/cookie/ Frame 9F0D 0
0

GET services
sync.technoratimedia.com/ Frame 9F0D 0
0

GET 142
match.deepintent.com/usersync/ Frame 9F0D 0
0

GET server_match
ad.360yield.com/ Frame 9F0D 0
0

GET sync
ssbsync.smartadserver.com/api/ Frame 9F0D 0
0

GET sync
ads.servenobid.com/ Frame 9F0D 0
0

GET oRTB
sync.inmobi.com/ Frame 6ECB 0
0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame F9AB 16 KB
6 KB 363ms
361ms Document
text/html 184.31.28.212

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.28.212 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=25152
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Sun, 25 Dec 2022 04:32:59 GMT
expires: Sun, 25 Dec 2022 11:32:11 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET

usersync
usersync.gumgum.com/ Frame 55BF
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=9e435674-81e6-45f7-8970-c8c3377de7ea

0
0

GET

usersync
usersync.gumgum.com/ Frame FBE2
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=074c63a7-d279-4a00-948d-3306a63009cc&gdpr=0&gdpr_consent=

0
0

GET URnmbSKM
sync-tm.everesttech.net/upi/pid/ Frame 3EEB 0
0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame 31EB 170 B
192 B 279ms
279ms Document
image/png 74.125.24.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=YV8wODU5N2U1My02MzFkLTQzZDMtYTg3Yi1hNmZlZjIzOGQ3Mjg=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Sun, 25 Dec 2022 04:32:59 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET um
cs.emxdgt.com/ Frame BC22 0
0

GET

usersync
usersync.gumgum.com/ Frame CDD7
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=Y6fSesCo8YMAAOAA2C8AAAAA

0
0

GET gumgum
cs.admanmedia.com/sync/ Frame FB75 0
0

GET

usersync
usersync.gumgum.com/ Frame 9330
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
https://usersync.gumgum.com/usersync?b=iex&i=Y6fSdEsLo7-OJzESs7eqOQAA%265313

0
0

GET cm-notify
creativecdn.com/ Frame 421C 0
0

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 4A49
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

256ms
256ms

Document
text/html

23.44.27.86
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.27.86 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-44-27-86.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 25 Dec 2022 04:33:00 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sun, 25 Dec 2022 04:32:59 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET PugMaster
image6.pubmatic.com/AdServer/ Frame 7F21 0
0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 4E4C 34 KB
10 KB 252ms
252ms Script
text/html 23.44.27.86
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=medianet
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.27.86 Jakarta, Indonesia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-44-27-86.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 31c34f97d95bcda3029d64ab92e319fdfe0e52085f89cad9caf6ea4fc3e05e8d

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=medianet
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 25 Dec 2022 04:32:59 GMT
Content-Encoding: gzip
Last-Modified: Sat, 24 Dec 2022 23:09:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66961
Connection: keep-alive
Content-Length: 10066
Expires: Sun, 25 Dec 2022 23:09:00 GMT

POST
H2 200 all
csm.as.criteo.net/ Frame A615 0
127 B 236ms
235ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sun, 25 Dec 2022 04:32:59 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET match
ads.betweendigital.com/ Frame 5232 0
0

GET

cs
cs.minutemedia-prebid.com/ Frame 5232
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21480%26id%3D$UID
https://cs.minutemedia-prebid.com/cs?aid=21480&id=3464135634942752674561

0
0

GET 6185b9cf4d72f7e454746134b8c78716.gif
cs.krushmedia.com/ Frame 5232 0
0

GET

generic
match.adsrvr.org/track/cmf/ Frame 5232
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=sportority&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21478%26id%3D%5BRX_UUID%5D
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2827960058

0
0

GET

cs
cs.minutemedia-prebid.com/ Frame 5232
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21488%26id%3D%24UID
https://cs.minutemedia-prebid.com/cs?aid=21488&id=F34wDRZHyyMgvh8gTH-TPCjD

0
0

GET

cs
cs.minutemedia-prebid.com/ Frame 5232
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=59&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]
https://cs.minutemedia-prebid.com/cs?aid=21498&id=6981966559823442213&gdpr=0&gdpr_consent=

0
0

GET

cs
cs.minutemedia-prebid.com/ Frame 5232
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=196326&cb=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21476%26id%3D
https://cs.minutemedia-prebid.com/cs?aid=21476&id=Y6fSdEsLo7-OJzESs7eqOQAA%265313

0
0

GET rtset
bh.contextweb.com/bh/ Frame 5232 0
0

GET sync
x.bidswitch.net/ Frame 5232 0
0

GET ImgSync
image8.pubmatic.com/AdServer/ Frame 5232 0
0

GET sync
rtb.mfadsrvr.com/ Frame 5232 0
0

GET minute_media
cs.admanmedia.com/sync/ Frame 5232 0
0

GET pbsync
ads.yieldmo.com/ Frame 5232 0
0

GET occ
ups.analytics.yahoo.com/ups/58611/ Frame 5232 0
0

GET redirectuser
ssp.disqus.com/ Frame 5232 0
0

GET us
sync.go.sonobi.com/ Frame 5232 0
0

GET 0
prebid.a-mo.net/cchain/ Frame 5232 0
0

GET 3e1ed898b08f9e935ca99407796b46c0.gif
cs.iqzone.com/ Frame 5232 0
0

GET v1
match.sharethrough.com/universal/ Frame 5232 0
0

GET getuid
secure.adnxs.com/ Frame 5232 0
0

GET cm
u.openx.net/w/1.0/ Frame 5232 0
0

GET /
ssc-cms.33across.com/ps/ Frame 5232 0
0

GET server_match
ad.360yield.com/ Frame 5232 0
0

GET sync
ads.servenobid.com/ Frame 5232 0
0

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame EED5 2 KB
814 B 395ms
392ms Document
text/html 51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=765b4e6bb9c8438

Requested by

Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.100 , Singapore, ASN16276 (OVH, FR),

Reverse DNS