www.billofsale-form.com Open in urlscan Pro
2606:4700:3035::ac43:bf24 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://cdn-5.billofsale-form.com/
Effective URL:
https://www.billofsale-form.com/
Submission: On June 11 via automatic, source certstream-suspicious (June 11th 2021, 4:18:31 pm UTC)

Summary HTTP 226 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 66 IPs in 8 countries across 62 domains to perform 226 HTTP transactions. The main IP is 2606:4700:3035::ac43:bf24, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.billofsale-form.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 11th 2020. Valid for: a year.

This is the only time www.billofsale-form.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 43	2606:4700:303... 2606:4700:3035::ac43:bf24	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3035::6815:4c02	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
10	2.18.235.93 2.18.235.93	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:20e... 2600:9000:20eb:d200:2:cb38:840:93a1	16509 (AMAZON-02) (AMAZON-02)
16	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
3	18.158.98.109 18.158.98.109	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1 2	2a02:2638:1::13 2a02:2638:1::13	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.0.157 178.250.0.157	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	51.89.9.253 51.89.9.253	16276 (OVH) (OVH)
5	54.194.104.251 54.194.104.251	16509 (AMAZON-02) (AMAZON-02)
2	35.157.224.42 35.157.224.42	16509 (AMAZON-02) (AMAZON-02)
2	3.123.191.65 3.123.191.65	16509 (AMAZON-02) (AMAZON-02)
1 5	185.33.220.242 185.33.220.242	29990 (ASN-APPNEX) (ASN-APPNEX)
1	198.148.27.133 198.148.27.133	19189 (PULSEPOINT) (PULSEPOINT)
1	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
2	2620:116:800d... 2620:116:800d:21:8c6e:cf2c:8d6:9fb5	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
2	2.17.123.80 2.17.123.80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.90.192.189 104.90.192.189	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:206... 2600:9000:206e:7600:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2001	15169 (GOOGLE) (GOOGLE)
3	2.16.186.67 2.16.186.67	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
8	52.200.32.3 52.200.32.3	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:1f18:42d... 2600:1f18:42df:3a01:6221:c1c3:43e5:87c9	14618 (AMAZON-AES) (AMAZON-AES)
3	2.16.186.43 2.16.186.43	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	34.102.149.62 34.102.149.62	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2004	15169 (GOOGLE) (GOOGLE)
1	51.89.7.199 51.89.7.199	16276 (OVH) (OVH)
1	2.18.232.130 2.18.232.130	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	185.29.135.234 185.29.135.234	30419 (MEDIAMATH...) (MEDIAMATH-INC)
7	198.148.27.139 198.148.27.139	19189 (PULSEPOINT) (PULSEPOINT)
4 4	76.223.111.131 76.223.111.131	16509 (AMAZON-02) (AMAZON-02)
5 15	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
1	2a02:fa8:8806... 2a02:fa8:8806:16::1400	41041 (VCLK-EU-SE) (VCLK-EU-SE)
2 3	104.111.242.53 104.111.242.53	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	66.155.71.25 66.155.71.25	13768 (COGECO-PEER1) (COGECO-PEER1)
1 1	18.198.69.109 18.198.69.109	16509 (AMAZON-02) (AMAZON-02)
2 2	35.227.248.159 35.227.248.159	15169 (GOOGLE) (GOOGLE)
5 6	35.156.158.150 35.156.158.150	16509 (AMAZON-02) (AMAZON-02)
2 2	52.17.151.21 52.17.151.21	16509 (AMAZON-02) (AMAZON-02)
2 2	3.126.63.176 3.126.63.176	16509 (AMAZON-02) (AMAZON-02)
1 2	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1 2	18.159.175.104 18.159.175.104	16509 (AMAZON-02) (AMAZON-02)
1	35.158.176.66 35.158.176.66	16509 (AMAZON-02) (AMAZON-02)
5 5	52.49.40.147 52.49.40.147	16509 (AMAZON-02) (AMAZON-02)
1 1	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	185.86.138.114 185.86.138.114	201081 (SMARTADSE...) (SMARTADSERVER)
1 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
2	199.232.137.44 199.232.137.44	54113 (FASTLY) (FASTLY)
1	2600:1f18:612... 2600:1f18:612b:4216:b3d7:e742:13a8:bd05	14618 (AMAZON-AES) (AMAZON-AES)
1	35.190.113.31 35.190.113.31	15169 (GOOGLE) (GOOGLE)
2 2	158.69.224.51 158.69.224.51	16276 (OVH) (OVH)
2 2	51.210.112.236 51.210.112.236	16276 (OVH) (OVH)
2 2	34.253.109.165 34.253.109.165	16509 (AMAZON-02) (AMAZON-02)
1	104.111.242.245 104.111.242.245	16625 (AKAMAI-AS) (AKAMAI-AS)
1	54.239.17.112 54.239.17.112	16509 (AMAZON-02) (AMAZON-02)
1 2	54.171.104.170 54.171.104.170	16509 (AMAZON-02) (AMAZON-02)
1 2	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
4 7	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a02:fa8:8806... 2a02:fa8:8806:12::1460	41041 (VCLK-EU-SE) (VCLK-EU-SE)
1	88.214.193.99 88.214.193.99	46636 (NATCOWEB) (NATCOWEB)
1 1	18.237.96.144 18.237.96.144	16509 (AMAZON-02) (AMAZON-02)
1	52.30.95.9 52.30.95.9	16509 (AMAZON-02) (AMAZON-02)
2 2	54.84.90.110 54.84.90.110	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:1f18:444... 2600:1f18:444a:4602:c18d:4a5:dcb1:ed3e	14618 (AMAZON-AES) (AMAZON-AES)
1	34.120.25.144 34.120.25.144	15169 (GOOGLE) (GOOGLE)
1	35.212.101.174 35.212.101.174	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
13	2a00:1450:400... 2a00:1450:4001:803::2006	15169 (GOOGLE) (GOOGLE)
2	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
2 2	72.251.244.140 72.251.244.140	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
1	174.137.133.49 174.137.133.49	27257 (WEBAIR-IN...) (WEBAIR-INTERNET)
1 1	193.0.160.128 193.0.160.128	54312 (ROCKETFUEL) (ROCKETFUEL)
2 2	217.66.147.167 217.66.147.167	29209 (SPBMTS-AS...) (SPBMTS-AS Malaya Monetnaya Street 2-A)
1 1	213.87.44.207 213.87.44.207	13174 (MTSNET Mo...) (MTSNET Moscow)
226	66

43 2606:4700:3035::ac43:bf24 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cdn-5.billofsale-form.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.billofsale-form.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::6815:4c02 (United States)

ASN13335 (CLOUDFLARENET, US)

go.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2.18.235.93 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-93.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
lg3.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:d200:2:cb38:840:93a1 (United States)

ASN16509 (AMAZON-02, US)

go.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.158.98.109 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

g.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:1::13 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.0.157 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.89.9.253 (London, United Kingdom)

ASN16276 (OVH, FR)

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 54.194.104.251 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

g2.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rtb.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.157.224.42 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.123.191.65 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

btlr.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.33.220.242 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.148.27.133 (New York, United States)

ASN19189 (PULSEPOINT, US)

bid.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.17.123.80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

pxlclnmdecom-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.90.192.189 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)

adservetx.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206e:7600:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.16.186.67 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

qsearch-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 52.200.32.3 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

dt.clnmde.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:42df:3a01:6221:c1c3:43e5:87c9 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

dt6.clnmde.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.16.186.43 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-43.deploy.static.akamaitechnologies.com

res-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.102.149.62 (Kansas City, United States)

ASN15169 (GOOGLE, US)

navvy.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.89.7.199 (London, United Kingdom)

ASN16276 (OVH, FR)

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.232.130 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.29.135.234 (United Kingdom) 1 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 198.148.27.139 (New York, United States)

ASN19189 (PULSEPOINT, US)

bh.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 76.223.111.131 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 216.58.212.162 (Mountain View, United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:16::1400 (United States)

ASN41041 (VCLK-EU-SE, US)

pulsepoint-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.111.242.53 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-53.deploy.static.akamaitechnologies.com

px.owneriq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.155.71.25 (Portsmouth, United Kingdom) 2 redirects

ASN13768 (COGECO-PEER1, CA)

pixel-sync.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.198.69.109 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-198-69-109.eu-central-1.compute.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.248.159 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.156.158.150 (Frankfurt am Main, Germany) 5 redirects

ASN16509 (AMAZON-02, US)

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.17.151.21 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

ads.avct.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.63.176 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.56.137 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.159.175.104 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.158.176.66 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.49.40.147 (Dublin, Ireland) 5 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-40-147.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.80 (United Kingdom) 1 redirects

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.138.114 (France) 1 redirects

ASN201081 (SMARTADSERVER, FR)

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (United States) 1 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.232.137.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4216:b3d7:e742:13a8:bd05 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.113.31 (Kansas City, United States)

ASN15169 (GOOGLE, US)

atemda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 158.69.224.51 (Montreal, Canada) 2 redirects

ASN16276 (OVH, FR)

red.erne.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.210.112.236 (France) 2 redirects

ASN16276 (OVH, FR)

pixel.onaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.253.109.165 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-109-165.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.242.245 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-245.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.239.17.112 (Ashburn, United States)

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.171.104.170 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

ads.yieldmo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.138 (Frankfurt am Main, Germany) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2.18.234.21 (Frankfurt am Main, Germany) 4 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:12::1460 (United States)

ASN41041 (VCLK-EU-SE, US)

match.sync.ad.cpe.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.214.193.99 (United Kingdom)

ASN46636 (NATCOWEB, US)

sync.colossusssp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.237.96.144 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)

demand.trafficroots.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.30.95.9 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

c.deployads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.84.90.110 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)

i.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:444a:4602:c18d:4a5:dcb1:ed3e (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

i6.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.25.144 (Kansas City, United States)

ASN15169 (GOOGLE, US)

public-prod-dspcookiematching.dmxleo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.212.101.174 (Washington, United States)

ASN15169 (GOOGLE, US)

cs.chocolateplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:803::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.251.244.140 (Amsterdam, Netherlands) 2 redirects

ASN29791 (VOXEL-DOT-NET, US)

tracking.m6r.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 174.137.133.49 (United States)

ASN27257 (WEBAIR-INTERNET, US)

rtb2-useast.e-volution.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.0.160.128 (United States) 1 redirects

ASN54312 (ROCKETFUEL, US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 217.66.147.167 (St Petersburg, Russian Federation) 2 redirects

ASN29209 (SPBMTS-AS Malaya Monetnaya Street 2-A, RU)

sm.rtb.mts.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.87.44.207 (Moscow, Russian Federation) 1 redirects

ASN13174 (MTSNET Moscow, Russia, RU)

tech.rtb.mts.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	billofsale-form.com 1 redirects cdn-5.billofsale-form.com www.billofsale-form.com	411 KB
35	doubleclick.net 5 redirects securepubads.g.doubleclick.net cm.g.doubleclick.net googleads.g.doubleclick.net googleads4.g.doubleclick.net	200 KB
18	googlesyndication.com 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	77 KB
13	2mdn.net s0.2mdn.net	603 KB
13	media.net contextual.media.net adservetx.media.net lg3.media.net navvy.media.net	201 KB
13	google.com adservice.google.com www.google.com	3 KB
11	google.ch adservice.google.ch	2 KB
9	clnmde.com dt.clnmde.com dt6.clnmde.com	3 KB
8	akamaihd.net pxlclnmdecom-a.akamaihd.net qsearch-a.akamaihd.net res-a.akamaihd.net	92 KB
8	contextweb.com bid.contextweb.com bh.contextweb.com	10 KB
7	casalemedia.com 4 redirects dsum.casalemedia.com dsum-sec.casalemedia.com	6 KB
6	bidswitch.net 5 redirects x.bidswitch.net	2 KB
6	adnxs.com 1 redirects ib.adnxs.com acdn.adnxs.com	22 KB
5	bidr.io 5 redirects match.prod.bidr.io	2 KB
5	gumgum.com g2.gumgum.com rtb.gumgum.com	3 KB
4	adsrvr.org 4 redirects match.adsrvr.org	2 KB
4	advertising.com 2 redirects ads.adaptv.advertising.com pixel.advertising.com	1 KB
4	criteo.com 1 redirects gum.criteo.com mug.criteo.com	1 KB
4	ezoic.net go.ezoic.net g.ezoic.net	2 KB
3	mts.ru 3 redirects sm.rtb.mts.ru tech.rtb.mts.ru	2 KB
3	liadm.com 2 redirects i.liadm.com i6.liadm.com	1 KB
3	owneriq.net 2 redirects px.owneriq.net	1 KB
3	sharethrough.com btlr.sharethrough.com match.sharethrough.com	501 B
2	m6r.eu 2 redirects tracking.m6r.eu	1 KB
2	googletagservices.com www.googletagservices.com	65 KB
2	rubiconproject.com 1 redirects pixel.rubiconproject.com	1 KB
2	yieldmo.com 1 redirects ads.yieldmo.com	892 B
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net	1 KB
2	onaudience.com 2 redirects pixel.onaudience.com	1 KB
2	erne.co 2 redirects red.erne.co	580 B
2	taboola.com trc.taboola.com	490 B
2	spotxchange.com 1 redirects sync.search.spotxchange.com	1 KB
2	3lift.com 1 redirects eb2.3lift.com	711 B
2	yahoo.com 1 redirects ups.analytics.yahoo.com	2 KB
2	avct.cloud 2 redirects ads.avct.cloud	898 B
2	tapad.com 2 redirects pixel.tapad.com	1 KB
2	sitescout.com 2 redirects pixel-sync.sitescout.com	1 KB
2	dotomi.com pulsepoint-match.dotomi.com match.sync.ad.cpe.dotomi.com	260 B
2	quantserve.com secure.quantserve.com pixel.quantserve.com	9 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	onetag-sys.com onetag-sys.com	1 KB
2	gstatic.com fonts.gstatic.com	43 KB
1	rfihub.com 1 redirects a.rfihub.com	1 KB
1	e-volution.ai rtb2-useast.e-volution.ai	233 B
1	chocolateplatform.com cs.chocolateplatform.com	85 B
1	dmxleo.com public-prod-dspcookiematching.dmxleo.com	176 B
1	deployads.com c.deployads.com	285 B
1	trafficroots.com 1 redirects demand.trafficroots.com	600 B
1	colossusssp.com sync.colossusssp.com	648 B
1	amazon-adsystem.com s.amazon-adsystem.com	344 B
1	teads.tv sync.teads.tv	286 B
1	atemda.com atemda.com	1020 B
1	tremorhub.com partners.tremorhub.com	183 B
1	smartadserver.com 1 redirects rtb-csync.smartadserver.com	757 B
1	pubmatic.com 1 redirects image2.pubmatic.com	554 B
1	exelator.com 1 redirects loadm.exelator.com	649 B
1	mathtag.com 1 redirects sync.mathtag.com	611 B
1	id5-sync.com id5-sync.com	541 B
1	quantcount.com rules.quantcount.com	429 B
1	googleapis.com fonts.googleapis.com	427 B
1	ezodn.com go.ezodn.com	66 KB
0	Failed function sub() { [native code] }. Failed
226	62

	Domain	Requested by
42	www.billofsale-form.com	www.billofsale-form.com
16	securepubads.g.doubleclick.net	www.billofsale-form.com securepubads.g.doubleclick.net
15	cm.g.doubleclick.net	5 redirects go.ezodn.com googleads.g.doubleclick.net 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
13	s0.2mdn.net	www.billofsale-form.com s0.2mdn.net
12	adservice.google.com	www.billofsale-form.com securepubads.g.doubleclick.net
11	adservice.google.ch	securepubads.g.doubleclick.net
10	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
8	dt.clnmde.com	pxlclnmdecom-a.akamaihd.net www.billofsale-form.com
7	bh.contextweb.com	go.ezodn.com bh.contextweb.com
6	x.bidswitch.net	5 redirects bh.contextweb.com
6	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
5	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
5	match.prod.bidr.io	5 redirects
5	lg3.media.net	www.billofsale-form.com contextual.media.net
5	ib.adnxs.com	1 redirects go.ezodn.com acdn.adnxs.com bh.contextweb.com
5	contextual.media.net	www.billofsale-form.com contextual.media.net
4	match.adsrvr.org	4 redirects
3	px.owneriq.net	2 redirects bh.contextweb.com
3	rtb.gumgum.com	go.ezodn.com
3	res-a.akamaihd.net	www.billofsale-form.com
3	qsearch-a.akamaihd.net	www.billofsale-form.com
3	g.ezoic.net	www.billofsale-form.com
2	sm.rtb.mts.ru	2 redirects
2	tracking.m6r.eu	2 redirects
2	googleads4.g.doubleclick.net	www.billofsale-form.com
2	googleads.g.doubleclick.net	4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com www.billofsale-form.com
2	www.googletagservices.com	securepubads.g.doubleclick.net 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
2	i.liadm.com	2 redirects
2	dsum.casalemedia.com	1 redirects bh.contextweb.com
2	pixel.rubiconproject.com	1 redirects bh.contextweb.com
2	ads.yieldmo.com	1 redirects bh.contextweb.com
2	sync.crwdcntrl.net	2 redirects
2	pixel.onaudience.com	2 redirects
2	red.erne.co	2 redirects
2	trc.taboola.com	bh.contextweb.com
2	sync.search.spotxchange.com	1 redirects bh.contextweb.com
2	eb2.3lift.com	1 redirects bh.contextweb.com
2	ups.analytics.yahoo.com	1 redirects bh.contextweb.com
2	pixel.advertising.com	2 redirects
2	ads.avct.cloud	2 redirects
2	pixel.tapad.com	2 redirects
2	pixel-sync.sitescout.com	2 redirects
2	navvy.media.net	contextual.media.net
2	4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	pxlclnmdecom-a.akamaihd.net	contextual.media.net pxlclnmdecom-a.akamaihd.net
2	www.google-analytics.com	www.billofsale-form.com www.google-analytics.com
2	btlr.sharethrough.com	go.ezodn.com
2	ads.adaptv.advertising.com	go.ezodn.com
2	g2.gumgum.com	go.ezodn.com
2	onetag-sys.com	go.ezodn.com
2	mug.criteo.com	www.billofsale-form.com
2	gum.criteo.com	1 redirects
2	fonts.gstatic.com	fonts.googleapis.com
1	tech.rtb.mts.ru	1 redirects
1	a.rfihub.com	1 redirects
1	rtb2-useast.e-volution.ai	4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
1	cs.chocolateplatform.com	bh.contextweb.com
1	public-prod-dspcookiematching.dmxleo.com	bh.contextweb.com
1	i6.liadm.com	bh.contextweb.com
1	c.deployads.com	bh.contextweb.com
1	demand.trafficroots.com	1 redirects
1	sync.colossusssp.com	bh.contextweb.com
1	match.sync.ad.cpe.dotomi.com	bh.contextweb.com
1	s.amazon-adsystem.com	bh.contextweb.com
1	sync.teads.tv	bh.contextweb.com
1	atemda.com	bh.contextweb.com
1	partners.tremorhub.com	bh.contextweb.com
1	rtb-csync.smartadserver.com	1 redirects
1	image2.pubmatic.com	1 redirects
1	match.sharethrough.com	bh.contextweb.com
1	loadm.exelator.com	1 redirects
1	pulsepoint-match.dotomi.com	bh.contextweb.com
1	sync.mathtag.com	1 redirects
1	acdn.adnxs.com	go.ezodn.com
1	id5-sync.com	go.ezodn.com
1	www.google.com	tpc.googlesyndication.com
1	dt6.clnmde.com	www.billofsale-form.com
1	pixel.quantserve.com	www.billofsale-form.com
1	rules.quantcount.com	secure.quantserve.com
1	adservetx.media.net	contextual.media.net
1	secure.quantserve.com	www.billofsale-form.com
1	bid.contextweb.com	go.ezodn.com
1	go.ezoic.net	www.billofsale-form.com
1	fonts.googleapis.com	www.billofsale-form.com
1	go.ezodn.com	www.billofsale-form.com
1	cdn-5.billofsale-form.com	1 redirects
0	blank Failed	www.billofsale-form.com
226	87

This site contains links to these domains. Also see Links.

Domain
silktide.com
www.facebook.com
twitter.com
plusone.google.com
pinterest.com
www.ezoic.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-11` - `2021-07-11`	a year	crt.sh
*.google.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2021-04-12` - `2022-04-20`	a year	crt.sh
*.ezoic.net Amazon	`2021-02-15` - `2022-03-16`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
ezoic.net R3	`2021-05-23` - `2021-08-21`	3 months	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-04-14` - `2021-07-12`	3 months	crt.sh
onetag-sys.com R3	`2021-05-02` - `2021-07-31`	3 months	crt.sh
*.gumgum.com Amazon	`2021-06-05` - `2022-07-04`	a year	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-05-24` - `2021-11-17`	6 months	crt.sh
*.sharethrough.com Amazon	`2020-09-09` - `2021-10-11`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.contextweb.com DigiCert SHA2 Secure Server CA	`2020-05-07` - `2022-05-12`	2 years	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2020-07-15` - `2021-09-13`	a year	crt.sh
*.google.ch GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.clnmde.com Amazon	`2021-05-06` - `2022-06-04`	a year	crt.sh
dt6.clnmde.com Amazon	`2021-03-29` - `2022-04-27`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.id5-sync.com R3	`2021-06-01` - `2021-08-30`	3 months	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2021-03-11` - `2022-02-07`	a year	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh
*.owneriq.net GeoTrust RSA CA 2018	`2021-01-29` - `2022-02-02`	a year	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-03-22` - `2021-09-15`	6 months	crt.sh
*.3lift.com Amazon	`2020-07-04` - `2021-08-05`	a year	crt.sh
*.search.spotxchange.com GeoTrust RSA CA 2018	`2021-04-08` - `2022-05-09`	a year	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-25` - `2021-12-26`	a year	crt.sh
*.tremorhub.com Amazon	`2020-07-25` - `2021-08-25`	a year	crt.sh
*.atemda.com Go Daddy Secure Certificate Authority - G2	`2019-12-13` - `2022-01-12`	2 years	crt.sh
teads.tv R3	`2021-06-11` - `2021-09-09`	3 months	crt.sh
s.amazon-adsystem.com Amazon	`2020-08-28` - `2021-08-20`	a year	crt.sh
*.yieldmo.com Amazon	`2021-05-25` - `2022-06-23`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2020-12-18` - `2022-01-18`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
ad.cpe.dotomi.com GlobalSign RSA OV SSL CA 2018	`2020-03-30` - `2022-06-25`	2 years	crt.sh
*.colossusssp.com Go Daddy Secure Certificate Authority - G2	`2020-10-06` - `2021-11-07`	a year	crt.sh
*.deployads.com Sectigo RSA Domain Validation Secure Server CA	`2019-07-04` - `2021-07-03`	2 years	crt.sh
*.liadm.com Amazon	`2020-11-30` - `2021-12-29`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
dspcookiematching.dmxleo.com ZeroSSL RSA Domain Secure Site CA	`2021-06-04` - `2021-09-02`	3 months	crt.sh
chocolateplatform.com GTS CA 1D4	`2021-05-01` - `2021-07-30`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.e-volution.ai Sectigo RSA Domain Validation Secure Server CA	`2020-09-14` - `2021-09-14`	a year	crt.sh

This page contains 20 frames:

Primary Page: https://www.billofsale-form.com/
Frame ID: 5BA4C9DD383E00AECF6D8D9637F2CE57
Requests: 126 HTTP requests in this frame

Frame: https://qsearch-a.akamaihd.net/log?&logid=kfk&id=00001623428292107029592307154321&cid=8CU4593V4&crid=637313813&cc=US&bsr=Chrome_89&os=WIN&dt=desktop&dsz=1600x1200&dn=billofsale-form.com&dc=0&adtagid=005585204&ptype=3&visitorId=2658877523071501&bidder_id=99999&biddertagid=99999&evtid=videoevent&evt=20&fallback=11&timenav=2232&last_event=0&cur_ad_iter=0&timediff=2232&purl=https%3A%2F%2Fwww.billofsale-form.com%2F&requrl=http%3A%2F%2Fwww.google.com
Frame ID: D0939F93F2D8BCB7D1C3CA4BE8E449D1
Requests: 3 HTTP requests in this frame

Frame: https://pxlclnmdecom-a.akamaihd.net/javascripts/bfp_ssn.js?templateId=3
Frame ID: 8F8E22555C8A123E74CA4D52247FE49A
Requests: 2 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV12042.js
Frame ID: 0030A339F895DFA22B9B3E7080D97C2A
Requests: 6 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV12042.js
Frame ID: 62AB0A46046BB15823C0214D8EA07273
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html
Frame ID: 9FB2A8D84571554181B4DDF06EA28A2E
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: A89039AA17779FA3213534C1E91E59D5
Requests: 1 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?cb=1623428291858
Frame ID: 831C5A1759406F2FB10A3AA84E3C1346
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: D4D0822716DAB8EEF405997D6ADCF304
Requests: 3 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=mmh&i=c72460c3-8cc7-4300-93f6-1c0f0e160003&gdpr=0&gdpr_consent=
Frame ID: 83EA7AB0B0BFB5AEF30BEC4ABE5D3C5F
Requests: 1 HTTP requests in this frame

Frame: https://bh.contextweb.com/visitormatch
Frame ID: D5CB2A55ABB0BD4A34D1D34A09061071
Requests: 30 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=ttd&i=7d454855-aa56-4af8-9c37-3c178db509d6&t=1626020295
Frame ID: DE8976772C429421A52244B2113E832B
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV9jMzIwM2UyNC05ZGY0LTRkNjQtYmI4ZS1hY2U2NDA2NDA1M2Q=&gdpr=0&gdpr_consent=
Frame ID: A60FD36A0C51D531DAE608E0130A42F9
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=ttd&i=7d454855-aa56-4af8-9c37-3c178db509d6&t=1626020295
Frame ID: CD52365E6B177BBD3B464EC99439CEF8
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV9kYjZiNTMwMy0zMDllLTQ4ZDQtYmEyZi03Zjk5MTg2NTQ5NWI=&gdpr=0&gdpr_consent=
Frame ID: 098C622DD4506D384925966C92B82C8C
Requests: 1 HTTP requests in this frame

Frame: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 74CE5D0D015582536B2487EDD02FB042
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNXM3MYCELaCisgCGNCEqqYBMAE&v=APEucNV8HXz-48twuXkMxcSxqTBDC-QJJKaHWiy_A8SvLoewXtUuP22FwzHGMW_WiKTob9FCVttBT2xBZd-izshSDhWOZPAamg
Frame ID: F9D041EAF3D25C34D39012E38A2ED706
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 336C2B0EB52CB29936E1B0FFA25A8054
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: FE299A4DDB831A29BA613DC8D92C3EFA
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2
Frame ID: A0FFE1A529E49ADD26F371CD8932CBFC
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://cdn-5.billofsale-form.com/ HTTP 301
https://www.billofsale-form.com/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Page Statistics

226
Requests

100 %
HTTPS

31 %
IPv6

62
Domains

87
Subdomains

66
IPs

8
Countries

1844 kB
Transfer

4443 kB
Size

11
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: http://silktide.com/cookieconsent
Title: Cookie Consent plugin for the EU cookie law

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://www.billofsale-form.com/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/home?status=Bill%20of%20Sale%20Form%20https://www.billofsale-form.com/
Title: Twitter

Search URL Search Domain Scan URL

URL: https://plusone.google.com/_/+1/confirm?hl=en&url=https://www.billofsale-form.com/&name=Bill%20of%20Sale%20Form
Title: Google +

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/button/?url=https://www.billofsale-form.com/&description=Bill%20of%20Sale%20Form&media=
Title: Pinterest

Search URL Search Domain Scan URL

URL: https://www.ezoic.com/what-is-ezoic/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cdn-5.billofsale-form.com/ HTTP 301
https://www.billofsale-form.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 35

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.billofsale-form.com%2F&domain=www.billofsale-form.com&cw=1 HTTP 302
https://mug.criteo.com/sid?cpp=FT02SnxNd2NlM0czdXVENHlWc2tqWDBLMkVrc0pTeFRNMEdHQXdZSkloYzRJdmloSVRLODlrUk5wajVJN3ZxZnFiK3VlYTRRQWVTLzBLeW9BYXFzdHBkWkR5b2wzNFZrOXhocE84WWwyTGJWclBjbXNzMW9iM0FxMFcraE5HSTJ3V2dmMm9vbW9MSU0vcjIvUllzYjBLQklaeTJ5Wm1PRmJWdFRqc3dTN1lVVW1BekRVQmRPbmc4bE9SNmJhbDlYUGdVaWxwYUVHckkrZ1ROR1Q0dWhTSVR2aHZGWHJtYVg3dWpsYnE3NjlkejZJN3pCaU1YUGFNN2RYQnVxcWhmUHpRZXp3fA&cppv=2

Request Chain 102

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
https://rtb.gumgum.com/usersync?b=mmh&i=c72460c3-8cc7-4300-93f6-1c0f0e160003&gdpr=0&gdpr_consent=

Request Chain 104

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://rtb.gumgum.com/usersync?b=ttd&i=7d454855-aa56-4af8-9c37-3c178db509d6&t=1626020295

Request Chain 106

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://rtb.gumgum.com/usersync?b=ttd&i=7d454855-aa56-4af8-9c37-3c178db509d6&t=1626020295

Request Chain 108

https://ib.adnxs.com/async_usersync?cbfn=queuePixels HTTP 307
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

Request Chain 114

https://px.owneriq.net/eucm/p/cwc HTTP 302
https://px.owneriq.net/ecc?redir=https%3a%2f%2fpx.owneriq.net%2ffr%2fepx.gif&uid=Q6767146951843027934&ref=%2Feucm%2Fp%2Fcwc HTTP 302
https://px.owneriq.net/noop?ct=image%2Fgif

Request Chain 115

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=95&gdpr=0&gdpr_consent= HTTP 302
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=95&gdpr=0&gdpr_consent= HTTP 302
https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348%26partner_url%3Dhttps%253A%252F%252Fbh.contextweb.com%252Fbh%252Frtset%253Fdo%253Dadd%2526pid%253D543793%2526ev%253D29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348%2526gdpr_in_effect%253D0%2526gdpr_consent%253D HTTP 302
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348&partner_url=https%3A%2F%2Fbh.contextweb.com%2Fbh%2Frtset%3Fdo%3Dadd%26pid%3D543793%26ev%3D29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348%26gdpr_in_effect%3D0%26gdpr_consent%3D HTTP 302
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348&partner_url=https%3A%2F%2Fbh.contextweb.com%2Fbh%2Frtset%3Fdo%3Dadd%26pid%3D543793%26ev%3D29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348%26gdpr_in_effect%3D0%26gdpr_consent%3D HTTP 302
https://bh.contextweb.com/bh/rtset?do=add&pid=543793&ev=29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348&gdpr_in_effect=0&gdpr_consent=

Request Chain 116

https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=VkdGUFpJXzZRYkJlX3kzZDRVcXJZdw&gdpr=0&gdpr_consent= HTTP 302
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEBikDWeK1J9X2oGhOoK5CIw&google_cver=1

Request Chain 117

https://x.bidswitch.net/sync?ssp=pulsepoint HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=pulsepoint HTTP 302
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpulsepoint HTTP 302
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpulsepoint HTTP 302
https://x.bidswitch.net/sync?dsp_id=59&user_id=eb83183d-15e2-4b6b-b852-5ecf7072987f&ssp=pulsepoint HTTP 302
https://bh.contextweb.com/bh/rtset?do=add&pid=556010&ev=a850428e-92c9-430b-8963-e14fb9ef1300

Request Chain 118

https://pixel.advertising.com/ups/55972/sync?uid=ENskYmmMP1fy&_origin=1&gdpr=0&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/55972/sync?uid=ENskYmmMP1fy&_origin=1&gdpr=0&gdpr_consent=&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/55972/sync?uid=ENskYmmMP1fy&_origin=1&gdpr=0&gdpr_consent=&apid=UPa0611f6a-cad0-11eb-91b9-06d326095278 HTTP 302
https://ups.analytics.yahoo.com/ups/55972/sync?uid=ENskYmmMP1fy&_origin=1&gdpr=0&gdpr_consent=&apid=UPa0611f6a-cad0-11eb-91b9-06d326095278&verify=true

Request Chain 119

https://eb2.3lift.com/xuid?mid=2636&xuid=ENskYmmMP1fy&dongle=8bee HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=2636&xuid=ENskYmmMP1fy&dongle=8bee&gdpr=1&cmp_cs=&us_privacy=

Request Chain 121

https://match.prod.bidr.io/cookie-sync/pp HTTP 303
https://match.prod.bidr.io/cookie-sync/pp?_bee_ppp=1 HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCSE8wN0JoeG9BQURIZzBlQlozUQ&bee_sync_partners=pm%2Csas%2Cpp&bee_sync_current_partner=adx&bee_sync_initiator=pp&bee_sync_hop_count=1 HTTP 302
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp&bee_sync_current_partner=adx&bee_sync_initiator=pp&bee_sync_hop_count=1 HTTP 303
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABHO07BhxoAADHg0eBZ3Q&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Cpp%26bee_sync_current_partner%3Dpm%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2 HTTP 302
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2 HTTP 303
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABHO07BhxoAADHg0eBZ3Q&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID HTTP 302
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pp&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=4221625219172282953 HTTP 303
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AABHO07BhxoAADHg0eBZ3Q

Request Chain 122

https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_cm&google_hm=ENskYmmMP1fy HTTP 302
https://bh.contextweb.com/bh/rtset?pid=559960&ev=1&google_gid=CAESEJOk3zuzJulhXWyoU8wlw50&google_cver=1

Request Chain 123

https://sync.search.spotxchange.com/partner?adv_id=8185&uid=ENskYmmMP1fy HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=8185&uid=ENskYmmMP1fy&__user_check__=1&sync_id=a0688386-cad0-11eb-a3af-1a7cb9e30406

Request Chain 127

https://red.erne.co/pulsepoint/cm HTTP 302
https://pixel.onaudience.com/?mapped=DIcx2l6I8YUfhqr8nIXhW9ay&partner=2&redirect=red.erne.co%2Fct%2Fcm%3Fred%3Dhttps%253A%252F%252Fbh.contextweb.com%252Fbh%252Frtset%253Fdo%253Dadd%2526pid%253D560956%2526ev%253DDIcx2l6I8YUfhqr8nIXhW9ay HTTP 302
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26redirect%3Dhttps%253A%252F%252Fred.erne.co%252Fct%252Fcm%253Fred%253Dhttps%25253A%25252F%25252Fbh.contextweb.com%25252Fbh%25252Frtset%25253Fdo%25253Dadd%252526pid%25253D560956%252526ev%25253DDIcx2l6I8YUfhqr8nIXhW9ay HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26redirect%3Dhttps%253A%252F%252Fred.erne.co%252Fct%252Fcm%253Fred%253Dhttps%25253A%25252F%25252Fbh.contextweb.com%25252Fbh%25252Frtset%25253Fdo%25253Dadd%252526pid%25253D560956%252526ev%25253DDIcx2l6I8YUfhqr8nIXhW9ay HTTP 302
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=4fa8b3393d3ebb096a1ab0adbd6cec9d&redirect=https%3A%2F%2Fred.erne.co%2Fct%2Fcm%3Fred%3Dhttps%253A%252F%252Fbh.contextweb.com%252Fbh%252Frtset%253Fdo%253Dadd%2526pid%253D560956%2526ev%253DDIcx2l6I8YUfhqr8nIXhW9ay HTTP 302
https://red.erne.co/ct/cm?red=https%3A%2F%2Fbh.contextweb.com%2Fbh%2Frtset%3Fdo%3Dadd%26pid%3D560956%26ev%3DDIcx2l6I8YUfhqr8nIXhW9ay HTTP 302
https://bh.contextweb.com/bh/rtset?do=add&pid=560956&ev=DIcx2l6I8YUfhqr8nIXhW9ay

Request Chain 132

https://dsum.casalemedia.com/rum?cm_dsp_id=189&external_user_id=ENskYmmMP1fy&expiration=[EXPIRATION] HTTP 302
https://dsum.casalemedia.com/rum?cm_dsp_id=189&external_user_id=ENskYmmMP1fy&expiration=[EXPIRATION]&C=1

Request Chain 136

https://demand.trafficroots.com/sync.php?buyer=2228&buyeruid=https://demand.trafficroots.com/sync.php?buyer=2228&buyeruid=ENskYmmMP1fy HTTP 302
https://c.deployads.com/cs/TRRT?b=ENskYmmMP1fy

Request Chain 137

https://i.liadm.com/s/55660?bidder_id=98251&bidder_uuid=ENskYmmMP1fy HTTP 303
https://i.liadm.com/s/55660?bidder_id=98251&bidder_uuid=ENskYmmMP1fy&_li_chk=true&previous_uuid=b7692ee81eae4819ae5b2d7dfe4200b3 HTTP 303
https://i6.liadm.com/s/55660?bidder_id=98251&bidder_uuid=ENskYmmMP1fy

Request Chain 192

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDcf7foFHJqvgbivqOfkyNU&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDcf7foFHJqvgbivqOfkyNU&google_cver=1&C=1

Request Chain 193

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMOMzkTA8YYKY4WccSSOewAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDcf7foFHJqvgbivqOfkyNU&google_cver=1

Request Chain 203

https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEO9kfddxGQlArc12h1iVY-Q&google_cver=1&google_push=AYg5qPIGTH1NEncuOwiWf_SGRUJ3p4_EsYjiEEu0mkaC_7LQ1iDIEDUP8J_WuIePjc5xcsqtxL7_ymd0Hh1z3fRc0irVkkPUgKe6 HTTP 302
https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEO9kfddxGQlArc12h1iVY-Q&google_cver=1&google_push=AYg5qPIGTH1NEncuOwiWf_SGRUJ3p4_EsYjiEEu0mkaC_7LQ1iDIEDUP8J_WuIePjc5xcsqtxL7_ymd0Hh1z3fRc0irVkkPUgKe6&checkcookies=true HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=xJfv5pMPiIpVidzusEkKGw&google_push=AYg5qPIGTH1NEncuOwiWf_SGRUJ3p4_EsYjiEEu0mkaC_7LQ1iDIEDUP8J_WuIePjc5xcsqtxL7_ymd0Hh1z3fRc0irVkkPUgKe6

Request Chain 204

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEEtLmiy8eVabWDRp82u-88g&google_cver=1&google_push=AYg5qPIM_CZJXVawVC-lfsZSoAxqtiABuMdukux_VD-_3o4tPRuKjCbD44QfSvjD3-XaamCCYBG_dTd_EwznaqvZmOfK2JhfSD3U HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEEtLmiy8eVabWDRp82u-88g&google_cver=1&google_push=AYg5qPIM_CZJXVawVC-lfsZSoAxqtiABuMdukux_VD-_3o4tPRuKjCbD44QfSvjD3-XaamCCYBG_dTd_EwznaqvZmOfK2JhfSD3U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIM_CZJXVawVC-lfsZSoAxqtiABuMdukux_VD-_3o4tPRuKjCbD44QfSvjD3-XaamCCYBG_dTd_EwznaqvZmOfK2JhfSD3U&google_hm=1u7lhcUMRcSqvSty2EcKqQ==

Request Chain 205

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGWwWSICKw40zEOPC3DDOQ0&google_cver=1&google_push=AYg5qPJ1Ok83s0jye7V1HvxVQSGs8gGnYZzNQu0yHnXNgUte-YmNtvJ3IqA2SY0atDw5zgHMMvUCM2zKpSrzegttsOU5IUec7Ho HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BTSkFONk0tMTItR09HWA==&google_push=AYg5qPJ1Ok83s0jye7V1HvxVQSGs8gGnYZzNQu0yHnXNgUte-YmNtvJ3IqA2SY0atDw5zgHMMvUCM2zKpSrzegttsOU5IUec7Ho

Request Chain 206

https://ads.yieldmo.com/exptsync?google_gid=CAESEIHWWwijHaaQiNJo-MnQ8G0&google_cver=1&google_push=AYg5qPKzU8ZDR2PV0hJORjKCEKfiMFo9zWjvopIo-pejdnFp4SvgUiJ_GQ-AkAC86gYcLCFhafyroh-N5eXj1vlcqflcvuqxQ5ZK HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPKzU8ZDR2PV0hJORjKCEKfiMFo9zWjvopIo-pejdnFp4SvgUiJ_GQ-AkAC86gYcLCFhafyroh-N5eXj1vlcqflcvuqxQ5ZK&google_hm=Z2YzOTFmNDQ4MjZiMjk3NDc3OWY=

Request Chain 208

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEHPZ2r-2EufPcxpW775Z3Qg&google_cver=1&google_push=AYg5qPKjZQGdP3UGvh-gCc6ZErgcUtmR1oHaT7sAm82_in-mm9cAk4dSB6Te4_Ia9QvwaDTyoWd1UrvLUcdco009wTwh5BEqEmkWvQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPKjZQGdP3UGvh-gCc6ZErgcUtmR1oHaT7sAm82_in-mm9cAk4dSB6Te4_Ia9QvwaDTyoWd1UrvLUcdco009wTwh5BEqEmkWvQ&google_hm=MTM0ODE3MTg3NzkzNzAzOTM0MA==

Request Chain 209

https://sm.rtb.mts.ru/p?ssp=googlevid&pm=1&google_gid=CAESEAhMRywZy_kT7DiPEi9uQE0&google_cver=1&google_push=AYg5qPIcD_CJZrpTWM4lMS93O_E33jfmRgI_kWsjrm4NsBbonQsDqR6sNP-mOHcBOdVlfyuRCBx5YTq7lKVnSAyi0MKO8DFRypEYvQ HTTP 301
https://sm.rtb.mts.ru/match/second?r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc_2%26id%3Dba517a1e-011d-479d-b1c2-625ce53863da%26google_push%3DAYg5qPIcD_CJZrpTWM4lMS93O_E33jfmRgI_kWsjrm4NsBbonQsDqR6sNP-mOHcBOdVlfyuRCBx5YTq7lKVnSAyi0MKO8DFRypEYvQ&ssp=googlevid&exu=CAESEAhMRywZy_kT7DiPEi9uQE0 HTTP 301
https://tech.rtb.mts.ru/?dsp_uid=ba517a1e-011d-479d-b1c2-625ce53863da&return_url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc_2%26id%3Dba517a1e-011d-479d-b1c2-625ce53863da%26google_push%3DAYg5qPIcD_CJZrpTWM4lMS93O_E33jfmRgI_kWsjrm4NsBbonQsDqR6sNP-mOHcBOdVlfyuRCBx5YTq7lKVnSAyi0MKO8DFRypEYvQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=stream_llc_2&id=ba517a1e-011d-479d-b1c2-625ce53863da&google_push=AYg5qPIcD_CJZrpTWM4lMS93O_E33jfmRgI_kWsjrm4NsBbonQsDqR6sNP-mOHcBOdVlfyuRCBx5YTq7lKVnSAyi0MKO8DFRypEYvQ

226 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.billofsale-form.com/
Redirect Chain

https://cdn-5.billofsale-form.com/
https://www.billofsale-form.com/

79 KB
21 KB

824ms
789ms

Document
text/html

2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c3191ba75f7a27d0acdb3596e4fbd009e6d7230c40021c8ca8ea946e2d2c1a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: www.billofsale-form.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
display: pub_site_sol
expires: Thu, 10 Jun 2021 16:18:11 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
pagespeed: off
response: 200
set-cookie: ezoadgid_26431=-1; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 16:48:10 UTC ezoref_26431=; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 18:18:10 UTC ezoab_26431=mod1; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 18:18:10 UTC active_template::26431=pub_site.1623428290; Path=/; Domain=billofsale-form.com; Expires=Sun, 13 Jun 2021 16:18:10 UTC ezopvc_26431=1; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 16:48:11 UTC ezepvv=0; Path=/; Domain=billofsale-form.com; Expires=Sat, 12 Jun 2021 16:18:11 UTC ezovid_26431=1534324690; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 16:48:11 UTC lp_26431=https://www.billofsale-form.com/; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 16:48:11 UTC ezovuuidtime_26431=1623428291; Path=/; Domain=billofsale-form.com; Expires=Sun, 13 Jun 2021 16:18:11 UTC ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 16:48:11 UTC ezCMPCCS=true; Path=/; Domain=billofsale-form.com; Expires=Sat, 11 Jun 2022 16:18:11 GMT
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie,Accept-Encoding
x-endurance-cache-level: 2
x-middleton-display: pub_site_sol
x-middleton-response: 200
x-sol: pub_site
cf-cache-status: DYNAMIC
cf-request-id: 0a9d76f08a0000dfebe4030000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=cC7w2bsUytg14EttiYwCvo7q2QQIRkU5GbahvHtVUDcqMwaN8S0DqwEFqRaS7YoUXhssM2eV1srsQHfzGJv9OwuTLqVqnF0XGD3SfEq92LOTMBRDmBrILCW%2BN83NCy%2FI2F7SmpK%2FFfvn1kFjUiq73cI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 65dc2760dcffdfeb-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

date: Fri, 11 Jun 2021 16:18:10 GMT
content-type: text/plain; charset=utf-8
content-length: 0
cache-control: max-age=300, private
location: https://www.billofsale-form.com/
vary: Accept-Encoding Accept-Encoding
x-middleton-display: redirect
cf-cache-status: DYNAMIC
cf-request-id: 0a9d76ed830000323ce592b000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=c2QxHbhA%2B9K1s1m36T6pRuglSX6U%2FmFaEPq1qv6mUl5K6fRHC5Zh0FOJ%2BIk0PgiOSsTdZzkIKcxlioWCChMuriT0lYmIpghwUA%2BKtIVmnmAS6SrAs34NOCgQGQqs52dKRPdgZKSdTYY9wLoNdzBkPeLBow%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 65dc275c0b9d323c-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 35ms
14ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 dall.js Show response
go.ezodn.com/hb/ 228 KB
66 KB 59ms
35ms Script
application/javascript 2606:4700:3035::6815:4c02
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:4c02 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ecd439062761adb903783ef159ab195a150909cfa769f2efe7c70feefddab84

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 861103
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=EAEVSSzsX3iyh5W1%2FWQPBR6IZX8UukakqvdcOcFztJdWbykJ%2FSpF9sG8ZL8xcIrprmllpjzhKjLaBAk4sAgy8RXkPdsaaeET4c5844Z43a9vVzTXdee2TpkF6wtpHcvgibSYl74J"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 65dc2765fade3233-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f3bd0000323398b81000000001

GET
H3-29 200 autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
www.billofsale-form.com/wp-content/cache/autoptimize/css/ 219 KB
38 KB 50ms
31ms Stylesheet
text/css 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2641613956457a058550707409ced955499e181d4756077e11a0fb1952fbf23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,Origin
cf-cache-status: HIT
x-sol: orig
age: 698076
cf-polished: origSize=225258
x-middleton-display: staticcontent_sol, orig_site_sol
strict-transport-security: max-age=31536000
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f3ba000097d253ad6000000001
response: 200
last-modified: Thu, 03 Jun 2021 13:37:14 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
x-endurance-cache-level: 2
content-type: text/css
x-middleton-response: 200
expires: Tue, 24 May 2022 14:23:35 GMT
cache-control: public, max-age=30672000, immutable
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=zPh0IRwM9%2FldIw4R2IVonKKn858e%2FR74lHWmiGzU2LKqgLtg1GFguaW5WOVTpKKWLhGGIS2j7SxmxKh08TPr%2BpBCDW4ra%2FNeL9uZleFMtkIE%2F0bXNKtTiX0efKuqSNegxnPYVTRgeyMcSNsu3lXif9M%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc2765fb3297d2-FRA
display: staticcontent_sol, orig_site_sol
cf-bgj: minify

GET
H3-29 200 autoptimize_42d98f84ce36d173334b58ae09fe2290.css
www.billofsale-form.com/wp-content/cache/autoptimize/css/ 3 KB
2 KB 39ms
21ms Stylesheet
text/css 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_42d98f84ce36d173334b58ae09fe2290.css

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00a7f30cba5ffdca996801a316a2dd4d9a484c22240e32e4e302a2bfc16e1551

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/cache/autoptimize/css/autoptimize_42d98f84ce36d173334b58ae09fe2290.css
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,Origin
cf-cache-status: HIT
x-sol: orig
age: 698076
cf-polished: origSize=3226
x-middleton-display: staticcontent_sol, orig_site_sol
strict-transport-security: max-age=31536000
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f3c0000097d2412ee000000001
response: 200
last-modified: Thu, 03 Jun 2021 10:11:16 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
x-endurance-cache-level: 2
content-type: text/css
x-middleton-response: 200
expires: Tue, 24 May 2022 14:23:35 GMT
cache-control: public, max-age=30672000, immutable
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=0FJCdqBkyTzO0q8cCQNnrSmvS2Kb%2B45cTt761Iwpgf%2FVTw%2BPwzwPo2JerilJe%2FBdqIQegjVzX%2FUdYNGc41xrPlN0bYlQspovmT2ojKPfZRGZJc%2FiZUZBlSwcW9lfdSobzeUIDrDibN9xBt1NUSPO05U%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc2765fb3597d2-FRA
display: staticcontent_sol, orig_site_sol
cf-bgj: minify

GET
H2 200 css
fonts.googleapis.com/ 754 B
427 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Droid+Sans%3Aregular%2C700

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0665f5f3dfc038e410e2f0004a1a5ff6d2d91f392dd32208606eb8ff51195172

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 11 Jun 2021 15:25:49 GMT
server: ESF
date: Fri, 11 Jun 2021 16:18:11 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 11 Jun 2021 16:18:11 GMT

GET
H2 200 dmedianet.js Show response
contextual.media.net/ 155 KB
53 KB 237ms
176ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/dmedianet.js?cid=8CU4593V4

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

95e53ac1aeaa2243bb6dba0e5cfb3f7335cea1c895e22a96aee668bd9685e5e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-mnt-h: 8-11
content-encoding: gzip
server: Apache
etag: "81cef64d9b9d717c107573647ee9cb5f"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Fri, 11 Jun 2021 16:18:11 GMT
strict-transport-security: max-age=604800
x-mnt-w: 8-16
expires: Fri, 11 Jun 2021 16:23:11 GMT

GET
H3-29 200 cookieconsent.min.js Show response
www.billofsale-form.com/ezoic/ 4 KB
2 KB 38ms
20ms Script
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/ezoic/cookieconsent.min.js
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10d4b728888654e0b85c706a9310b551087d3321fb8ebfff147d07b13fa73bf0

Request headers

:path: /ezoic/cookieconsent.min.js
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 259456
cf-ray: 65dc2765fb3497d2-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f3bb000097d2412ed000000001
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
etag: W/"11a4-5c3cf8fc12640-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2FKc6iC%2FPhlFNoAcSyH%2FhgA1e0ec5GRrUQmGvidnG1nDqO%2F%2F2vgr4PtxQd7almVpUYO5U9L4rJEgVcc9kHqOpKZTPIb7%2FX%2BQBhhTz0enFFg%2BCDNuH0b8DZe0M51vbMZprS2r47av0LSrnq55AZMmIm8s%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex
expires: Wed, 08 Jun 2022 16:13:55 GMT

GET
H3-29 200 newlogo2.png
www.billofsale-form.com/wp-content/uploads/2015/08/ 3 KB
3 KB 27ms
26ms Image
image/png 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2015/08/newlogo2.png

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

385010b2baf8e0770b72bda5e96434d98bb716cfe29968e27a8eb51ee4ffde68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2015/08/newlogo2.png
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 259455
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f3ed000097d245b52000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/png
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=gtR07cQvsh1R4kpEsYqU2U0hY25QPu0W7tk%2BL8%2F1ePizZQntxfG8tz4dORztt91CkYU6%2BfkU%2Bj9rbTqGEFslZALsyR0xKDI9fTzO5KrekSQEyDntUelsizfXqBDREnuFm3ZSclxA1t3MQjbfFHFHjxY%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27664b8897d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Thu, 08 Jul 2021 16:13:56 GMT

GET
H2 200 ezoic.png
go.ezoic.net/utilcave_com/img/ 1 KB
2 KB 36ms
8ms Image
image/png 2600:9000:20eb:d200:2:cb38:840:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://go.ezoic.net/utilcave_com/img/ezoic.png
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:d200:2:cb38:840:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 02:36:30 GMT
via: 1.1 e0efba8a72628bfc3dc6d4d637b28302.cloudfront.net (CloudFront)
x-sol: middleton
age: 481309
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol
content-length: 1181
x-amz-cf-id: aQFn9kciSLGkN9iPnytazJL7gsZUJ_tED8fJiboGuA3noW3drSZ25w==
last-modified: Fri, 28 May 2021 00:46:16 GMT
server: nginx/1.16.0
etag: "49d-5bd497273b080-gzip-gzip"
vary: Accept-Encoding,Accept-Encoding
content-type: image/png
cache-control: max-age=604800
x-amz-cf-pop: FRA2-C1
display: staticcontent_sol
expires: Sun, 13 Jun 2021 02:36:22 GMT

GET
H3-29 200 autoptimize_f5ddbee1756ef961868f5222da593f8e.js Show response
www.billofsale-form.com/wp-content/cache/autoptimize/js/ 254 KB
84 KB 53ms
51ms Script
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/wp-content/cache/autoptimize/js/autoptimize_f5ddbee1756ef961868f5222da593f8e.js

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

01d4dd3082ee2fa86ca800af378341f54e4980badbe1448ffd39d0e3bc98a7f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/cache/autoptimize/js/autoptimize_f5ddbee1756ef961868f5222da593f8e.js
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,Origin
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 698074
cf-polished: origSize=260429
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f410000097d23cb7d000000001
response: 200
last-modified: Thu, 03 Jun 2021 06:12:20 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: application/javascript
expires: Tue, 24 May 2022 14:23:36 GMT
cache-control: public, max-age=30672000, immutable
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=yNiXFIObKXKMB9FjkBq06i4nil10wxqk7bk0uMQoNiEti5UMDgIpdlmx%2F9uEUSotdelV%2FzE%2B0FwfuAdaFfnCJLF5GdefWwqbuaNWTSx3ELw2w3F5Ln3z6aBw8AfGKZoWAt8Ft0bgexuuewgAwITk6eQ%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27667bac97d2-FRA
display: staticcontent_sol, staticcontent_sol
cf-bgj: minify

GET
H3-29 200 ezcl.webp Show response
www.billofsale-form.com/utilcave_com/inc/ 1 KB
1 KB 60ms
58ms Script
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/utilcave_com/inc/ezcl.webp?cb=4
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c5ad2fd42dffdf04a0f1d757c1cccb4d840218d7ecada79d6cc9db33ca40319

Request headers

:path: /utilcave_com/inc/ezcl.webp?cb=4
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding
cf-cache-status: BYPASS
x-sol: middleton
display: staticcontent_sol
x-middleton-display: staticcontent_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f410000097d24993b000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=UuD%2BeszKJ8HnFTz7ZUSzsPS2yu93XMTwNJAU7cSquTCenVX6aMIDuPRcZJ8eSa84eiuvydA3TLCWjxFPmUXvCbEAxV8sXLvsFiMKUkPPELaSA8GaeDbBZvzWT8V7o0ZDMGu7CNtnJ31%2BqpsX1Gsnt2o%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
set-cookie: ezoab_26431=mod1; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 18:18:11 UTC ezoadgid_26431=-1; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 16:48:11 UTC ezoref_26431=; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 18:18:11 UTC active_template::26431=pub_site.1623428291; Path=/; Domain=billofsale-form.com; Expires=Sun, 13 Jun 2021 16:18:11 UTC
cf-ray: 65dc27667bad97d2-FRA

GET
H3-29 200 houston.js Show response
www.billofsale-form.com/detroitchicago/ 3 KB
2 KB 40ms
38ms Script
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/houston.js?gcb=2&cb=36
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d6f7818a09adfc9c11ff7110eb866179ef9d36a3625cd1c02e23292d315daaa

Request headers

:path: /detroitchicago/houston.js?gcb=2&cb=36
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 693946
cf-ray: 65dc27667baf97d2-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f411000097d24a3f5000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Qz1oqJK6PXiq77TOtm%2BSkTTvcXqBnxcZBkyMz7m6OaS2%2BkTgIGCahDiMHSQYzyA0LDquz2s4oukWBqac8NW%2B8JrI50kJKadwdbdERL8py6M4Ybqg9Qq2wqIP57fNIP4mkBY7B%2BnOUxeC7oAiJOxAc1c%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 62 KB
21 KB 83ms
26ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

sffe /

Resource Hash

c4097db096b40a4c65ebda1889a5c68f17c046139fed626bdced56c5a23eddf0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "899 / 519 of 1000 / last-modified: 1623409848"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21320
x-xss-protection: 0
expires: Fri, 11 Jun 2021 16:18:11 GMT

GET
H3-29 200 banger.js Show response
www.billofsale-form.com/porpoiseant/ 43 KB
10 KB 40ms
38ms Script
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/banger.js?cb=194-2&bv=19&v=51&PageSpeed=off
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7aa8f89d9629c52abf1948b041e78560978a7f601876aa634852f0b2e58cbcf9

Request headers

:path: /porpoiseant/banger.js?cb=194-2&bv=19&v=51&PageSpeed=off
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 693946
cf-polished: origSize=44006
cf-ray: 65dc27667bb097d2-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f411000097d22305a000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Oupx9mp58plreeLKFN4cnKOF2PLg1aD37C3zbiSGKUnjapCeDhBr8LmekuEuyt8H0x4mRHNNYmzrlI1%2Fo6yjayNEEoFr4ymiVHr4wklwQiG7afx2Ta5N9kyIlVJau2uyonGXQwQgpFXHW9lpm7FrrEI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex

GET
H3-29 200 wp-emoji-release.min.js Show response
www.billofsale-form.com/wp-includes/js/ 14 KB
5 KB 40ms
39ms Script
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/wp-includes/js/wp-emoji-release.min.js

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-includes/js/wp-emoji-release.min.js
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,Origin
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 574754
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f412000097d24d3f8000000001
response: 200
last-modified: Fri, 04 Jun 2021 17:12:32 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: application/javascript
cache-control: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=LhDXp1mpRZir%2BIHuQvCD5OZHoQrwtSGqnvA89gW0jRgziRsPXkxre4LIF9Z7m0%2FKGD%2BW9zby1xvniC%2Fntwa1re1Zt1Xj8a3Y3%2FCILjV0eeBYdzPEX1UCv3hJwS1gxKc8X5fenTxHgLJz5%2FAQyaObwSU%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27667bb297d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 05 Jun 2022 00:38:57 GMT

GET
H2 200 ezosuigeneris.js Show response
g.ezoic.net/ 555 B
563 B 81ms
24ms Script
text/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/ezosuigeneris.js
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 58bd47f3f007b720189b832527c45ca568eba4917e32863f85a8f4122766b4b2

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: br
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
etag: 3d7d73c240a53ea0800c876a9d435f7f
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript
cache-control: max-age=999999, private
content-length: 276
expires: Mon, 29 Apr 2020 21:44:55 GMT

GET
H3-29 200 cmbv2.js Show response
www.billofsale-form.com/detroitchicago/ 85 KB
21 KB 61ms
60ms Script
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c16267b73be934e47fa59b248a66488479092eef5d06d02977630f01b6015d6

Request headers

:path: /detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 236652
cf-polished: origSize=87117
cf-ray: 65dc27667bb397d2-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f412000097d215274000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=uwFQVq6OzQEh3OdLvW1gdifVO1rg2%2BNrzRr4LMDnzD%2FKpuywOTPcDe7V2b%2BEusV6UPu7XVd%2F6XYE3t4mI0GiGnHsGZNMxLNyGLhiqiqQ6%2BQ3%2BS4aavcRoOwRtIR4bkAp4NKPvuUs828GB2roA2QzAD4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex

GET
H3-29 200 body-bg7.png
www.billofsale-form.com/wp-content/themes/sahifa/images/patterns/ 21 KB
21 KB 39ms
39ms Image
image/png 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/themes/sahifa/images/patterns/body-bg7.png

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_42d98f84ce36d173334b58ae09fe2290.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a6ac6e588a725241e6f43feaad46fb36de9682576f5f29c570edc3ec5247477

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/themes/sahifa/images/patterns/body-bg7.png
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_42d98f84ce36d173334b58ae09fe2290.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_42d98f84ce36d173334b58ae09fe2290.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 259455
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f412000097d245b54000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/png
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=jIU4Bj2SzcHJtdCXAm4sth851zqw%2F8hOwEw40HCzjpa3%2F4S85vdULMyMx7wNW2UgjeXF2GVoLYM0uxQHyyrqPokU8%2B5F5q3SXc%2FyH5rRuHZ%2FFVs3B%2B5rcL8xRXeA2%2BXfADQlfwTj5qPnk2Cjc4Xux6c%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27667bb597d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Thu, 08 Jul 2021 16:13:56 GMT

GET
H3-29 200 home.png
www.billofsale-form.com/wp-content/themes/sahifa/images/ 1022 B
2 KB 54ms
53ms Image
image/png 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/themes/sahifa/images/home.png

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6039cdb2c8028b73ddb9d711e7eb22834a8e11ba865283a7ed2fd2c75a401040

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/themes/sahifa/images/home.png
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 259455
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1022
cf-request-id: 0a9d76f42d000097d2132e7000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/png
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=43JsPmfhyPsS5Ee3Lvje%2BNhHiBzvyUc7vaMhLP0cOmZUH2ZSoV6ifefV4ppgOdT1piYIrLKnPf4osdou1VAU6YkLmZBArwyLugtBjOEkulP1iHtkn6t%2FkJ77jkTg%2Buwo2Wem6gf3PNDHWctUYbGaXgE%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 65dc2766abdb97d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Thu, 08 Jul 2021 16:13:56 GMT

GET
H3-29 200 fontawesome-webfont.woff2
www.billofsale-form.com/wp-content/themes/sahifa/fonts/fontawesome/ 55 KB
56 KB 54ms
53ms Font
font/woff2 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/wp-content/themes/sahifa/fonts/fontawesome/fontawesome-webfont.woff2?v=4.3.0

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-fetch-mode: cors
origin: https://www.billofsale-form.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
:path: /wp-content/themes/sahifa/fonts/fontawesome/fontawesome-webfont.woff2?v=4.3.0
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.billofsale-form.com
Referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
strict-transport-security: max-age=31536000
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 259455
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f42d000097d21d889000000001
x-endurance-cache-level: 2
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff2
access-control-allow-origin: https://www.billofsale-form.com
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=VdQH4WGBDE24T2jk8DxVFSpV8uR9G%2FcECNYnX5Ov3Z9ls9wOPfZXHsNaW6bJKoHYJpX2IEvu5YoNkry5rsMZ9N8Z5IKPnj6qbvNFmxhJXtFXcxglME4%2BaD1r8fWpy5Fu9pM7jI7Xf7wcdi7qDFJj%2BQ0%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc2766abdd97d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Thu, 08 Jul 2021 16:13:56 GMT

GET
H2 200 SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
fonts.gstatic.com/s/droidsans/v12/ 21 KB
21 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/droidsans/v12/SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3Aregular%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a615849237c0ce94e73fc69d86e5f9c58bdaca8d9756a5ff4c88fa86b14e6177

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.billofsale-form.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 12:21:16 GMT
x-content-type-options: nosniff
age: 273415
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21232
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 01:56:42 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 12:21:16 GMT

GET
H3-29 200 BebasNeue-webfont.woff
www.billofsale-form.com/wp-content/themes/sahifa/fonts/BebasNeue/ 20 KB
20 KB 36ms
31ms Font
font/woff 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/wp-content/themes/sahifa/fonts/BebasNeue/BebasNeue-webfont.woff

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8c2e4d6ab0ad2f055a6cc3c777d31531e665758db5ca815f2613afad72f7088

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-fetch-mode: cors
origin: https://www.billofsale-form.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; active_template::26431=pub_site.1623428290; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true
:path: /wp-content/themes/sahifa/fonts/BebasNeue/BebasNeue-webfont.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.billofsale-form.com
Referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
strict-transport-security: max-age=31536000
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 693945
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f455000097d24a3fb000000001
x-endurance-cache-level: 2
response: 200
last-modified: Thu, 03 Jun 2021 02:12:46 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff
access-control-allow-origin: https://www.billofsale-form.com
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=WTEN0V3KXA8dqT4h0cMn0XK%2FucPVMPILw%2Br2kLVfnIUup2LzynCM0r3Yg2Nvioz1055%2BU2nsmlCA1I9%2FJ7xa6%2F41OiVGDGUrsH3vn0cBNj4nTNsKRF5IFVz7h%2FpcHNFaU0XDMNc%2B8GTM55TcrUTW%2F%2FM%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc2766ec0a97d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sat, 03 Jul 2021 15:32:25 GMT

GET
H3-29 200 SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
fonts.gstatic.com/s/droidsans/v12/ 22 KB
22 KB 12ms
8ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/droidsans/v12/SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3Aregular%2C700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06c572e99c878362d40d1f358efdfe400ae1310f35cf22174dcdd5db022dd810

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.billofsale-form.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 23:06:08 GMT
x-content-type-options: nosniff
age: 234723
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22340
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 02:52:18 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 23:06:08 GMT

GET
H3-29 200 feature_homepage2.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 8 KB
8 KB 24ms
20ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/feature_homepage2.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9d391cff26c4263fb63bd1ec57cb0cbd9c9693a4e7f6c8451d073438f2a6bd6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/feature_homepage2.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 440505
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f460000097d232a60000000001
response: 200
last-modified: Sun, 06 Jun 2021 09:11:29 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=n4jSgQ5fioakdY6eDL%2BWYypjKYnRUTnC7SgiKPF0kRR88lBvrwGD1NqLZectrL9XWj7HQPlZqPE8gFEeoacYYQNdwoZHg%2F3ePptuCPghB2vQbk7h6C%2B5S8RdxGF436I9UwM1710e8rksPKTe5JZsWj4%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27670c1a97d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Tue, 06 Jul 2021 13:56:26 GMT

GET
H3-29 200 billofsaleform.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 6 KB
7 KB 19ms
15ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/billofsaleform.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2bf593112504d6cf7ef713e8648777ba85e0cf0fe4930933960d83ce041b19dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/billofsaleform.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 8117
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f461000097d2191b1000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2FYv2VRTkcmYu9VgnPCMw4XoJrv%2B74rr7cTY%2FTzQuGnT2ll1bDcOyITNndLnUOjpGITdVwodWOxIXS18Y0%2BiceYAmoTmuTnMxK6WyUI5Av99dh5WRVlLhi4BgXMvLQOtwyYn9z%2FyNiWc6tT23DTCDZEs%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27670c1b97d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 auto-bill-of-sale-form-thumb-310x190.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 10 KB
11 KB 19ms
14ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/auto-bill-of-sale-form-thumb-310x190.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f563769bc10d7f4f9daad8c0992d4749482a80ad5bafd4fda3024655a108aa9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/auto-bill-of-sale-form-thumb-310x190.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 8117
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f462000097d24d3ff000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wlrbkk4Gg7fgsD8CUQ%2B3PwYH56jGtBvUe3v9nWsPYq3TYBHI7MOtTgh9CQKMxUwgF6sLTlB%2FIxZ3tG%2B3va8sPR4mnlbtHpKWl86jwCzZDcn5HlEcCrcLMyBURNOOxDEM%2FEimloZ4watr4gHnwYjXdCc%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27670c1c97d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 used-car-bill-of-sale-form-thumb-310x190.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 9 KB
10 KB 25ms
21ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/used-car-bill-of-sale-form-thumb-310x190.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5d4535cc978de1c946554320f48b5b816ebe04e7de3408c9affccb277625138

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/used-car-bill-of-sale-form-thumb-310x190.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 8117
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f462000097d258a41000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=k2BtEe6uSiwwpldtSlvxGXDUPNtK81jADNCcGh3EI6vU3mT36SS3yMUPUL2aJcg6nlW9NuI%2B%2BJlFuAn%2FUhHi17eb%2BJIY4Ur1zLADmAP1xTD0GRjmcTKa2ikNbChMrGoyxyF4CnjNND1iDtSIsDhKZG8%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27670c1d97d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 motor-vehicle-bill-of-sale-form-thumb-310x191.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 13 KB
13 KB 20ms
15ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/motor-vehicle-bill-of-sale-form-thumb-310x191.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

661cbae1050193b339c2f4753348eee3b11a0fe3c8c6b3954426b7cf347cabd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/motor-vehicle-bill-of-sale-form-thumb-310x191.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 440505
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f463000097d249942000000001
response: 200
last-modified: Sun, 06 Jun 2021 13:12:22 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=MmNaMYoDrt7XOaxZYFGoDYmUNe4f3BToTFXzd40HJyegwjVKp%2BTTPzIg2JIP71%2BEr3lobIXdXPfSzmJ0gUuafVU507FdRpv%2BOBnh9ly96CDrFK83%2BZrdZ9hq5bVVUYL1x6rW7EleEFckEXrpnLQT6ec%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27670c1e97d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Tue, 06 Jul 2021 13:56:26 GMT

GET
H3-29 200 motorcycle-bill-of-sale-form-thumb1-310x190.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 10 KB
11 KB 24ms
19ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/motorcycle-bill-of-sale-form-thumb1-310x190.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

202bd56541955467d5f146d2327d07cf24d15c1a4cec190b4422e0b05e6aa521

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/motorcycle-bill-of-sale-form-thumb1-310x190.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 8117
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f464000097d245b55000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=eAzErraHx%2BpD6%2B7495%2BW3lMC3lTW8ZMIKkvwN2H3tkZWz7tPQf05zYfvN5tFtqlib97JIk%2F4GtWMihZFoQqG72ALWcMaZE88IR98zN5O6HLaK7oGpDqIoFVZIHGIZpBeGAlwij0hhNs45W0pIOZWKJM%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27670c1f97d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 stripe.png
www.billofsale-form.com/wp-content/themes/sahifa/images/ 93 B
886 B 17ms
16ms Image
image/png 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/themes/sahifa/images/stripe.png

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

23c79bb552706be2ca97bdb259921e3269a5263326b147676c2f7909a45b58c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/themes/sahifa/images/stripe.png
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 259455
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 93
cf-request-id: 0a9d76f482000097d258a42000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/png
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HFivzJem5NCrSwa%2FGLjnLuzpuio9j1IcN4f8mxZtdJZOvayG2%2F%2BYI3FpBD0vZuc1FeBXtdexn3XW3Pz0Hr6BJlbBgNYO86oNbcljw%2B2rDkiFppXkgpQZzBBTcWrIwEsvoYb%2FHVLqvhuczEX8YzAhDqY%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 65dc27673c4597d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Thu, 08 Jul 2021 16:13:56 GMT

GET
H3-29 200 general-bill-of-sale-form-thumb-310x190.jpg
www.billofsale-form.com/wp-content/uploads/2012/07/ 8 KB
9 KB 16ms
15ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/07/general-bill-of-sale-form-thumb-310x190.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a93848c085efc9f585f788e97acaccd8e4b19ea4b81e1b82c72900a53d233a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/07/general-bill-of-sale-form-thumb-310x190.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 8117
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f496000097d2412f9000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2B%2FjgijXuQFWsfWX6csOQemDJg3wuRdCMXhBx2UHvePh9sfzRbfGEKXL%2FjRGflGFo%2FIonNMFagii9Ag%2BTWnkavQS7OWRdFVxMNp4gPQl6HVcxaNDMhTJv%2FgTAfzXU1qGpSMEeFg9qX1sB2IRkQ81VMmc%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27675c6097d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 blank-bill-of-sale-form-thumb-310x190.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 6 KB
6 KB 17ms
16ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/blank-bill-of-sale-form-thumb-310x190.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9fdb19a71e00bb21dfedda32adce5776cf86de33a1b4b2aebafdbd6f94cebc88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/blank-bill-of-sale-form-thumb-310x190.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 8117
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f497000097d223063000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=m8NZdPl7xUyHih4ZhCKar%2FWAKpYzB760elnXbXs3sqS3CawIpkEoEXDbbMpK38AkwnUPd4tEqGbSRGmvtB14qJyMhJicDQvs1z1%2Bl%2F3Z3NEFutkn%2BzYVFrCEe5nOtJw3JdjrgfGmtWHfMCT67XcWwss%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27675c6297d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 equine-bill-of-sale-form-thumb-310x191.jpg
www.billofsale-form.com/wp-content/uploads/2012/07/ 16 KB
17 KB 17ms
16ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/07/equine-bill-of-sale-form-thumb-310x191.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6f57fd658644f23df86a2b6859fb3a01831bc41d99c9cb6a38ecf0641d89a722

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/07/equine-bill-of-sale-form-thumb-310x191.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 8117
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f497000097d249945000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=iJEh5QPBCiSsUjHNblB8pNj2IeaiveRpVp%2BMGEEFm74rUF53AC2QGZoS7LLL0GMXHe82vbU6JOAmzirPZ5yuv3rqdl4t0qzYVi0LPEiFn5mWIp35ImO%2BGBF6FxUYO9Ae8V65PmPJ%2FLgIp51ETC9pxco%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27675c6497d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 gun-bill-of-sale-form-thumb-310x190.jpg
www.billofsale-form.com/wp-content/uploads/2012/07/ 9 KB
10 KB 17ms
17ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/07/gun-bill-of-sale-form-thumb-310x190.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b113cf7d5e8230f2c635ef644ee8ab1533228b80b42d953bc6ca10ec2d2a8cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/07/gun-bill-of-sale-form-thumb-310x190.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 8117
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f497000097d2282ab000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=IcAQGyuRQ1hFrnWoiHH%2FcgB21nckkWzEEBbd%2Fl6Vl0Rf2U5euOxCfNO5L2DP8xc%2FsGOCiYS%2Btro5iwypCaPDZfy1586Idk5fWkSoRugNMSa7vk5PgMER%2BXq%2BmRenzenpKZOh1J7FCrfK39qORwvo%2Bzw%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dc27675c6797d2-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 44ms
14ms Preflight
application/json 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.billofsale-form.com%2F&domain=www.billofsale-form.com&cw=1

Protocol

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://www.billofsale-form.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: https://www.billofsale-form.com
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1336
date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.billofsale-form.com%2F&domain=www.billofsale-form.com&cw=1
https://mug.criteo.com/sid?cpp=FT02SnxNd2NlM0czdXVENHlWc2tqWDBLMkVrc0pTeFRNMEdHQXdZSkloYzRJdmloSVRLODlrUk5wajVJN3ZxZnFiK3VlYTRRQWVTLzBLeW9BYXFzdHBkWkR5b2wzNFZrOXhocE84WWwyTGJWclBjbXNzMW9iM0FxMFcraE...

337 B
625 B

91ms
30ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=FT02SnxNd2NlM0czdXVENHlWc2tqWDBLMkVrc0pTeFRNMEdHQXdZSkloYzRJdmloSVRLODlrUk5wajVJN3ZxZnFiK3VlYTRRQWVTLzBLeW9BYXFzdHBkWkR5b2wzNFZrOXhocE84WWwyTGJWclBjbXNzMW9iM0FxMFcraE5HSTJ3V2dmMm9vbW9MSU0vcjIvUllzYjBLQklaeTJ5Wm1PRmJWdFRqc3dTN1lVVW1BekRVQmRPbmc4bE9SNmJhbDlYUGdVaWxwYUVHckkrZ1ROR1Q0dWhTSVR2aHZGWHJtYVg3dWpsYnE3NjlkejZJN3pCaU1YUGFNN2RYQnVxcWhmUHpRZXp3fA&cppv=2

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

b794ad42af27681a525c1877fb6d8c2fcbd2476be61ffba0f9b082607cf84edf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Fri, 11 Jun 2021 16:18:11 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2953
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Fri, 11 Jun 2021 16:18:11 GMT
location: https://mug.criteo.com/sid?cpp=FT02SnxNd2NlM0czdXVENHlWc2tqWDBLMkVrc0pTeFRNMEdHQXdZSkloYzRJdmloSVRLODlrUk5wajVJN3ZxZnFiK3VlYTRRQWVTLzBLeW9BYXFzdHBkWkR5b2wzNFZrOXhocE84WWwyTGJWclBjbXNzMW9iM0FxMFcraE5HSTJ3V2dmMm9vbW9MSU0vcjIvUllzYjBLQklaeTJ5Wm1PRmJWdFRqc3dTN1lVVW1BekRVQmRPbmc4bE9SNmJhbDlYUGdVaWxwYUVHckkrZ1ROR1Q0dWhTSVR2aHZGWHJtYVg3dWpsYnE3NjlkejZJN3pCaU1YUGFNN2RYQnVxcWhmUHpRZXp3fA&cppv=2
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2111
content-length: 509
expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
375 B 73ms
29ms XHR
application/json 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 1 KB
1 KB 223ms
147ms XHR
application/json 54.194.104.251
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?si=20886&pi=3&bf=728x90&schain=1.0%2C1!ezoic.ai%2Ccb390534799b3c6fb38c40a159032f8f%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fwww.billofsale-form.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%224.27.0%22%7D&ogu=https%3A%2F%2Fwww.billofsale-form.com%2F&ns=9830
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 59cb29c5ae0173aefe10cf4fda280b5da604c342c7067ae69e49bfa8d5340c39

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: gzip
server: nginx
timing-allow-origin: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.billofsale-form.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=UTF-8
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 1 KB
1 KB 138ms
62ms XHR
application/json 54.194.104.251
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?si=20837&pi=3&bf=300x250&schain=1.0%2C1!ezoic.ai%2Ccb390534799b3c6fb38c40a159032f8f%2C1%2C%2C%2C&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fwww.billofsale-form.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%224.27.0%22%7D&ogu=https%3A%2F%2Fwww.billofsale-form.com%2F&ns=9830
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: f377b759aac40c25cc53ca008840e474260854a7f18be7473369b65f16bff5b4

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: gzip
server: nginx
timing-allow-origin: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.billofsale-form.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=UTF-8
expires: 0

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ 0
224 B 79ms
22ms XHR
application/json 35.157.224.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.224.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.billofsale-form.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ 0
224 B 295ms
231ms XHR
application/json 35.157.224.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.224.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.billofsale-form.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
120 B 61ms
21ms XHR
text/plain 3.123.191.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.191.65 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.billofsale-form.com
date: Fri, 11 Jun 2021 16:18:11 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
119 B 62ms
22ms XHR
text/plain 3.123.191.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.191.65 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.billofsale-form.com
date: Fri, 11 Jun 2021 16:18:11 GMT
access-control-allow-credentials: true
vary: Origin

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 262 B
1 KB 104ms
44ms XHR
application/json 185.33.220.242
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.242 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

2b2016f58510908bc9ef7f3a931ace0d37f779f53412550b755a813fedcf1288

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:11 GMT
X-Proxy-Origin: 185.230.125.108; 185.230.125.108; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.233:80
AN-X-Request-Uuid: 7f335f85-1a32-4a98-8a2e-cb230fc0ca5d
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.billofsale-form.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 262
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 ortb Show response
bid.contextweb.com/header/ 0
514 B 371ms
137ms XHR
text/plain 198.148.27.133
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.contextweb.com/header/ortb?src=prebid
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.148.27.133 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 11 Jun 2021 16:18:12 GMT
server: envoy
cwdl: 22/4211,22/4211
access-control-allow-origin: https://www.billofsale-form.com
access-control-expose-headers: Access-Control-Allow-Origin
access-control-allow-credentials: true
x-envoy-upstream-service-time: 6
cw-server: bid-deployment-5fcfb8b64b-2mpsg

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 2359
date: Fri, 11 Jun 2021 15:38:52 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Fri, 11 Jun 2021 17:38:52 GMT

GET
H3-29 200 nmash.js
www.billofsale-form.com/porpoiseant/ 33 KB
9 KB 40ms
39ms Other
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/nmash.js?v=19
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9ceb55dc61f4a59d76a175754dd840f84a3d4e5e3b4797690ecea8fa8bf89cf

Request headers

:path: /porpoiseant/nmash.js?v=19
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291; ezouspvv=0; ezouspva=0; _pbjs_userid_consent_data=3524755945110770; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: same-origin
accept: */*
cache-control: no-cache
sec-fetch-dest: worker
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 693946
cf-polished: origSize=34125
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f4fb000097d232a6d000000001
x-robots-tag: noindex
last-modified: Fri, 28 May 2021 04:19:14 GMT
server: cloudflare
etag: W/"854d-5c35c2da8d480;5c3d8f5e745e1-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=IfpllGjWI3gCTOALdampCV1PjOKo5mUHnCiqMI70GgIAxV8aF7mbG1pyG2t32IdCBNe1bz6RpeAURd8FECAvuq6USJT6rOH2Ka4j3xxec7LmQwioyJA7q1dlx9UuyAltw90oVWULEci9uQwKGEKO%2Bc0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 65dc2767fcd897d2-FRA
cf-bgj: minify

GET
H3-29 200 imp.gif Show response
www.billofsale-form.com/detroitchicago/ 43 B
685 B 221ms
221ms XHR
image/gif 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A0%2C%22ad_count_adjustment%22%3A1%2C%22ad_lazyload_version%22%3A5%2C%22ad_load_version%22%3A0%2C%22ad_location_ids%22%3A%221%2C4%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A2%2C%22bidder_method%22%3A0%2C%22bidder_version%22%3A3%2C%22city%22%3A%22%22%2C%22country%22%3A%22DE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A2%2C%22domain_id%22%3A26431%2C%22domain_test_group%22%3A20210309%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22iab_category_0%22%3A%223000%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A0%2C%22page_ad_positions%22%3A%221101%2C1112%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%225842384c-94bc-4b1e-5ced-d389288b9a63%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%22%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A36124%2C%22response_time_orig%22%3A613%2C%22serverid%22%3A%2215.237.82.160%3A14779%22%2C%22state%22%3A%22%22%2C%22sub_page_ad_positions%22%3A%221101%2C1112%22%2C%22t_epoch%22%3A1623428290%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fwww.billofsale-form.com%2F%22%2C%22user_id%22%3A0%2C%22weather_precipitation%22%3A0%2C%22weather_summary%22%3A%22%22%2C%22weather_temperature%22%3A0%2C%22word_count%22%3A1111%2C%22worst_bad_word_level%22%3A0%7D
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:path: /detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A0%2C%22ad_count_adjustment%22%3A1%2C%22ad_lazyload_version%22%3A5%2C%22ad_load_version%22%3A0%2C%22ad_location_ids%22%3A%221%2C4%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A2%2C%22bidder_method%22%3A0%2C%22bidder_version%22%3A3%2C%22city%22%3A%22%22%2C%22country%22%3A%22DE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A2%2C%22domain_id%22%3A26431%2C%22domain_test_group%22%3A20210309%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22iab_category_0%22%3A%223000%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A0%2C%22page_ad_positions%22%3A%221101%2C1112%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%225842384c-94bc-4b1e-5ced-d389288b9a63%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%22%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A36124%2C%22response_time_orig%22%3A613%2C%22serverid%22%3A%2215.237.82.160%3A14779%22%2C%22state%22%3A%22%22%2C%22sub_page_ad_positions%22%3A%221101%2C1112%22%2C%22t_epoch%22%3A1623428290%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fwww.billofsale-form.com%2F%22%2C%22user_id%22%3A0%2C%22weather_precipitation%22%3A0%2C%22weather_summary%22%3A%22%22%2C%22weather_temperature%22%3A0%2C%22word_count%22%3A1111%2C%22worst_bad_word_level%22%3A0%7D
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291; ezouspvv=0; ezouspva=0; _pbjs_userid_consent_data=3524755945110770; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:12 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=4CVeDKao9lsqzY7vfo47fyh8Sg7OCW6fVhFuC8l%2Bl1kE9AzT1V0xuQ9c3mamdlXlvAUby1cGhNPQYPQWR4ganY0cooL0ASGZWRw%2FA70i%2FFRRmaVBK2cpBMmT9P%2BdPdar0HZaqzmcwTf4WGeXtT3O%2Fo4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-middleton-display: imp_sol
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
cf-ray: 65dc2767fcdb97d2-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 43
cf-request-id: 0a9d76f4fb000097d21d890000000001

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 25ms
8ms Script
application/javascript 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: gzip
etag: "WhyxmPkT7L77qVDcrjxwGw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Fri, 18 Jun 2021 16:18:11 GMT

GET
H2 200 ezosuigenerisc.js Show response
g.ezoic.net/ 0
54 B 26ms
25ms Script
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/ezosuigenerisc.js?nogen=1
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
cache-control: max-age=300, private
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8

GET
H3-29 200 cl.gif
www.billofsale-form.com/detroitchicago/ 43 B
686 B 70ms
69ms Image
image/gif 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.billofsale-form.com/detroitchicago/cl.gif?pvID=5842384c-94bc-4b1e-5ced-d389288b9a63&dID=26431
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:path: /detroitchicago/cl.gif?pvID=5842384c-94bc-4b1e-5ced-d389288b9a63&dID=26431
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291; ezouspvv=0; ezouspva=0; _pbjs_userid_consent_data=3524755945110770; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=fccWnHKOUOt70AbxUhb9h4Nr26a%2Bmv%2F752ca0iqAtzBKEHtnpAgoux3dNgGlUOxav2borxaD6KzL3%2FZpxlBw8iZdJhP3nJyVGFyv4Wdme3ro278n2WV8dzx6i2BXPN5yw%2F%2FtUyrAJBORvsX0QOoiD%2Fo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-middleton-display: imp_sol
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
cf-ray: 65dc27681cee97d2-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 43
cf-request-id: 0a9d76f50d000097d23e3d6000000001

GET
H3-29 200 greenoaks.gif Show response
www.billofsale-form.com/detroitchicago/ 0
675 B 35ms
34ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJkZXZpY2Vfd2lkdGgiLCJ2YWwiOiIxNjAwIn0seyJuYW1lIjoiZGV2aWNlX2hlaWdodCIsInZhbCI6IjEyMDAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA2LTExIn0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTgifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiNSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV9wcmltYXJ5X3N1YnRhZyIsInZhbCI6ImVuIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJkYXRhIjpbeyJuYW1lIjoidW5pdmVyc2FsX3VzZXJfaWQiLCJ2YWwiOiIzZDdkNzNjMjQwYTUzZWEwODAwYzg3NmE5ZDQzNWY3ZiJ9XX1d
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJkZXZpY2Vfd2lkdGgiLCJ2YWwiOiIxNjAwIn0seyJuYW1lIjoiZGV2aWNlX2hlaWdodCIsInZhbCI6IjEyMDAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA2LTExIn0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTgifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiNSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV9wcmltYXJ5X3N1YnRhZyIsInZhbCI6ImVuIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJkYXRhIjpbeyJuYW1lIjoidW5pdmVyc2FsX3VzZXJfaWQiLCJ2YWwiOiIzZDdkNzNjMjQwYTUzZWEwODAwYzg3NmE5ZDQzNWY3ZiJ9XX1d
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod1; ezopvc_26431=1; ezepvv=0; ezovid_26431=1534324690; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623428291; ezovuuid_26431=352c8c24-100e-41b4-5e8e-148e7a7590b2; ezCMPCCS=true; active_template::26431=pub_site.1623428291; ezouspvv=0; ezouspva=0; _pbjs_userid_consent_data=3524755945110770; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9d76f50d000097d241303000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2FsTvRtIVeJ%2Fj5VYo7I1eAUCnGGLc%2FXqzVJdGlg7%2BGhQU9Qb%2BkchOGigbw0FmZpWSY5TwJEDIgn2ZMXpVWlTHZ3nhJkURLqMc%2BuDmTSgqOi8yWuuABpYcDdviYPtLsGQofVm70KygOFpNfNriGirPaCw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dc27681cf097d2-FRA
expires: Thu, 10 Jun 2021 16:18:11 UTC

GET
H3-29 200 pubads_impl_2021060701.js Show response
securepubads.g.doubleclick.net/gpt/ 318 KB
112 KB 51ms
26ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

sffe /

Resource Hash

094c1111eeb737673d376e2598c9abfad2c1dadeab91522940bbf5d2ff512a72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 07 Jun 2021 08:45:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 114129
x-xss-protection: 0
expires: Fri, 11 Jun 2021 16:18:11 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 105ms
33ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1157
date: Fri, 11 Jun 2021 16:18:11 GMT
content-encoding: gzip
vary: Accept-Encoding

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 15ms
14ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=598433398&t=pageview&_s=1&dl=https%3A%2F%2Fwww.billofsale-form.com%2F&ul=en-us&de=UTF-8&dt=Bill%20of%20Sale%20Form&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=458675112&gjid=345100889&cid=2054788727.1623428292&tid=UA-978532-51&_gid=1653060147.1623428292&_r=1&_slc=1&z=1026422508

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:11 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK browserfp.min.js Show response
pxlclnmdecom-a.akamaihd.net/javascripts/ 108 KB
34 KB 108ms
42ms Script
text/javascript 2.17.123.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU4593V4
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU4593V4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.17.123.80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: / Express
Resource Hash: ae49854b995c21d9416af58e4f4f666041c14421b1cdf6a136078b9a19ad8e95

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 16:18:12 GMT
Content-Encoding: gzip
X-Powered-By: Express
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Cache-Control: max-age=1800
Connection: keep-alive
Content-Length: 34106
Expires: Fri, 11 Jun 2021 16:48:12 GMT

GET
H2 200 fcmain.js Show response
contextual.media.net/1017354394/ 98 KB
28 KB 596ms
591ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/1017354394/fcmain.js?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU4593V4&cpcd=pW0W2n1qzJZYY8yxiQBiyA%3D%3D&crid=661154765&size=600x250&cc=CH&https=1&vif=1&requrl=https%3A%2F%2Fwww.billofsale-form.com%2F&nse=5&vi=1623428291328015259&lw=1&ugd=4&nb=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU4593V4

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

32b2fbe18c177f7eed99b4ab51fb875e4ea80fd7731b27be9cf6391b9e273fad

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
x-mnt-hl2: 8-8
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=0, no-cache, no-store
date: Fri, 11 Jun 2021 16:18:12 GMT
x-mnt-w: 8-21
content-length: 27807
expires: Fri, 11 Jun 2021 16:18:12 GMT

GET
H2 200 fcmain.js Show response
contextual.media.net/1017354394/ 50 KB
12 KB 560ms
558ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/1017354394/fcmain.js?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU4593V4&cpcd=pW0W2n1qzJZYY8yxiQBiyA%3D%3D&crid=889045848&size=300x250&cc=CH&https=1&vif=1&requrl=https%3A%2F%2Fwww.billofsale-form.com%2F&nse=5&vi=1623428291499523997&lw=1&ugd=4&nb=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU4593V4

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

3a4e4fabacb0f91e3f1ead1b56d8ea8b20105640718307950f5491d2a0ad9a34

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
x-mnt-hl2: 8-8
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=0, no-cache, no-store
date: Fri, 11 Jun 2021 16:18:12 GMT
x-mnt-w: 8-19
content-length: 12304
expires: Fri, 11 Jun 2021 16:18:12 GMT

GET
H/1.1 200
OK videoAds.js Show response
adservetx.media.net/ 147 KB
47 KB 89ms
30ms Script
text/javascript 104.90.192.189
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://adservetx.media.net/videoAds.js?cid=8CU4593V4&crid=005585204&dn=billofsale-form.com&https=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU4593V4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.192.189 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: nginx /
Resource Hash: 4d3a8098f56d6b35db597d7bc9aeac3e5952a19a34126a12fa71f9c1baba0a4d

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 16:18:12 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=300
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Expires: Fri, 11 Jun 2021 16:23:12 GMT

GET
H2 200 bping.php
lg3.media.net/ 35 B
189 B 58ms
55ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=0&prid=8PRHGG6T9&cid=8CU4593V4&crid=661154765&vi=1623428291328015259&ugd=4&lf=6&cc=CH&sc=ZH&lper=100&wsip=2886781008&r=1623428291965&requrl=https%3A%2F%2Fwww.billofsale-form.com%2F&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_rakh=1623428291166932524&vgd_rpth=%2Fdmedianet.js&vgd_pgid=p0335872702t202106111618&vgd_pgids=1&vgd_uspa=0&hvsid=00001623428291957031188903482105&gdpr=0&vgd_end=1

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 11 Jun 2021 16:18:12 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 11 Jun 2021 16:18:12 GMT

GET
H2 200 bping.php
lg3.media.net/ 35 B
189 B 61ms
59ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=0&prid=8PRHGG6T9&cid=8CU4593V4&crid=889045848&vi=1623428291499523997&ugd=4&lf=6&cc=CH&sc=ZH&lper=100&wsip=2886781008&r=1623428291980&requrl=https%3A%2F%2Fwww.billofsale-form.com%2F&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_rakh=1623428291166932524&vgd_rpth=%2Fdmedianet.js&vgd_pgid=p0335872702t202106111618&vgd_pgids=2&vgd_uspa=0&hvsid=00001623428291968031188903484606&gdpr=0&vgd_end=1

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 11 Jun 2021 16:18:12 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 11 Jun 2021 16:18:12 GMT

GET
H2 200 rules-p-31iz6hfFutd16.js Show response
rules.quantcount.com/ 3 B
429 B 66ms
19ms Script
application/javascript 2600:9000:206e:7600:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:7600:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 14:24:20 GMT
via: 1.1 a243c19b86829b9271d382d92416109c.cloudfront.net (CloudFront)
age: 6833
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 19:50:24 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
x-amz-cf-id: qfNKvPYpIU9bKEpenRRSNkT7_bqVSqeJvD7jfj2Txm9mUqFgj9FQAw==

GET
H2 200 integrator.js Show response
adservice.google.ch/adsid/ 107 B
799 B 42ms
18ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 30ms
15ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 465 B
279 B 675ms
675ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=2521472406743549&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&prev_scp=iid10%3D949364%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C253%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dbillofsale_form_com-box-2-949364%26eb_br%3Df1e225445ec024e41bfd8ce2ba4aa91b%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D1%26acptad%3D1%26br1%3D10000%26br2%3D10000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%252C117%252C120%252C67%252C51%252C116%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D27%2C815%2C817%2C899%2C903%2C919%2C782&cookie_enabled=1&bc=31&abxe=1&lmt=1622671121&dt=1623428292075&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=308&adys=183&adks=3053355510&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90&msz=728x90&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

a51b6c9c02a24f8f7d1f85ed85fe49a07232bcfcc176b85ff1a27469f7736b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:12 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 249
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 65ms
14ms Other
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 475 B
288 B 1071ms
1071ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=2521472406743549&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&prev_scp=iid10%3D925964%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C251%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbillofsale_form_com-medrectangle-1-925964%26eb_br%3Df1e225445ec024e41bfd8ce2ba4aa91b%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D28%26bvm%3D2%26bvr%3D5%26shp%3D3%26acptad%3D1%26br1%3D10000%26br2%3D7000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D85%252C163%252C207%252C4%252C95%252C122%252C92%252C20%252C26%252C209%252C205%252C31%26deal1%3D782&cookie_enabled=1&bc=31&abxe=1&lmt=1622671121&dt=1623428292082&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=482&adys=5025&adks=3853710753&ucis=2&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x266&msz=300x250&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

586929a8b177baed0450109ab7696a56540fca0011ebaffaf63f58138e0b588a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 258
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel;r=989059776;labels=Domain.billofsale_form_com%2CDomainId.26431;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fwww.billofsale-form.com%2F;uht=2;fpan=1;fpa=P0-1421005504-1623428292091;pbcn=u;pbc=;ns=...
pixel.quantserve.com/ 35 B
371 B 12ms
10ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=989059776;labels=Domain.billofsale_form_com%2CDomainId.26431;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fwww.billofsale-form.com%2F;uht=2;fpan=1;fpa=P0-1421005504-1623428292091;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=0;ref=;d=billofsale-form.com;je=0;sr=1600x1200x24;dst=1;et=1623428292091;tzo=-120;ogl=title.Bill%20of%20Sale%20Form%2Ctype.website%2Cdescription.Free%20Bill%20of%20Sale%20Form%20at%20Your%20Fingertips%20%252E%252E%252E%2Curl.https%3A%2F%2Fwww%252Ebillofsale-form%252Ecom%2F%2Csite_name.Bill%20of%20Sale%20Form%2Clocale.en_US%2Ctype.website%2Ctitle.Bill%20of%20Sale%20Form%2Cdescription.Are%20you%20looking%20for%20bill%20of%20sale%20form%20to%20complete%20paper%20work%20of%20your%20sales%20trans%2Curl.https%3A%2F%2Fwww%252Ebillofsale-form%252Ecom%2F%2Csite_name.Bill%20of%20Sale%20Form%2Cimage.https%3A%2F%2Fwww%252Ebillofsale-form%252Ecom%2Fwp-content%2Fuploads%2F2012%2F06%2Ffeature_homepage2%252Ejpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:12 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame D093 35 B
329 B 92ms
27ms Image
image/gif 2.16.186.67
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?&logid=kfk&id=00001623428292107029592307154321&cid=8CU4593V4&crid=637313813&cc=US&bsr=Chrome_89&os=WIN&dt=desktop&dsz=1600x1200&dn=billofsale-form.com&dc=0&adtagid=005585204&ptype=3&visitorId=2658877523071501&bidder_id=99999&biddertagid=99999&evtid=videoevent&evt=20&fallback=11&timenav=2232&last_event=0&cur_ad_iter=0&timediff=2232&purl=https%3A%2F%2Fwww.billofsale-form.com%2F&requrl=http%3A%2F%2Fwww.google.com
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.67 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:12 GMT
Server: Jetty(9.4.35.v20201120)
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Fri, 11 Jun 2021 16:18:12 GMT

GET
H/1.1 200
OK bping.php
qsearch-a.akamaihd.net/ Frame D093 35 B
280 B 93ms
27ms Image
image/gif 2.16.186.67
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/bping.php?&cid=8CU4593V4&crid=637313813&cc=US&ugd=4&vi=1623428292926770770&lf=6&requrl=https%3A%2F%2Fwww.billofsale-form.com%2F&r=1623428292122&hvsid=00001623428292107029592307154321
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.67 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Apache /
Resource Hash: 0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:12 GMT
Server: Apache
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Fri, 11 Jun 2021 16:18:12 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame D093 35 B
329 B 95ms
25ms Image
image/gif 2.16.186.67
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?&logid=kfk&id=00001623428292107029592307154321&cid=8CU4593V4&crid=637313813&cc=US&bsr=Chrome_89&os=WIN&dt=desktop&dsz=1600x1200&dn=billofsale-form.com&dc=0&adtagid=005585204&ptype=3&visitorId=2658877523071501&REASON=39&ACTION=0&evtid=videoerror&bidder_id=99999&biddertagid=99999&timenav=2241&purl=https%3A%2F%2Fwww.billofsale-form.com%2F&requrl=http%3A%2F%2Fwww.google.com
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.67 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:12 GMT
Server: Jetty(9.4.35.v20201120)
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Fri, 11 Jun 2021 16:18:12 GMT

GET
H/1.1 200
OK bfp_ssn.js Show response
pxlclnmdecom-a.akamaihd.net/javascripts/ Frame 8F8E 12 KB
4 KB 19ms
18ms Document
text/html 2.17.123.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/bfp_ssn.js?templateId=3
Requested by: Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU4593V4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.17.123.80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: / Express
Resource Hash: 508a8b73dfefe6e9998cca8a66aef5f7b9b5a8b24b35ae0e6e8a02f37d4a2c93

Request headers

Host: pxlclnmdecom-a.akamaihd.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.billofsale-form.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

Content-Type: text/html; charset=utf-8
X-Powered-By: Express
Vary: Accept-Encoding
Access-Control-Max-Age: 1800
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Cache-Control: max-age=1800
Expires: Fri, 11 Jun 2021 16:48:12 GMT
Date: Fri, 11 Jun 2021 16:18:12 GMT
Content-Length: 3752
Connection: keep-alive

POST
H2 200 ptmdP
dt.clnmde.com/ 7 B
329 B 342ms
117ms Ping
text/html 52.200.32.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://dt.clnmde.com/ptmdP
Requested by: Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU4593V4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.32.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: / Express
Resource Hash: aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 11 Jun 2021 16:18:12 GMT
vary: Accept-Encoding
x-powered-by: Express
etag: W/"7-Jgyp3YpFd/wAt71YECmAdg"
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
content-length: 7

GET
H2 200 cenw.js Show response
dt.clnmde.com/ 36 B
360 B 354ms
124ms XHR
text/html 52.200.32.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://dt.clnmde.com/cenw.js?identifier=bafp
Requested by: Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU4593V4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.32.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: / Express
Resource Hash: 2b258af03c5ea1ab8e9dae28c94b2081036b71bf2949810780ba628607001ff5

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:12 GMT
vary: Accept-Encoding
x-powered-by: Express
etag: W/"24-IXE85aXeh2K0pF7YNO+Zmg"
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
content-length: 36

GET
H2 200 ptmdDual
dt6.clnmde.com/ 70 B
331 B 306ms
94ms Image
image/gif 2600:1f18:42df:3a01:6221:c1c3:43e5:87c9
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt6.clnmde.com/ptmdDual?t=%7B%22gh%22%3A%22162342829215431437896091%22%2C%22za%22%3A1%2C%22gcd%22%3A1623428292167%2C%22al%22%3A3%2C%22bcnd%22%3A1%7D
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:42df:3a01:6221:c1c3:43e5:87c9 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: / Express
Resource Hash: c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 11 Jun 2021 16:18:12 GMT
x-powered-by: Express
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: image/gif

GET
H2 200 cenw.js Show response
dt.clnmde.com/ Frame 8F8E 36 B
360 B 302ms
124ms XHR
text/html 52.200.32.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://dt.clnmde.com/cenw.js
Requested by: Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/bfp_ssn.js?templateId=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.32.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: / Express
Resource Hash: 2a0cdabe2126b0e6f598bd087b4a83333c9d074c21d396bfe83b9f097088f34c

Request headers

Referer: https://pxlclnmdecom-a.akamaihd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:12 GMT
vary: Accept-Encoding
x-powered-by: Express
etag: W/"24-ceQcdPEbmOvzkA7g5wUs8w"
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
content-length: 36

GET
H2 200 nrrV12042.js Show response
contextual.media.net/4a/ Frame 0030 90 KB
29 KB 51ms
51ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/4a/nrrV12042.js

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU4593V4

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

98d453d14213adc82358775170098980cfdeab09e53543d0273924ad13cf77ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: max-age=2592000
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
etag: "8585939e10dc0d11d37aa63cdeaecdf8"
vary: Accept-Encoding
x-mnet-h: 8-11
content-type: text/javascript; charset=utf-8
cache-control: max-age=1209600
date: Fri, 11 Jun 2021 16:18:12 GMT
content-length: 29733
expires: Fri, 25 Jun 2021 16:18:12 GMT

GET
H/1.1 200
OK 10124_505bb4db55aaa1165fa3b242bf39701b.png
res-a.akamaihd.net/__media__/images/800000006/ Frame 0030 4 KB
4 KB 86ms
33ms Image
image/png 2.16.186.43
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://res-a.akamaihd.net/__media__/images/800000006/10124_505bb4db55aaa1165fa3b242bf39701b.png
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.43 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-43.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 16:18:12 GMT
Last-Modified: Tue, 03 Oct 2017 12:52:51 GMT
Server: nginx
ETag: "59d38823-1001"
Content-Type: image/png
Cache-Control: public, max-age=1205740
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4097
Expires: Fri, 25 Jun 2021 15:13:52 GMT

GET
H/1.1 200
OK Oswald_Demibold.woff
res-a.akamaihd.net/__media__/fonts/Oswald_Demibold/ Frame 0030 27 KB
27 KB 99ms
46ms Font
application/font-woff 2.16.186.43
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/Oswald_Demibold/Oswald_Demibold.woff
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.43 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-43.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: d5b724b7fcc373e0d4b583817d46310f7c5d92c59209d183d24f0b27ae119cf8

Request headers

Origin: https://www.billofsale-form.com
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 16:18:12 GMT
Last-Modified: Mon, 16 May 2016 10:39:41 GMT
Server: nginx
ETag: "5739a36d-6b78"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 27512

GET
H2 200 nrrV12042.js Show response
contextual.media.net/4a/ Frame 62AB 90 KB
29 KB 46ms
46ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/4a/nrrV12042.js

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU4593V4

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

98d453d14213adc82358775170098980cfdeab09e53543d0273924ad13cf77ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: max-age=2592000
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
etag: "8585939e10dc0d11d37aa63cdeaecdf8"
vary: Accept-Encoding
x-mnet-h: 8-11
content-type: text/javascript; charset=utf-8
cache-control: max-age=1209600
date: Fri, 11 Jun 2021 16:18:12 GMT
content-length: 29733
expires: Fri, 25 Jun 2021 16:18:12 GMT

GET blank
/ Frame 62AB 0
0

GET
DATA 200
OK truncated
/ Frame 62AB 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 62AB 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK OpenSans_Semibold.woff
res-a.akamaihd.net/__media__/fonts/OpenSans_Semibold/ Frame 0030 21 KB
21 KB 65ms
28ms Font
application/font-woff 2.16.186.43
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/OpenSans_Semibold/OpenSans_Semibold.woff
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.43 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-43.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 2a354649f57a81405daccfd6b5785da5f73ba638f2db591992cb7b739dac3135

Request headers

Origin: https://www.billofsale-form.com
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 16:18:12 GMT
Last-Modified: Mon, 16 May 2016 10:39:41 GMT
Server: nginx
ETag: "5739a36d-54c8"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21704

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 62AB 15 B
216 B 34ms
33ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=0&hvsid=00001623428291957031188903482105&geo=47.37|8.55&dlper=25&lper=100&fp=oaU99tdnOWcz3R0ojHLEWON9KauzDunj2k6NcTTI-nm1kLvPtD1H8_zis98D1J3pCNdzAdeMnpTtJTvQ2aewBezv0dUHV_xgxONXEtd5rgzzGDU6YubX0UawG1YH-T5CgL598qxWef4%3D&lpid=&tsid=112&q=&prv=&type=&ps=&cme=E9kQkaq7ZH6fPbC7Ll8m7KwiaRjYqWJ3-8W6dxXoJ74rF91smTJQ7Z2_kirzXJJmVEoO7gETeGPmOJkDhKBGfGAYoQkfVeWFfHO3_1OS9YmJQrDJvsR2Gwq2v-zfdHEK_KMSN4U4_paAHtiASBH21Bx_rlyOEwS0imkULRYmacHy_6GNJ0ifNQo6ItiC96S-O8O-5PlxXIg%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CYdjFvixrVaF8p8bRV2-VqgKNNqcmZ61nOSKd24xYWWiPBaBzzAZG6w%3D%3D%7CN7fu2vKt8_s%3D%7CZ2B6VmPo4cFZwdGFjZMbnxcdeH8KHNkWPTHs8Bn59uuPdnFfvYfjgmjpyq51PZVp2E1eDRcNStAkZ8sWbzXZSXp-OpwFs_0KpXCpP1JE8ALJkKNian1oS4ZmuLs4YwxZwdHE_BFYxNdzsEumxaPCxrWNBYrbHeVUCX-MTi4INbN92uUHoXRnfm30TXB4C195KtfUYB6Z5z0pu9YTwuBo_YaXvQTpqocvHz6SzRAucd8%3D%7C&hint=&td=&cc=CH&wsip=2886781338&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=0&vgde_kbbh=WoNWNY&vgde_setid=NW&&rc=0&ksu=207&fdkt=232&kwd[]=Printable%20Car%20Bill%20of%20Sale%20Form&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=1&kid[]=329775958&kbc2[]=0%7C%7Cps%3D1.038%7C%7Crpc%3D0.09%7C%7Clvl%3D1.00&ktd[]=274895077632&kwd[]=Free%20Bill%20of%20Sale%20Forms&kwt[]=341&kbc[]=im3650137&kwp[]=2&kid[]=11521341&kbc2[]=free%20bill%7C%7Cps%3D0.813%7C%7Crpc%3D0.12%7C%7Clvl%3D1.00&ktd[]=1126174801723648&kwd[]=RV%20Bill%20of%20Sale&kwt[]=307&kbc[]=31598&kwp[]=3&kid[]=152332466&kbc2[]=0%7C%7Cps%3D0.718%7C%7Crpc%3D0.38%7C%7Clvl%3D1.00&ktd[]=1128373841756416&kwd[]=Printable%20Boat%20Bill%20Of%20Sale&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=4&kid[]=143560913&kbc2[]=0%7C%7Cps%3D1.038%7C%7Crpc%3D0.45%7C%7Clvl%3D1.00&ktd[]=1126174801920256&kwd[]=Free%20General%20Bill%20of%20Sale&kwt[]=201&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=5&kid[]=208325539&kbc2[]=o_r%3D0.33%7C%7Cp_r%3D0.20%7C%7Cl_r%3D138%7C%7Cc%3D-3045%7C%7Crpc%3D0.12%7C%7Clvl%3D1.00&ktd[]=1126174801527296&kwd[]=Printable%20Blank%20Bill%20of%20Sale%20Template&kwt[]=201&kbc[]=&kwp[]=6&kid[]=329967127&kbc2[]=o_r%3D0.39%7C%7Cp_r%3D0.62%7C%7Cl_r%3D46%7C%7Cc%3D1917%7C%7Crpc%3D0.09%7C%7Clvl%3D1.00&ktd[]=274894684672&kwd[]=Boat%20Bill%20of%20Sale%20Template&kwt[]=341&kbc[]=im208276042&kwp[]=7&kid[]=51270623&kbc2[]=sale%20form%7C%7Cps%3D0.838%7C%7Crpc%3D0.11%7C%7Clvl%3D1.00&ktd[]=274894881024&kwd[]=Free%20Vehicle%20Bill%20of%20Sale&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=8&kid[]=11678867&kbc2[]=0%7C%7Co_r%3DNaN%7C%7Cp_r%3D0.15%7C%7Cl_r%3D138%7C%7Cc%3D-4619%7C%7Cps%3D1.038%7C%7Crpc%3D0.13%7C%7Clvl%3D1.00&ktd[]=1126174818697984&kwd[]=Local%20Used%20Cars&kwt[]=267&kbc[]=108325&kwp[]=9&kid[]=17751841&kbc2[]=ps%3D0.594%7C%7Crpc%3D0.08%7C%7Clvl%3D1.00&ktd[]=274911592704&kwd[]=Free%20Blank%20Bill%20of%20Sale&kwt[]=307&kbc[]=33769&kwp[]=10&kid[]=11523120&kbc2[]=0%7C%7Co_r%3D0.00%7C%7Cp_r%3D0.00%7C%7Cl_r%3D42%7C%7Cc%3D-4619%7C%7Cps%3D0.718%7C%7Crpc%3D0.07%7C%7Clvl%3D1.00&ktd[]=1128373841756928&rand=1623428292639&cid=8CU4593V4&vwid=1623428291328015259&vi=1623428291328015259&l3ch=0&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_sc=ZH&vgd_l1rakh=1623428291166932524&vgd_lhl=753&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_ifrmode=00&sttm=1623428291957&upk=1623428292.10881&hvsid=00001623428291957031188903482105&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&vgd_isiolc=1&pid=8POU88YO6&vgd_pgid=p0335872702t202106111618&matm=1623428292645&vgd_ltime=701&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3Dtransparent&tdAdd[]=comp%3DNone&vgd_l3_sc=ZH&vgd_l2ch=0&vgd_l1ch=1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2886781338&vgd_nrrsf=nrr&vgd_nrrv=12042&vgd_nrrs=12042&vgd_nrrmf=4a&vgd_cntrdt=AS%7CDIV-661154765%7CDIV&vgd_x_pos=322&vgd_y_pos=2947&vgd_ren_page_h=5975&vgd_cty=ZURICH&vgd_l1hcsd=A11%7C3853&vgd_sethcsd=A8%7C3839&vgd_cfud=191218&vgd_is_amp=0&vgd_optout=0&vgd_ect=4g&vgd_rensize=620_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_mbr=1&vgd_l1rpth=%2Fdmedianet.js&vgd_pgids=1&requrl=https%3A%2F%2Fwww.billofsale-form.com&oRurl=http%3A%2F%2Fcdng%2Ffcmain.js%3F%26esi%3D1%26%26fvips%3D0%26vpf%3D000%26chost%3Dcontextual.media.net%26cb%3Dwindow._mNDetails.initAd%26%26gdpr%3D0%26cid%3D8CU4593V4%26cpcd%3DpW0W2n1qzJZYY8yxiQBiyA%253D%253D%26crid%3D661154765%26size%3D600x250%26cc%3DCH%26https%3D1%26vif%3D1%26requrl%3Dhttps%253A%252F%252Fwww.billofsale-form.com%252F%26nse%3D5%26vi%3D1623428291328015259%26lw%3D1%26ugd%3D4%26nb%3D1%26blacpfl%3D1%26baeFlag%3D0%26blapd%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A620%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A10&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV12042.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 11 Jun 2021 16:18:12 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 11 Jun 2021 16:18:12 GMT

POST
H2 200 log
navvy.media.net/ Frame 62AB 807 B
980 B 190ms
159ms Ping
image/gif 34.102.149.62
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://navvy.media.net/log
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV12042.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.149.62 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Jetty(9.4.7.v20170914) /
Resource Hash: 0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:12 GMT
via: 1.1 google
server: Jetty(9.4.7.v20170914)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache,no-store
alt-svc: clear
content-length: 807
expires: Fri, 11 Jun 2021 16:18:12 GMT

GET
H2 200 ptmd
dt.clnmde.com/ 70 B
330 B 112ms
112ms Image
image/gif 52.200.32.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.clnmde.com/ptmd?t=162342829215431437896091_N4IgxmAWDWIFwG0QA5kE4AMAWArMryIANCAGykCMFOWA7KTiALokAOAlgCYAu8SGxEAJYgATgFMAZgFVRAG16IQg5iQDOosLIV8Qkbt1ZqApAGYAgsYBMAMWs2A7k4B0AI3Zy5Ae0lqAhnLiALSSXqIAts5gXuH2gvqGJhb29k4Obh7evgHBoRFRMXEiAG5qAPpciggAdgCunkR1niKQpRU8uhhdGBSkVqZYVshWaBRopMgYplSomAP4pBikgt09fQNDI2M4tFMz6FMEVhQYjCJgtWrc7VUoAMLSuGimAGpYgsgPT6-v56LFumAAB0UAdcPhkCC4MCQNwAJ6scRQkFgUTtEFEEHFdjo+Ag3r9QbDUZYNBoHD9Mm0DEg1rlLjIoTdAkbYljCZ7CizQ4LJYggC+-MEMPIVBo9BwUJh8MRjNRuMxIGxuLg+PWRK2piGPQpODQNL0bQZeKZXRZGtG5N20y5B3mx1OAqFImqfj4gzQpNItCspCwRAoAwwyGtaCIOFMXQhkZdfjU8BGJHYfnCfAwImT8bgyCTALgGGcOHU3D83Eu7qIplMlf9piLplIldolZzpjDterA0r9cbpmbplbYcTYxEAC83XAKGwAObwJWCcTVPMgViCaeQOfmzZoY40aZYPvoRajQTcLMgCgeya0LB9HB4QSlOekZwFwbvEgBeDVkCSMDwIIpxAcRuHYeAt2JKxi1nfN1FgOAL3VbcrDKIZUGmWgcAoWhkEYEhxHYVcEK5HBnH6AsKCsUiTkIfDagnIDajA2DgOKOQ+FAV1wnEOd3E4ThxDRLhBE4UsJ1APiBKEzh4CaOQSGVYTiKQtlSXJSk0FoEBBSITiUx4hDJME9oRLE+AJK4KSTLgOSFJxJTEMJbdA21agqLQbT+RENQ5CuTcVJGY4qMEORJHAuzrMc1lNVc3UPJIC4rkiz5Hj1H413-ScAp3b0wxAABHAygMkZirH5IA
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.32.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: / Express
Resource Hash: c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 11 Jun 2021 16:18:12 GMT
x-powered-by: Express
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: image/gif

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 0030 15 B
216 B 36ms
35ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=0&hvsid=00001623428291968031188903484606&geo=47.37|8.55&dlper=25&lper=100&fp=oaU99tdnOWcz3R0ojHLEWON9KauzDunj2k6NcTTI-nm1kLvPtD1H8_zis98D1J3pCNdzAdeMnpSB2uwO1DKySXI-l3wLZhZmqLhudCpTxU565CMGDutV_ZdDyAfH8pY4&lpid=&tsid=1&q=&prv=&type=&ps=&cme=E9j3EOCPAFKcoIIM7kZhIpN4vpyVkxq7MDuCMo8yDENujke2_jqedSHIyKzr-uJJgAsRQl4wvsYM5FrU2zu_JR2a2sW3vYYA58jQeCJnL6fl89LoTTW13proTNNFlxX6m-alRh8MAZ84_JVn_Hiz8ekU5Avv0JZuPGZw7w41M1LDzr4WiweoyBOzXU6ygNn0%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CYdjFvixrVaF8p8bRV2-VqgKNNqcmZ61nOSKd24xYWWiPBaBzzAZG6w%3D%3D%7CN7fu2vKt8_s%3D%7CxcpJgGBch7HkUq26PI94Kuwq2ny4q0pcXbHPamFHWdleY2kxoMAOEB1hiRtyuyciImsoyJp5YPiKEvthBdoLXi7TLv-5x4-NhXKJ4AIwFdayl1XxcILQgkCoymr3h7wrIAlM2PzKKI_5xXR6Sd_JLCaNhZ0uUylROhOnBW-ozGWBjRwG10BXO72ECs0tMeGv3cQmNMy84oGLkZIPAOp50A%3D%3D%7C&hint=&td=&cc=CH&wsip=2886781336&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=0&vgde_kbbh=WoNWNY&vgde_setid=NW&&rc=0&ksu=207&fdkt=232&kwd[]=Print%20Bill%20of%20Sale%20Template&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=1&kid[]=324625082&kbc2[]=0%7C%7Crpc%3D0.11%7C%7Clvl%3D1.00&ktd[]=274911526912&kwd[]=Free%20Boat%20Bill%20of%20Sale&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=2&kid[]=11523951&kbc2[]=0%7C%7Crpc%3D0.13%7C%7Clvl%3D1.00&ktd[]=274894749696&kwd[]=Printable%20Bill%20of%20Sale&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=3&kid[]=23154061&kbc2[]=0%7C%7Crpc%3D0.09%7C%7Clvl%3D1.00&ktd[]=274911526912&kwd[]=Free%20Boat%20Bill%20of%20Sale%20Form&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=4&kid[]=208276042&kbc2[]=0%7C%7Crpc%3D0.14%7C%7Clvl%3D1.00&ktd[]=274894749696&kwd[]=Blank%20Printable%20Bill%20of%20Sale%20Form&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=5&kid[]=301580311&kbc2[]=0%7C%7Crpc%3D0.39%7C%7Clvl%3D1.00&ktd[]=274894749696&rand=1623428292616&cid=8CU4593V4&vwid=1623428291499523997&vi=1623428291499523997&l3ch=0&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_sc=ZH&vgd_l1rakh=1623428291166932524&vgd_lhl=760&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_ifrmode=00&sttm=1623428291968&upk=1623428292.10881&hvsid=00001623428291968031188903484606&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&vgd_isiolc=1&npgv=1&pid=8POU88YO6&vgd_pgid=p0335872702t202106111618&matm=1623428292622&vgd_ltime=719&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3Dtransparent&tdAdd[]=comp%3DNone&vgd_l3_sc=ZH&vgd_l2ch=0&vgd_l1ch=1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2886781336&vgd_nrrsf=nrr&vgd_nrrv=12042&vgd_nrrs=12042&vgd_nrrmf=4a&vgd_cntrdt=AS%7CDIV-889045848%7CDIV&vgd_x_pos=999&vgd_y_pos=391&vgd_ren_page_h=5975&vgd_cty=ZURICH&vgd_l1hcsd=A11%7C3853&vgd_sethcsd=A8%7C3839&vgd_cfud=180403&vgd_is_amp=0&vgd_optout=0&vgd_ect=4g&vgd_rensize=290_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_mbr=1&vgd_l1rpth=%2Fdmedianet.js&vgd_pgids=2&requrl=https%3A%2F%2Fwww.billofsale-form.com&oRurl=http%3A%2F%2Fcdng%2Ffcmain.js%3F%26esi%3D1%26%26fvips%3D0%26vpf%3D000%26chost%3Dcontextual.media.net%26cb%3Dwindow._mNDetails.initAd%26%26gdpr%3D0%26cid%3D8CU4593V4%26cpcd%3DpW0W2n1qzJZYY8yxiQBiyA%253D%253D%26crid%3D889045848%26size%3D300x250%26cc%3DCH%26https%3D1%26vif%3D1%26requrl%3Dhttps%253A%252F%252Fwww.billofsale-form.com%252F%26nse%3D5%26vi%3D1623428291499523997%26lw%3D1%26ugd%3D4%26nb%3D1%26blacpfl%3D1%26baeFlag%3D0%26blapd%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A290%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV12042.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 11 Jun 2021 16:18:12 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 11 Jun 2021 16:18:12 GMT

POST
H2 200 log
navvy.media.net/ Frame 0030 807 B
869 B 161ms
161ms Ping
image/gif 34.102.149.62
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://navvy.media.net/log
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV12042.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.149.62 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Jetty(9.4.7.v20170914) /
Resource Hash: 0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:12 GMT
via: 1.1 google
server: Jetty(9.4.7.v20170914)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache,no-store
alt-svc: clear
content-length: 807
expires: Fri, 11 Jun 2021 16:18:12 GMT

GET
H2 200 greenoaks.gif Show response
www.billofsale-form.com/detroitchicago/ 0
387 B 45ms
45ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9yZXF1ZXN0IiwidmFsIjoiMTI3MyJ9XX1d
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9yZXF1ZXN0IiwidmFsIjoiMTI3MyJ9XX1d
pragma: no-cache
cookie: bfp_sn_rf_8b2087b102c9e3e5ffed1c1478ed8b78=Direct; bfp_sn_rt_8b2087b102c9e3e5ffed1c1478ed8b78=1623428292157; bfp_sn_pl=1623428292|1_288831751785; __qca=P0-1421005504-1623428292091; bafp=9e6d3ea0-cad0-11eb-a9be-772629367fb7; __gads=ID=b8c5807911c55794-22527cbc5dc8007b:T=1623428292:S=ALNI_Ma3ZREIBVLxEMyIs8QF-mUD0mGVdQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:12 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9d76f89f0000dfebe40ab000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=7zvvBgkh5pGO3%2FGgfYq%2Bv0BafvGrvg%2FuLMA0tyxSd%2B5NblpZPGrz%2F6iyCLfn9xz5H3vRgZlqWcoDYKOyFcRir32WCrTnrYQu6cTQVrRlww7eFxYk84pRYm7JQM2F1JD3VJaRpXrCBJpNBSbX7%2BKNgjU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dc276dceabdfeb-FRA
expires: Thu, 10 Jun 2021 16:18:12 UTC

GET
H2 200 dark-bottom.css
www.billofsale-form.com/ezoic/styles/ 3 KB
1 KB 15ms
14ms Stylesheet
text/css 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/ezoic/styles/dark-bottom.css
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/ezoic/cookieconsent.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ac054159a85ddee2e265bc0a517304e773e8c8db653af949bab52dec5e2a1ed9

Request headers

:path: /ezoic/styles/dark-bottom.css
pragma: no-cache
cookie: bfp_sn_rf_8b2087b102c9e3e5ffed1c1478ed8b78=Direct; bfp_sn_rt_8b2087b102c9e3e5ffed1c1478ed8b78=1623428292157; bfp_sn_pl=1623428292|1_288831751785; __qca=P0-1421005504-1623428292091; bafp=9e6d3ea0-cad0-11eb-a9be-772629367fb7; __gads=ID=b8c5807911c55794-22527cbc5dc8007b:T=1623428292:S=ALNI_Ma3ZREIBVLxEMyIs8QF-mUD0mGVdQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 693944
cf-polished: origSize=3031
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9d76f8bf0000dfeb170ef000000001
x-robots-tag: noindex
last-modified: Fri, 28 May 2021 04:19:14 GMT
server: cloudflare
etag: W/"bd7-5c35c2da8d480-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=VSN23vBdFUcStHKxdjReuuvF4Xgvu5VHxj0kEYLrojDl6oOafrIR86nlZjy3gXb9muidzM%2BVfrctxcYKoNQKX%2Bd1oXbr3XqssEAYJLe96Ww0mKBDh71wcgR0xz9gFTzwSGEDbfmWWfqgR2eRBPBms3Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=31536000
cf-ray: 65dc276dff2edfeb-FRA
cf-bgj: minify

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 38ms
18ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021060701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

890b0403f7de1272c790ca332a61e69c6e57127aee8c33b51069a02d5fc8dff2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7903
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 35ms
14ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622653785071769"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Fri, 11 Jun 2021 16:18:12 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/223/ Frame 9FB2 12 KB
5 KB 21ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/223/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Fri, 11 Jun 2021 15:46:19 GMT
expires: Sat, 11 Jun 2022 15:46:19 GMT
last-modified: Wed, 17 Mar 2021 18:24:30 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1913
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A890 783 B
783 B 17ms
16ms Document
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4daaedf2684f7f848abb29ad5a01cf685ad51206a14f73a3039f066897a64cf6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Bz5gZt/0GFAK/+pxIcGF5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

expires: Fri, 11 Jun 2021 16:18:12 GMT
date: Fri, 11 Jun 2021 16:18:12 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-Bz5gZt/0GFAK/+pxIcGF5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 tE64XG1cXAHgdRZqLuUmMLCyOuQ9s7LE_kL_xOEQzyo.js Show response
pagead2.googlesyndication.com/bg/ Frame 9FB2 14 KB
6 KB 20ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/tE64XG1cXAHgdRZqLuUmMLCyOuQ9s7LE_kL_xOEQzyo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b44eb85c6d5c5c01e075166a2ee52630b0b23ae43db3b2c4fe42ffc4e110cf2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 10:47:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19813
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5784
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 11 Jun 2022 10:47:59 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=223&t=2&li=gpt_2021060701&jk=3298302919766932&bg=!ycqlyo7NAAY6sG-_OrA7ACkAdvg8Wg23MJELsDaucElhEF6Q-jnkdWAsib5pW5kcvjfJXqVDdg1rhQIAAABvUgAAAA1oAQeZAnWNmXhxVFEiePtjf1VZy5Mj6kVk7GOa9vrd44_NdOc_RdxSBNNRIv58YSesgwPq78NWMDG7bwRwi3M3aqAylo0aYPZlpRXi8iUS4PNIY8HGn8CCU5ThvEp8AYcCa2xBiu5pq80LmtohSccrMZagRqlueGRUERLNfuszHp7KnMEj3eha94iW5yUAumrhi6LYel2GdZ0WUgq9-HHf9PJFRjyD96wwnBYZZembCW8w70bJUKDCy5U_QfmySxk38Jg2JBICkO3hYTIGHViLP5zOiuRcu_jhRFruw5cbSQAiu08tEo_sZw7QnZAZO_xHL_J_5eYnimx7dWAIbTCp5PhC1gx1VnfqOW_kl_FJdg8tEHKRAGHdUlK09lXASnoNOxIsCbWnMax49HKVEiHG0dgt3hLz0iXBIKeN4m7RZKMRngHdZPg0ejKwnBCVu6hOlKrsuyqaYkp7bFWR6rpT2UfkbWpWMCFFgyV5ZAXhkLAqteR_knSABbLa_p-h6kYvhGytMaVYbAGfYy__t3Na0kMVtpoVlv_9Gmlyxz2rz4DghF-TgjP-4m4ZRyo2B2DgaLyn51XbGou0cYO2WRsGpcXUpC7ffX-vprbMGbchr3B-xD9y2z0a9gafQDjFAjJ6xTQxTYhN8ytTjvZNCkloiJWZhxSuh18d0GialjrWEN2J4mZWaRIG4YBdelAPXqZ5qFxJ_3g2kUqP28d-rlGw5w8eoLG3kGthbUMrvTgI5SK1xMRmn-vKCLuL082MTyLc2mJE1MZasr5CojkI427KSmXgU1Qj7295W7ypbPGJSeDqzp4HTHhnxiao3gnrCDI6fQfDRPXAGVQqJw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bqi.php
lg3.media.net/ 15 B
15 B 31ms
30ms Image
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?lf=3&&vgd_l2type=setting&pid=8POU88YO6&cme=E9j3EOCPAFKcoIIM7kZhIpN4vpyVkxq7MDuCMo8yDENujke2_jqedSHIyKzr-uJJgAsRQl4wvsYM5FrU2zu_JR2a2sW3vYYA58jQeCJnL6fl89LoTTW13proTNNFlxX6m-alRh8MAZ84_JVn_Hiz8ekU5Avv0JZuPGZw7w41M1LDzr4WiweoyBOzXU6ygNn0||NDHRnZ9Gz3KXlI-i9OnZqQ==|5gDUJdTGiJzedmq9hanWYg==|sRBSg3CPSiQ=|YdjFvixrVaF8p8bRV2-VqgKNNqcmZ61nOSKd24xYWWiPBaBzzAZG6w==|N7fu2vKt8_s=|xcpJgGBch7HkUq26PI94Kuwq2ny4q0pcXbHPamFHWdleY2kxoMAOEB1hiRtyuyciImsoyJp5YPiKEvthBdoLXi7TLv-5x4-NhXKJ4AIwFdayl1XxcILQgkCoymr3h7wrIAlM2PzKKI_5xXR6Sd_JLCaNhZ0uUylROhOnBW-ozGWBjRwG10BXO72ECs0tMeGv3cQmNMy84oGLkZIPAOp50A==|&gdpr=0&prid=8PRHGG6T9&cid=8CU4593V4&crid=889045848&requrl=https%3A%2F%2Fwww.billofsale-form.com%2F&vi=1623428291499523997&ugd=4&cc=CH&sc=ZH&startTime=1623428291967&l2type=setting&vgd_l1rakh=1623428291166932524&l1ch=1&sttm=1623428291968&upk=1623428292.10881&hvsid=00001623428291968031188903484606&verid=3121199&vgd_sc=ZH&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&l1hcsd=l1!A11|3853&vgd_uspa=0&vgd_isiolc=1&npgv=1&clp=%7B%7D&cl=%7B%7D&l2ch=0&l2wsip=2886781336&sethcsd=set!A8%7C3839&vgd_pgid=p0335872702t202106111618&vgd_pgids=2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 11 Jun 2021 16:18:13 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 11 Jun 2021 16:18:13 GMT

GET
H2 200 ptmd
dt.clnmde.com/ 70 B
330 B 113ms
112ms Image
image/gif 52.200.32.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.clnmde.com/ptmd?t=162342829215431437896091_N4IgpgHiBcIAwgDQgM4GMD2MQEYBsATAMwAsBAHAQJwED6F55ROA7AKyvltKqYBmMHMnQYALtnzEylGvUZNWHFl1rkARgTjkWanHAJoqYImDZ8+YACY40OEsqvrlPEaIHQhvMZYmFSFajoGBXZONloWE3sSNipKAENLFniwMDQicio2Nnj48jg0Fhi+H2FMUUt3TzAAa3jsIzxLPDY1OABaNESOnBwwNXajEjx2nD48eKI8OFI8NTUeWoWPZDQANxRsYAAdVDAUFABLDAA7WhRRDAAneIBzMF3oXcbm1o6uyx6+gaGRsYmpjNhvNdohdpgMDVDmBaJZ4qJ4o9nmAmi02p1uqNvoMwMNRuNJtNZiCQABfHh1BooywmeLvTG9frteJUNRgdosFgEQhUKYsPhqFgU5aedZbXYofZHU7nS43e5IkAvWn0z5Ypkstkcrk8vkClig8EYSHQ2HwxEwZFNFUYtWMgaa9mc7nUPWC3bk5C3NwwADacEQAYDQjgAF0vaJNtB-YHY0Hw6hI36g3HAwm0qIALbYbJURbxAA2fvT8QADn7cFwAHTEOBVnAENj1rQgBOZgCeft9QiIBAIiCoZEQ1BI5EQzDi4d9-aos8QDcy46oQjwJBwoYTAHcAI7F5Adq57kBoTNoZYgRhUOAxcijnhoK6Z8vR3B+aTUHC9-I4NiNqi0TN4kOM4cB4SR-BkOxZ1-IhZxYACgLOAhW2QQtxGjeNhCwaB+xAQ41hgXCLnhABXKNpyIAd5zHSjKJwKgEwAL3qFYQFLW5sAI5AwBOAjYHLL0AAtfCkAIaB-EhmEk5QqGmZceCTWA7GofIikIbJyB4DZsDwKs6zIEgeELGBKJAPg0BgUZuNEQ5BDfMSiNEDjoADVAahEiDAjkRhmFCZRuG4w5n0rJta3rRtm007iSJYzwSNslzuLWIto1AE54kzMBsDUQ5LEsMArloXKeDhBEYFAHK8oKoqfGgE4SILAtkDWQ4ao899lxIaDiDgslSUQNKMqy2BKvywriuQUqWIq3KxrauqGqakAWvm19RMgr84B-P8+oTFACwudqHIbAKQALKpmta4qlPsjaKC239YnvMjRFW8gAGEAFUYl5AA1QyvQsjxbpHVgqGQbdhs8PgEqIUkgA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.32.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: / Express
Resource Hash: c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 11 Jun 2021 16:18:14 GMT
x-powered-by: Express
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: image/gif

POST
H/1.1 200 457.json Show response
id5-sync.com/g/v2/ 213 B
541 B 76ms
19ms XHR
application/json 51.89.7.199
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/457.json

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.89.7.199 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

d976d08f7f80de76d1851904b20c2e6ebbcf18d15e1e421f3d2763363b619940

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.billofsale-form.com
Date: Fri, 11 Jun 2021 16:18:15 GMT
Access-Control-Allow-Credentials: true
Vary: Origin
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 831C 2 KB
818 B 24ms
23ms Document
text/html 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1623428291858

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: onetag-sys.com
:scheme: https
:path: /usync/?cb=1623428291858
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame D4D0 52 KB
17 KB 77ms
27ms Document
text/html 2.18.232.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.billofsale-form.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Server: nginx/1.13.10
Access-Control-Allow-Origin: *
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Sat, 12 Jun 2021 16:18:17 GMT
Date: Fri, 11 Jun 2021 16:18:15 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 83EA
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://rtb.gumgum.com/usersync?b=mmh&i=c72460c3-8cc7-4300-93f6-1c0f0e160003&gdpr=0&gdpr_consent=

35 B
237 B

40ms
39ms

Document
image/gif

54.194.104.251
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=mmh&i=c72460c3-8cc7-4300-93f6-1c0f0e160003&gdpr=0&gdpr_consent=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

:method: GET
:authority: rtb.gumgum.com
:scheme: https
:path: /usersync?b=mmh&i=c72460c3-8cc7-4300-93f6-1c0f0e160003&gdpr=0&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

date: Fri, 11 Jun 2021 16:18:15 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Date: Fri, 11 Jun 2021 16:17:40 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Server: MT3 3759 5f8f15b master cdg-pixel-x31
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
set-cookie: uuid=c72460c3-8cc7-4300-93f6-1c0f0e160003; domain=.mathtag.com; path=/; expires=Sat, 09-Jul-2022 16:18:15 GMT; SameSite=None; Secure
location: https://rtb.gumgum.com/usersync?b=mmh&i=c72460c3-8cc7-4300-93f6-1c0f0e160003&gdpr=0&gdpr_consent=
Expires: Fri, 11 Jun 2021 16:17:39 GMT

GET
H2 200 visitormatch Show response
bh.contextweb.com/ Frame D5CB 4 KB
5 KB 318ms
105ms Document
text/html 198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bh.contextweb.com/visitormatch

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(9.4.14.v20181114) /

Resource Hash

f3147680701c3bfe6cd9142a9f38cc1415108bd7edaafdba1af2efd664205e28

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

:method: GET
:authority: bh.contextweb.com
:scheme: https
:path: /visitormatch
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: vf=1; V=ENskYmmMP1fy; wf=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cw-server: bh-deployment-8474b759f8-s2cvd
cache-control: private, max-age=0, no-cache, no-store
expires: -1
content-language: en-US
content-type: text/html;charset=iso-8859-1
set-cookie: V=ENskYmmMP1fy;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Mon, 06-Jun-2022 16:18:15 GMT;Max-Age=31104000;SameSite=None pb_rtb_ev=3-17kz|89b.0|88b.0|8ea.0|8fg.0|2JB.0|7Nq.0|7Bj.0|7aw.0|8as.0|7TY.0|7TZ.0|8fr.0|8cn.0|7br.0|7Fn.0|7ND.0|7bs.0|8fP.0|6zB.0|7Xh.0|83u.0|8dQ.0|87G.0|8bO.0|2N.0|7RY.0|7dN.0|4is.0|89W.0|7Rn.0|7I7.0|3oy.0|81B.0;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Sat, 11-Jun-2022 16:18:15 GMT;Max-Age=31536000;SameSite=None INGRESSCOOKIE=521e98b98d276390; path=/; HttpOnly; Secure; SameSite=None
content-length: 3876
server: Jetty(9.4.14.v20181114)
strict-transport-security: max-age=15768000

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame DE89
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=ttd&i=7d454855-aa56-4af8-9c37-3c178db509d6&t=1626020295

35 B
237 B

39ms
39ms

Document
image/gif

54.194.104.251
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=ttd&i=7d454855-aa56-4af8-9c37-3c178db509d6&t=1626020295
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

:method: GET
:authority: rtb.gumgum.com
:scheme: https
:path: /usersync?b=ttd&i=7d454855-aa56-4af8-9c37-3c178db509d6&t=1626020295
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

date: Fri, 11 Jun 2021 16:18:15 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Fri, 11 Jun 2021 16:18:15 GMT
content-type: text/html
content-length: 209
location: https://rtb.gumgum.com/usersync?b=ttd&i=7d454855-aa56-4af8-9c37-3c178db509d6&t=1626020295
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
set-cookie: TDID=7d454855-aa56-4af8-9c37-3c178db509d6; domain=.adsrvr.org; expires=Sat, 11-Jun-2022 16:18:15 GMT; path=/; secure; SameSite=None TDCPM=CAEYBSABKAIyCwjm1vb257_WORAFOAE.; domain=.adsrvr.org; expires=Sat, 11-Jun-2022 16:18:15 GMT; path=/; secure; SameSite=None
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 pixel Show response
cm.g.doubleclick.net/ Frame A60F 170 B
232 B 72ms
28ms Document
image/png 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV9jMzIwM2UyNC05ZGY0LTRkNjQtYmI4ZS1hY2U2NDA2NDA1M2Q=&gdpr=0&gdpr_consent=

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

:method: GET
:authority: cm.g.doubleclick.net
:scheme: https
:path: /pixel?google_nid=gumgum_dbm&google_hm=ZV9jMzIwM2UyNC05ZGY0LTRkNjQtYmI4ZS1hY2U2NDA2NDA1M2Q=&gdpr=0&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

content-type: image/png
date: Fri, 11 Jun 2021 16:18:15 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
server: HTTP server (unknown)
content-length: 170
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame CD52
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=ttd&i=7d454855-aa56-4af8-9c37-3c178db509d6&t=1626020295

35 B
237 B

39ms
39ms

Document
image/gif

54.194.104.251
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=ttd&i=7d454855-aa56-4af8-9c37-3c178db509d6&t=1626020295
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

:method: GET
:authority: rtb.gumgum.com
:scheme: https
:path: /usersync?b=ttd&i=7d454855-aa56-4af8-9c37-3c178db509d6&t=1626020295
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

date: Fri, 11 Jun 2021 16:18:15 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Fri, 11 Jun 2021 16:18:15 GMT
content-type: text/html
content-length: 209
location: https://rtb.gumgum.com/usersync?b=ttd&i=7d454855-aa56-4af8-9c37-3c178db509d6&t=1626020295
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
set-cookie: TDID=7d454855-aa56-4af8-9c37-3c178db509d6; domain=.adsrvr.org; expires=Sat, 11-Jun-2022 16:18:15 GMT; path=/; secure; SameSite=None TDCPM=CAEYBSABKAIyCwjm1vb257_WORAFOAE.; domain=.adsrvr.org; expires=Sat, 11-Jun-2022 16:18:15 GMT; path=/; secure; SameSite=None
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 pixel Show response
cm.g.doubleclick.net/ Frame 098C 170 B
506 B 68ms
27ms Document
image/png 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV9kYjZiNTMwMy0zMDllLTQ4ZDQtYmEyZi03Zjk5MTg2NTQ5NWI=&gdpr=0&gdpr_consent=

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=gumgum,oftmedia,oneVideo,onemobile,onetag,pulsepoint,sharethrough&cb=194-2-22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

:method: GET
:authority: cm.g.doubleclick.net
:scheme: https
:path: /pixel?google_nid=gumgum_dbm&google_hm=ZV9kYjZiNTMwMy0zMDllLTQ4ZDQtYmEyZi03Zjk5MTg2NTQ5NWI=&gdpr=0&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

content-type: image/png
date: Fri, 11 Jun 2021 16:18:15 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
server: HTTP server (unknown)
content-length: 170
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

bounce Show response
ib.adnxs.com/ Frame D4D0
Redirect Chain

https://ib.adnxs.com/async_usersync?cbfn=queuePixels
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

0
825 B

30ms
29ms

Script
text/html

185.33.220.242
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.242 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:15 GMT
X-Proxy-Origin: 185.230.125.108; 185.230.125.108; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.36:80
AN-X-Request-Uuid: 2996d27b-c59e-408c-b3bd-345ef4db72af
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:15 GMT
X-Proxy-Origin: 185.230.125.108; 185.230.125.108; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.223.146:80
AN-X-Request-Uuid: 274aa278-cf9e-42e6-b543-3231b7a25ced
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.ch/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 458 B
281 B 530ms
530ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=2146342627465473&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=3&rcs=1&prev_scp=iid10%3D925964%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C251%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbillofsale_form_com-medrectangle-1-925964%26eb_br%3D49d60519eec4f00cfb2d91dec1e48d41%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D28%26bvm%3D2%26bvr%3D5%26shp%3D3%26acptad%3D1%26br1%3D6000%26br2%3D7000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D85%252C163%252C207%252C4%252C95%252C122%252C92%252C20%252C26%252C209%252C205%252C31%26deal1%3D782%2C26%26lb%3D10000%26reqt%3D1623428295490&eri=1&cookie=ID%3Dfc3ef0ead55cac26-22d4e0945dc800cc%3AT%3D1623428292%3AS%3DALNI_MbTX5NlAJ-rcrYJv_lsgKitdz3HpQ&bc=31&abxe=1&lmt=1622671121&dt=1623428295538&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=482&adys=5307&adks=3853710753&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x266&msz=300x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

27e7b832c635b63fa25125efa6d44dd2f6d89210c5fa8dbab63d2adb828fcd69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 250
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 448 B
269 B 726ms
726ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=3970305391250195&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=3&rcs=1&prev_scp=iid10%3D949364%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C253%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dbillofsale_form_com-box-2-949364%26eb_br%3D116f73d8738ced0c5546d5313109581e%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D1%26acptad%3D1%26br1%3D5000%26br2%3D10000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%252C117%252C120%252C67%252C51%252C116%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D27%2C815%2C817%2C899%2C903%2C919%2C782%2C26%26lb%3D10000%26reqt%3D1623428295493&eri=1&cookie=ID%3Dfc3ef0ead55cac26-22d4e0945dc800cc%3AT%3D1623428292%3AS%3DALNI_MbTX5NlAJ-rcrYJv_lsgKitdz3HpQ&bc=31&abxe=1&lmt=1622671121&dt=1623428295540&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=308&adys=183&adks=3053355510&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90&msz=728x90&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

222be95c7ff40d94b726ac2746b9f466db3b60d26265d13d0c2b72eb9cd78774

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 238
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 current
pulsepoint-match.dotomi.com/match/bounce/ Frame D5CB 0
104 B 100ms
67ms Image
text/plain 2a02:fa8:8806:16::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pulsepoint-match.dotomi.com/match/bounce/current?networkId=14200&version=1&nuid=
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1400 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:15 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H/1.1

200
OK

noop
px.owneriq.net/ Frame D5CB
Redirect Chain

https://px.owneriq.net/eucm/p/cwc
https://px.owneriq.net/ecc?redir=https%3a%2f%2fpx.owneriq.net%2ffr%2fepx.gif&uid=Q6767146951843027934&ref=%2Feucm%2Fp%2Fcwc
https://px.owneriq.net/noop?ct=image%2Fgif

0
287 B

26ms
26ms

Image
image/gif

104.111.242.53
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.owneriq.net/noop?ct=image%2Fgif
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.242.53 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-53.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 16:18:15 GMT
Server: Apache/2.2.15 (CentOS)
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
X-Powered-By: PHP/5.3.3
Content-Length: 0
Content-Type: image/gif

Redirect headers

Location: https://px.owneriq.net/noop?ct=image%2Fgif
Date: Fri, 11 Jun 2021 16:18:15 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame D5CB
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=95&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=95&gdpr=0&gdpr_consent=
https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348&partner_url=https%3A%2F%2Fbh.contextweb.com%2Fbh%2Frtset%3Fdo%3Dadd%26pid...
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348&partner_url=https%3A%2F%2Fbh.contextweb.com%2Fbh%2Frtset%3Fdo%3Dadd...
https://bh.contextweb.com/bh/rtset?do=add&pid=543793&ev=29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348&gdpr_in_effect=0&gdpr_consent=

49 B
943 B

104ms
104ms

Image
image/gif

198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=543793&ev=29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348&gdpr_in_effect=0&gdpr_consent=

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(9.4.14.v20181114) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
content-language: en-US
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
content-type: image/gif;charset=iso-8859-1
cw-server: bh-deployment-8474b759f8-s2cvd
expires: -1

Redirect headers

date: Fri, 11 Jun 2021 16:18:16 GMT
via: 1.1 google
server: Jetty(9.4.36.v20210114)
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location: https://bh.contextweb.com/bh/rtset?do=add&pid=543793&ev=29981141-ba72-4abd-a268-3d3ccb504cb2-60c38cc7-4348&gdpr_in_effect=0&gdpr_consent=
alt-svc: clear
content-length: 0

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame D5CB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=VkdGUFpJXzZRYkJlX3kzZDRVcXJZdw&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEBikDWeK1J9X2oGhOoK5CIw&google_cver=1

49 B
827 B

104ms
103ms

Image
image/gif

198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEBikDWeK1J9X2oGhOoK5CIw&google_cver=1

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(9.4.14.v20181114) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
content-language: en-US
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
content-type: image/gif;charset=iso-8859-1
cw-server: bh-deployment-8474b759f8-s2cvd
expires: -1

Redirect headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:15 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEBikDWeK1J9X2oGhOoK5CIw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 335
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame D5CB
Redirect Chain

https://x.bidswitch.net/sync?ssp=pulsepoint
https://x.bidswitch.net/ul_cb/sync?ssp=pulsepoint
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpulsepoint
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpulsepoint
https://x.bidswitch.net/sync?dsp_id=59&user_id=eb83183d-15e2-4b6b-b852-5ecf7072987f&ssp=pulsepoint
https://bh.contextweb.com/bh/rtset?do=add&pid=556010&ev=a850428e-92c9-430b-8963-e14fb9ef1300

49 B
892 B

105ms
104ms

Image
image/gif

198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=556010&ev=a850428e-92c9-430b-8963-e14fb9ef1300

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(9.4.14.v20181114) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
content-language: en-US
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
content-type: image/gif;charset=iso-8859-1
cw-server: bh-deployment-8474b759f8-s2cvd
expires: -1

Redirect headers

location: //bh.contextweb.com/bh/rtset?do=add&pid=556010&ev=a850428e-92c9-430b-8963-e14fb9ef1300
date: Fri, 11 Jun 2021 16:18:16 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55972/ Frame D5CB
Redirect Chain

https://pixel.advertising.com/ups/55972/sync?uid=ENskYmmMP1fy&_origin=1&gdpr=0&gdpr_consent=
https://pixel.advertising.com/ups/55972/sync?uid=ENskYmmMP1fy&_origin=1&gdpr=0&gdpr_consent=&verify=true
https://ups.analytics.yahoo.com/ups/55972/sync?uid=ENskYmmMP1fy&_origin=1&gdpr=0&gdpr_consent=&apid=UPa0611f6a-cad0-11eb-91b9-06d326095278
https://ups.analytics.yahoo.com/ups/55972/sync?uid=ENskYmmMP1fy&_origin=1&gdpr=0&gdpr_consent=&apid=UPa0611f6a-cad0-11eb-91b9-06d326095278&verify=true

0
1 KB

22ms
22ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55972/sync?uid=ENskYmmMP1fy&_origin=1&gdpr=0&gdpr_consent=&apid=UPa0611f6a-cad0-11eb-91b9-06d326095278&verify=true

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.128 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 16:18:15 GMT
Server: ATS/7.1.2.128
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

Date: Fri, 11 Jun 2021 16:18:15 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://ups.analytics.yahoo.com/ups/55972/sync?uid=ENskYmmMP1fy&_origin=1&gdpr=0&gdpr_consent=&apid=UPa0611f6a-cad0-11eb-91b9-06d326095278&verify=true
Connection: keep-alive
Content-Length: 0

GET
H2

200

xuid
eb2.3lift.com/ Frame D5CB
Redirect Chain

https://eb2.3lift.com/xuid?mid=2636&xuid=ENskYmmMP1fy&dongle=8bee
https://eb2.3lift.com/xuid?ld=1&mid=2636&xuid=ENskYmmMP1fy&dongle=8bee&gdpr=1&cmp_cs=&us_privacy=

37 B
352 B

20ms
20ms

Image
image/gif

18.159.175.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=2636&xuid=ENskYmmMP1fy&dongle=8bee&gdpr=1&cmp_cs=&us_privacy=
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.159.175.104 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=2636&xuid=ENskYmmMP1fy&dongle=8bee&gdpr=1&cmp_cs=&us_privacy=
date: Fri, 11 Jun 2021 16:18:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 v1
match.sharethrough.com/sync/ Frame D5CB 68 B
262 B 72ms
17ms Image
image/png 35.158.176.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=790d3e0174b12a86f1cbebf4&source_user_id=ENskYmmMP1fy
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.176.66 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:15 GMT
content-length: 68
content-type: image/png

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame D5CB
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pp
https://match.prod.bidr.io/cookie-sync/pp?_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCSE8wN0JoeG9BQURIZzBlQlozUQ&bee_sync_partners=pm%2Csas%2Cpp&bee_sync_current_partner=adx&bee_sync_initiator=pp&bee_sy...
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp&bee_sync_current_partner=adx&bee_sync_initiator=pp&bee_sync_hop_count=1
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABHO07BhxoAADHg0eBZ3Q&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3...
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABHO07BhxoAADHg0eBZ3Q&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%26bee_sync_current_part...
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pp&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=4221625219172282953
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AABHO07BhxoAADHg0eBZ3Q

49 B
966 B

104ms
104ms

Image
image/gif

198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AABHO07BhxoAADHg0eBZ3Q

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(9.4.14.v20181114) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
content-language: en-US
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
content-type: image/gif;charset=iso-8859-1
cw-server: bh-deployment-8474b759f8-s2cvd
expires: -1

Redirect headers

location: https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AABHO07BhxoAADHg0eBZ3Q
Date: Fri, 11 Jun 2021 16:18:16 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame D5CB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_cm&google_hm=ENskYmmMP1fy
https://bh.contextweb.com/bh/rtset?pid=559960&ev=1&google_gid=CAESEJOk3zuzJulhXWyoU8wlw50&google_cver=1

49 B
855 B

104ms
104ms

Image
image/gif

198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?pid=559960&ev=1&google_gid=CAESEJOk3zuzJulhXWyoU8wlw50&google_cver=1

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(9.4.14.v20181114) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
content-language: en-US
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
content-type: image/gif;charset=iso-8859-1
cw-server: bh-deployment-8474b759f8-s2cvd
expires: -1

Redirect headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:15 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://bh.contextweb.com/bh/rtset?pid=559960&ev=1&google_gid=CAESEJOk3zuzJulhXWyoU8wlw50&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 312
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame D5CB
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=8185&uid=ENskYmmMP1fy
https://sync.search.spotxchange.com/partner?adv_id=8185&uid=ENskYmmMP1fy&__user_check__=1&sync_id=a0688386-cad0-11eb-a3af-1a7cb9e30406

43 B
548 B

29ms
29ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=8185&uid=ENskYmmMP1fy&__user_check__=1&sync_id=a0688386-cad0-11eb-a3af-1a7cb9e30406
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.180.125 , United States, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 16:18:15 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 36
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Fri, 11 Jun 2021 16:18:15 GMT
Server: nginx
Location: /partner?adv_id=8185&uid=ENskYmmMP1fy&__user_check__=1&sync_id=a0688386-cad0-11eb-a3af-1a7cb9e30406
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 22
Connection: keep-alive
Content-Length: 0

GET
H2 200 /
trc.taboola.com/sg/rtb-pulsepoint-network/1/rtb-h/ Frame D5CB 0
288 B 128ms
79ms Image
text/plain 199.232.137.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/rtb-pulsepoint-network/1/rtb-h/?taboola_hm=ENskYmmMP1fy
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-vcl-time-ms: 60
date: Fri, 11 Jun 2021 16:18:15 GMT
via: 1.1 varnish
server: nginx
x-timer: S1623428296.770481,VS0,VE60
x-cache: MISS
x-cache-hits: 0
accept-ranges: bytes
content-length: 0
x-served-by: cache-hhn11579-HHN

GET
H2 200 sync
partners.tremorhub.com/ Frame D5CB 43 B
183 B 283ms
93ms Image
image/gif 2600:1f18:612b:4216:b3d7:e742:13a8:bd05
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?uipp=ENskYmmMP1fy
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4216:b3d7:e742:13a8:bd05 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:16 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

GET
H2 200 UserMatch.ashx
atemda.com/ Frame D5CB 43 B
1020 B 190ms
116ms Image
image/gif 35.190.113.31
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://atemda.com/UserMatch.ashx?bidderid=97&bidderuid=ENskYmmMP1fy
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.113.31 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:15 GMT
via: 1.1 google
access-control-allow-headers: Content-Type
access-control-allow-methods: GET
p3p: CP="NOI DSP NID BUS UNI COM NAV INT STA OTC CURa ADMa DEVa PSAa PSDa OUR"
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Fri, 11 Jun 2021 16:18:15 GMT

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame D5CB
Redirect Chain

https://red.erne.co/pulsepoint/cm
https://pixel.onaudience.com/?mapped=DIcx2l6I8YUfhqr8nIXhW9ay&partner=2&redirect=red.erne.co%2Fct%2Fcm%3Fred%3Dhttps%253A%252F%252Fbh.contextweb.com%252Fbh%252Frtset%253Fdo%253Dadd%2526pid%253D5609...
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26redirect%3Dhttps%253A%252F%252Fred.erne.co%252Fct%2...
https://sync.crwdcntrl.net/map/ct=y/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26redirect%3Dhttps%253A%252F%252Fred.erne.co%252...
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=4fa8b3393d3ebb096a1ab0adbd6cec9d&redirect=https%3A%2F%2Fred.erne.co%2Fct%2Fcm%3Fred%3Dhttps%253A%252F%252Fbh.contextweb.com%252Fbh%252Frtse...
https://red.erne.co/ct/cm?red=https%3A%2F%2Fbh.contextweb.com%2Fbh%2Frtset%3Fdo%3Dadd%26pid%3D560956%26ev%3DDIcx2l6I8YUfhqr8nIXhW9ay
https://bh.contextweb.com/bh/rtset?do=add&pid=560956&ev=DIcx2l6I8YUfhqr8nIXhW9ay

49 B
991 B

104ms
103ms

Image
image/gif

198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=560956&ev=DIcx2l6I8YUfhqr8nIXhW9ay

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(9.4.14.v20181114) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
content-language: en-US
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
content-type: image/gif;charset=iso-8859-1
cw-server: bh-deployment-8474b759f8-s2cvd
expires: -1

Redirect headers

location: https://bh.contextweb.com/bh/rtset?do=add&pid=560956&ev=DIcx2l6I8YUfhqr8nIXhW9ay
date: Fri, 11 Jun 2021 16:18:16 GMT
server: openresty
strict-transport-security: max-age=0; includeSubDomains;
content-type: text/html; charset=UTF-8

GET
H2 200 um
sync.teads.tv/ Frame D5CB 23 B
286 B 120ms
52ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=84&uid=ENskYmmMP1fy
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:15 GMT
cache-control: max-age=0, no-cache, no-store
expires: Fri, 11 Jun 2021 16:18:15 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame D5CB 43 B
344 B 341ms
114ms Image
image/gif 54.239.17.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/ecm3?id=ENskYmmMP1fy&ex=Pulsepoint
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.239.17.112 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:16 GMT
Server: Server
Vary: User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 sync
ads.yieldmo.com/v000/ Frame D5CB 43 B
430 B 134ms
40ms Image
image/gif 54.171.104.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?userid=ENskYmmMP1fy&pn_id=pp
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.104.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Fri, 11 Jun 2021 16:18:16 GMT
content-type: image/gif
content-length: 43
access-control-allow-methods: GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame D5CB 42 B
734 B 79ms
20ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=390200&nid=5120&put=ENskYmmMP1fy
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Content-Type: image/gif

GET
H/1.1

200
OK

rum
dsum.casalemedia.com/ Frame D5CB
Redirect Chain

https://dsum.casalemedia.com/rum?cm_dsp_id=189&external_user_id=ENskYmmMP1fy&expiration=[EXPIRATION]
https://dsum.casalemedia.com/rum?cm_dsp_id=189&external_user_id=ENskYmmMP1fy&expiration=[EXPIRATION]&C=1

43 B
999 B

34ms
34ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=189&external_user_id=ENskYmmMP1fy&expiration=[EXPIRATION]&C=1
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 11 Jun 2021 16:18:16 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:16 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum.casalemedia.com/rum?cm_dsp_id=189&external_user_id=ENskYmmMP1fy&expiration=[EXPIRATION]&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 300
Expires: Fri, 11 Jun 2021 16:18:16 GMT

GET
H2 200 user.sync
match.sync.ad.cpe.dotomi.com/w/ Frame D5CB 43 B
156 B 40ms
12ms Image
image/gif 2a02:fa8:8806:12::1460
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=9&userid=ENskYmmMP1fy
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a02:fa8:8806:12::1460 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:16 GMT
cache-control: no-cache
server: nginx
content-type: image/gif
content-length: 43
expires: 0

GET
H/1.1 200
OK pp.gif
sync.colossusssp.com/ Frame D5CB 42 B
648 B 331ms
117ms Image
image/gif 88.214.193.99
NATCOWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.colossusssp.com/pp.gif?puid=ENskYmmMP1fy

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.214.193.99 , United Kingdom, ASN46636 (NATCOWEB, US),

Reverse DNS

Software

nginx /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:16 GMT
Server: nginx
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: image/gif
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
Connection: keep-alive
Expires: 0

GET
H2 204 /
trc.taboola.com/sg/pulsepointrtb-network/1/rtb-h/ Frame D5CB 0
202 B 78ms
77ms Image
text/plain 199.232.137.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=ENskYmmMP1fy
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-vcl-time-ms: 58
date: Fri, 11 Jun 2021 16:18:16 GMT
via: 1.1 varnish
server: nginx
x-timer: S1623428296.042998,VS0,VE58
x-cache: MISS
x-cache-hits: 0
accept-ranges: bytes
x-served-by: cache-hhn11579-HHN

GET
H2

200

TRRT
c.deployads.com/cs/ Frame D5CB
Redirect Chain

https://demand.trafficroots.com/sync.php?buyer=2228&buyeruid=https://demand.trafficroots.com/sync.php?buyer=2228&buyeruid=ENskYmmMP1fy
https://c.deployads.com/cs/TRRT?b=ENskYmmMP1fy

43 B
285 B

128ms
40ms

Image
image/gif

52.30.95.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.deployads.com/cs/TRRT?b=ENskYmmMP1fy
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.95.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: SortableCactus/1.0 /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:16 GMT
cache-control: no-cache
server: SortableCactus/1.0
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://c.deployads.com/cs/TRRT?b=ENskYmmMP1fy
Date: Fri, 11 Jun 2021 16:18:16 GMT
Server: nginx/1.10.3
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

55660
i6.liadm.com/s/ Frame D5CB
Redirect Chain

https://i.liadm.com/s/55660?bidder_id=98251&bidder_uuid=ENskYmmMP1fy
https://i.liadm.com/s/55660?bidder_id=98251&bidder_uuid=ENskYmmMP1fy&_li_chk=true&previous_uuid=b7692ee81eae4819ae5b2d7dfe4200b3
https://i6.liadm.com/s/55660?bidder_id=98251&bidder_uuid=ENskYmmMP1fy

43 B
447 B

295ms
98ms

Image
image/gif

2600:1f18:444a:4602:c18d:4a5:dcb1:ed3e
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/55660?bidder_id=98251&bidder_uuid=ENskYmmMP1fy

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:444a:4602:c18d:4a5:dcb1:ed3e Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 16:18:16 GMT
Cache-Control: no-store
Connection: keep-alive
trace-id: 76e175f5dbc5b363
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/55660?bidder_id=98251&bidder_uuid=ENskYmmMP1fy
Date: Fri, 11 Jun 2021 16:18:16 GMT
Connection: keep-alive
trace-id: 317dd3a721852b07
Content-Length: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H2 200 sync
x.bidswitch.net/ Frame D5CB 43 B
145 B 23ms
23ms Image
image/gif 35.156.158.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=400&user_id=ENskYmmMP1fy&expires=30&user_group=[NUMERICAL_VALUE]
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.156.158.150 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:16 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H2 200 dspreply
public-prod-dspcookiematching.dmxleo.com/ Frame D5CB 0
176 B 64ms
27ms Image
text/plain 34.120.25.144
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://public-prod-dspcookiematching.dmxleo.com/dspreply?dspId=1003&dspUserId=ENskYmmMP1fy
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.25.144 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:16 GMT
via: 1.1 google
alt-svc: clear
content-length: 0

GET
H2 200 bid
cs.chocolateplatform.com/ Frame D5CB 0
85 B 356ms
118ms Image
text/plain 35.212.101.174
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.chocolateplatform.com/bid?advid=5771&bcid=ENskYmmMP1fy
Requested by: Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.101.174 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: CookieSync Powered by Vdopia /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:15 GMT
via: 1.1 google
server: CookieSync Powered by Vdopia
alt-svc: clear
content-length: 0

GET
H/1.1 200
OK setuid
ib.adnxs.com/ Frame D5CB 43 B
1006 B 30ms
30ms Image
image/gif 185.33.220.242
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=494&code=ENskYmmMP1fy

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.242 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:16 GMT
X-Proxy-Origin: 185.230.125.108; 185.230.125.108; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.44:80
AN-X-Request-Uuid: 922c3ace-04cc-4cce-8a26-e6b3450d42e4
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ptmd
dt.clnmde.com/ 70 B
330 B 113ms
112ms Image
image/gif 52.200.32.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.clnmde.com/ptmd?t=162342829215431437896091_N4IgHgZiBcIAwDYIEYDGAmAnAEwEbowHYBWADnQFNcBmXUuAFhXWIWvULhABpwIAXGCFLUKCCpky4IDOLkIME6ahFTViyFdjipimOOmw8QASwBuMBrwDO-AIb8ArtZgBtanG7JMAXV4AvOxhkXgAHAHMhC14KADsLWFDjcIALIWQlagZ0ckx0ZGIGamQiwlJMBDhMZGN+F1gSrHoFJWIyYzN6kAQAOjge7IZjOwAbGGpeVRgAWhCQCn4TYMzs3PQbfkjoTxBrAGt0lZysdAB9HNIRZBJr0mJjChMkhrue5X7kFh7kOFIHxyC0DmjiW2xiZjG0FcoFidgAthQhLgTNhsBQAE6nFHGbAOQGgZGojFYozQWKOEYjXhmEwkw7KVZYEqSYjKSSEEAAX053Bh8MRsEJaMx2N4uPsMAJKOFdLJFKpIBpspAGQZx2q7HoBRYmC5nL8uxGtnpWXV+RYxhGUCB1Np2IaR1ymhycG1emMqGc-GVpAAwgBVBh6agANSGvHCqGWatySnQOwAjgK5hBQQxOUA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.32.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: / Express
Resource Hash: c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 11 Jun 2021 16:18:16 GMT
x-powered-by: Express
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: image/gif

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame D4D0 0
754 B 33ms
33ms Script
text/html 185.33.220.242
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.242 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:16 GMT
X-Proxy-Origin: 185.230.125.108; 185.230.125.108; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.138:80
AN-X-Request-Uuid: e1c512c6-989c-4fe1-af09-e14f4756e6cc
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.ch/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 475 B
795 B 629ms
626ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=783545729943881&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=2&prev_scp=iid10%3D925964%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C251%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbillofsale_form_com-medrectangle-1-925964%26eb_br%3De9b52ed700c176b9b3f036aa176f3f3e%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D28%26bvm%3D2%26bvr%3D5%26shp%3D3%26acptad%3D1%26br1%3D4200%26br2%3D7000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D85%252C163%252C207%252C4%252C95%252C122%252C92%252C20%252C26%252C209%252C205%252C31%26deal1%3D782%2C26%2C25%2C26%26lb%3D6000%26reqt%3D1623428296170&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1622671121&dt=1623428297174&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=482&adys=5307&adks=3853710753&ucis=5&ifi=5&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x266&msz=300x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

f54b54661acbf5912bc4bbfd9b3c52101f51a670d08053652eb4f7cbd69023f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.ch/adsid/ 107 B
122 B 31ms
17ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 465 B
427 B 483ms
483ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=1915403164862739&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=2&rcs=2&prev_scp=iid10%3D949364%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C253%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dbillofsale_form_com-box-2-949364%26eb_br%3D81f896ad12450b2f0257b1df6d3f1edc%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D1%26acptad%3D1%26br1%3D3600%26br2%3D10000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%252C117%252C120%252C67%252C51%252C116%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D27%2C815%2C817%2C899%2C903%2C919%2C782%2C26%2C24%2C25%2C26%26lb%3D5000%26reqt%3D1623428296335&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1622671121&dt=1623428297343&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=308&adys=183&adks=3053355510&ucis=6&ifi=6&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90&msz=728x90&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

a73ecc47860fb648aa30a59b9f2673e63e49498fae4a2ec2223a19a15e012a58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 250
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
374 B 32ms
31ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTI1OTY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLW1lZHJlY3RhbmdsZS0xLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMTAzNSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMjYifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTI1OTY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLW1lZHJlY3RhbmdsZS0xLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMTAzNSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMjYifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:17 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9d770c4c0000dfeb2a103000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Wm0fqshLnsywa4UxShtves4CasInzRSDVNDMC2Go%2FjP8vP0QTSU3YS2xn1VNwWJr4H6LiEAOOUw6zvIHZrCcC9nBTDig0fRR%2FQtL5UIEncqsjb%2Bw7X1phmM3zvmd4lVTVsGMnTxspzG3j82Ht7pJVm8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dc278d4d04dfeb-FRA
expires: Thu, 10 Jun 2021 16:18:17 UTC

GET
H2 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
297 B 43ms
42ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTI1OTY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLW1lZHJlY3RhbmdsZS0xLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI0ODIifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjUzMDcifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5NDkzNjQiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MjgyOTAsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjU4NDIzODRjLTk0YmMtNGIxZS01Y2VkLWQzODkyODhiOWE2MyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjMwOCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMTgzIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTI1OTY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLW1lZHJlY3RhbmdsZS0xLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI0ODIifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjUzMDcifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5NDkzNjQiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MjgyOTAsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjU4NDIzODRjLTk0YmMtNGIxZS01Y2VkLWQzODkyODhiOWE2MyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjMwOCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMTgzIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:17 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9d770c4d0000dfebe3afa000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=jBqC%2F%2B8MUyMYY0Qr9enzDWKaBiaAz69g2fWMXo7dOOjCBuyRg2hGFdrlE6qUhJkmtbTqLv%2FrcXiARCCWjCMGOPilGVAQF2ysxFKbszOWvtLyrXpvkdo9widMJlvFGC9uDCuvf7ulKPQFjrytSD%2BZ3Zo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dc278d4d06dfeb-FRA
expires: Thu, 10 Jun 2021 16:18:17 UTC

GET
H3-29 200 integrator.js Show response
adservice.google.ch/adsid/ 107 B
122 B 17ms
16ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 458 B
265 B 533ms
533ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=1642763240823648&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=3&prev_scp=iid10%3D925964%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C251%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbillofsale_form_com-medrectangle-1-925964%26eb_br%3D2c0082dd1efc5e4dfdd4f50677fea822%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D28%26bvm%3D2%26bvr%3D5%26shp%3D3%26acptad%3D1%26br1%3D3400%26br2%3D7000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D85%252C163%252C207%252C4%252C95%252C122%252C92%252C20%252C26%252C209%252C205%252C31%26deal1%3D782%2C26%2C25%2C26%2C24%2C25%2C26%26lb%3D4200%26reqt%3D1623428297808&eri=1&cookie=ID%3D173e7c5b0436e60c-224ddc505dc800c5%3AT%3D1623428297%3AS%3DALNI_MZC5Yi_yu3qVpv_AomCbFYDiZHq5w&bc=31&abxe=1&lmt=1622671121&dt=1623428297813&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=482&adys=5307&adks=3853710753&ucis=7&ifi=7&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x266&msz=300x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=4&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

7a516874d943ea432dd6503893eaac720d725da5e966910e2bb36456149237f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 454 B
275 B 965ms
965ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=2156322740908553&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=1&rcs=3&prev_scp=iid10%3D949364%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C253%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dbillofsale_form_com-box-2-949364%26eb_br%3Da835e008e248a793da87524a4919f755%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D1%26acptad%3D1%26br1%3D2300%26br2%3D10000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%252C117%252C120%252C67%252C51%252C116%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D27%2C815%2C817%2C899%2C903%2C919%2C782%2C26%2C24%2C25%2C26%2C22%2C23%2C24%2C25%2C26%26lb%3D3600%26reqt%3D1623428297846&eri=1&cookie=ID%3Dc4c823f0ff2239a2-22b088725dc80083%3AT%3D1623428297%3AS%3DALNI_MZviCkNzYkwaXuNavfCkBXleosrkw&bc=31&abxe=1&lmt=1622671121&dt=1623428297848&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=308&adys=183&adks=3053355510&ucis=8&ifi=8&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90&msz=728x90&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

c7ef45a5279928065811180beb6addf5f3dc68c44d4183c4e5aa8cc348f0f3eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 244
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 greenoaks.gif Show response
www.billofsale-form.com/detroitchicago/ 0
675 B 53ms
52ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJuYXZpZ2F0aW9uX3R5cGUiLCJ2YWwiOiIwIn0seyJuYW1lIjoicmVkaXJlY3RfY291bnQiLCJ2YWwiOiIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJkYXRhIjpbeyJuYW1lIjoicGVyZl9pc190cmFja2VkIiwidmFsIjoiMSJ9LHsibmFtZSI6InBlcmZfbmF2X3RvX2Nvbm5lY3QiLCJ2YWwiOiI4MTUifSx7Im5hbWUiOiJwZXJmX2Nvbm5lY3RfdG9fcmVzcF9zdGFydCIsInZhbCI6IjE2MDMifSx7Im5hbWUiOiJwZXJmX3Jlc3BfdGltZSIsInZhbCI6IjgifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiMjg2In0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiMzE5In0seyJuYW1lIjoicGVyZl9jb21wbGV0ZSIsInZhbCI6IjEzMDMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9wYWludCIsInZhbCI6IjE3NDIifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9jb250ZW50ZnVsX3BhaW50IiwidmFsIjoiMTc0MiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjU4NDIzODRjLTk0YmMtNGIxZS01Y2VkLWQzODkyODhiOWE2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidF9lcG9jaCI6MTYyMzQyODI5MCwiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fZWZmZWN0aXZlX3R5cGUiLCJ2YWwiOiI0ZyJ9XX1d
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJuYXZpZ2F0aW9uX3R5cGUiLCJ2YWwiOiIwIn0seyJuYW1lIjoicmVkaXJlY3RfY291bnQiLCJ2YWwiOiIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJkYXRhIjpbeyJuYW1lIjoicGVyZl9pc190cmFja2VkIiwidmFsIjoiMSJ9LHsibmFtZSI6InBlcmZfbmF2X3RvX2Nvbm5lY3QiLCJ2YWwiOiI4MTUifSx7Im5hbWUiOiJwZXJmX2Nvbm5lY3RfdG9fcmVzcF9zdGFydCIsInZhbCI6IjE2MDMifSx7Im5hbWUiOiJwZXJmX3Jlc3BfdGltZSIsInZhbCI6IjgifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiMjg2In0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiMzE5In0seyJuYW1lIjoicGVyZl9jb21wbGV0ZSIsInZhbCI6IjEzMDMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9wYWludCIsInZhbCI6IjE3NDIifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9jb250ZW50ZnVsX3BhaW50IiwidmFsIjoiMTc0MiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjU4NDIzODRjLTk0YmMtNGIxZS01Y2VkLWQzODkyODhiOWE2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidF9lcG9jaCI6MTYyMzQyODI5MCwiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fZWZmZWN0aXZlX3R5cGUiLCJ2YWwiOiI0ZyJ9XX1d
pragma: no-cache
cookie: __gads=ID=c4c823f0ff2239a2:T=1623428297:S=ALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:19 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9d77124a000097d21307a000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=CszM0WoLIE34yeuqQKjHAtWkm3sBVo37gEJXqsLTfojn%2F744TlJ%2FlGr9S7rAw1ZDhlO9xYtZFi6rJjfgFXagCymocYffa4m8lP5x7QGGy%2BliYrrV%2FCtdY7y%2F2etWwsx7%2F8CD%2F%2BmHqo1EEboUec248q8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dc2796dca797d2-FRA
expires: Thu, 10 Jun 2021 16:18:19 UTC

GET
H3-29 200 greenoaks.gif Show response
www.billofsale-form.com/detroitchicago/ 0
675 B 37ms
36ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX2Rvd25saW5rIiwidmFsIjoiOS42In1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9ydHQiLCJ2YWwiOiIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjEzODAyMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIyIn0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19weCIsInZhbCI6IjM2ODAyMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX2NvdW50IiwidmFsIjoiNCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJ2aWV3cG9ydF9zaXplIiwidmFsIjoiMTYwMHgxMjAwIn0seyJuYW1lIjoidmlld3BvcnRfcHgiLCJ2YWwiOiIxOTIwMDAwIn0seyJuYW1lIjoiZG9jX3B4IiwidmFsIjoiOTU2MDAwMCJ9LHsibmFtZSI6ImRvY19oZWlnaHQiLCJ2YWwiOiI1OTc1In1dfV0=
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX2Rvd25saW5rIiwidmFsIjoiOS42In1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9ydHQiLCJ2YWwiOiIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjEzODAyMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIyIn0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19weCIsInZhbCI6IjM2ODAyMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX2NvdW50IiwidmFsIjoiNCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJ2aWV3cG9ydF9zaXplIiwidmFsIjoiMTYwMHgxMjAwIn0seyJuYW1lIjoidmlld3BvcnRfcHgiLCJ2YWwiOiIxOTIwMDAwIn0seyJuYW1lIjoiZG9jX3B4IiwidmFsIjoiOTU2MDAwMCJ9LHsibmFtZSI6ImRvY19oZWlnaHQiLCJ2YWwiOiI1OTc1In1dfV0=
pragma: no-cache
cookie: __gads=ID=c4c823f0ff2239a2:T=1623428297:S=ALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:19 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9d77124a000097d22320a000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=TFHIrnl464nq%2FJm3Syf8EYbzumRtonxr3OpAWsSa%2BJDH4aT6Yc8rYI4GkPvxDeW80uJv%2F0IEzcPmEktpdyLjJTyqlokkreIomO4s9xOZ3QQQOk9%2Bxyi14pFR3Y1Yf%2F%2BEGlTRXijMJfuUYiYDzgghQ%2Bo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dc2796dca897d2-FRA
expires: Thu, 10 Jun 2021 16:18:19 UTC

GET
H3-29 200 integrator.js Show response
adservice.google.ch/adsid/ 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 17ms
16ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 356 B
185 B 495ms
495ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=4402671688776924&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=4&prev_scp=iid10%3D925964%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C251%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbillofsale_form_com-medrectangle-1-925964%26eb_br%3D92831edb305b955e915a7cc2288d5df6%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D28%26bvm%3D2%26bvr%3D5%26shp%3D3%26acptad%3D1%26br1%3D3000%26br2%3D7000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D85%252C163%252C207%252C4%252C95%252C122%252C92%252C20%252C26%252C209%252C205%252C31%26deal1%3D782%2C26%2C25%2C26%2C24%2C25%2C26%2C24%2C25%2C26%26lb%3D3400%26reqt%3D1623428298351&eri=1&cookie=ID%3Dc4c823f0ff2239a2%3AT%3D1623428297%3AS%3DALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw&bc=31&abxe=1&lmt=1622671121&dt=1623428299355&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=482&adys=5307&adks=3853710753&ucis=9&ifi=9&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x266&msz=300x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=5&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

ae4de0f52961d7e5fd8fb8aa6df78cb9403d3a924ac9419a81f1f27a639277e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:19 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 156
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.ch/adsid/ 107 B
122 B 18ms
17ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 17ms
16ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 346 B
177 B 488ms
487ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=1932924689307800&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=2&rcs=4&prev_scp=iid10%3D949364%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C253%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dbillofsale_form_com-box-2-949364%26eb_br%3Dbfa042bdb1583c959161b7823290dc1f%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D1%26acptad%3D1%26br1%3D1300%26br2%3D10000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%252C117%252C120%252C67%252C51%252C116%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D27%2C815%2C817%2C899%2C903%2C919%2C782%2C26%2C24%2C25%2C26%2C22%2C23%2C24%2C25%2C26%2C21%2C22%2C23%2C24%2C25%2C26%26lb%3D2300%26reqt%3D1623428298818&eri=1&cookie=ID%3Dc4c823f0ff2239a2%3AT%3D1623428297%3AS%3DALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw&bc=31&abxe=1&lmt=1622671121&dt=1623428299822&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=308&adys=183&adks=3053355510&ucis=a&ifi=10&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90&msz=728x90&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

a1fb72b70ca195cd74873d1ef1270da18aa6d8c7721295f7d069434cfbb28b8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 148
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.ch/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 356 B
186 B 217ms
216ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=3602230372391446&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=5&prev_scp=iid10%3D925964%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C251%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D6%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbillofsale_form_com-medrectangle-1-925964%26eb_br%3D401612ca672af30f67eaf5e0989ce385%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D28%26bvm%3D2%26bvr%3D5%26shp%3D3%26acptad%3D1%26br1%3D2700%26br2%3D7000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D85%252C163%252C207%252C4%252C95%252C122%252C92%252C20%252C26%252C209%252C205%252C31%26deal1%3D782%2C26%2C25%2C26%2C24%2C25%2C26%2C24%2C25%2C26%2C23%2C24%2C25%2C26%26lb%3D3000%26reqt%3D1623428299857&eri=1&cookie=ID%3Dc4c823f0ff2239a2%3AT%3D1623428297%3AS%3DALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw&bc=31&abxe=1&lmt=1622671121&dt=1623428299861&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=482&adys=5307&adks=3853710753&ucis=b&ifi=11&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x266&msz=300x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=6&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

2d332aebd18170d0625679e60cba044e5fd1ddcbc6fd9bcbeaec4bca0d0253ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 157
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ptmd
dt.clnmde.com/ 70 B
330 B 112ms
111ms Image
image/gif 52.200.32.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.clnmde.com/ptmd?t=162342829215431437896091_N4IgZghiBcDaDMB2AbADgAzIJzwEyoBoBGdQ9A8yi6q5AFhsfQF0DwIBnGZNgC15iwArIgJDUrcGBhE2AVzkz06XGzAA3GCBBsALgAcocWLFktmkgJabohEB10RdcrnFxCCdVUSySAXkayIPoA5lqabACmAHY2wTogIQLQIETIuPBeqLhYuERCdPBEhYioWMjoWEQJuq6pXlgYiHTpQuIJ6nXIAHTo3V50CRAANjDwagDGMAC0QZG6ljLpmfg5qva6YdDk9gDWWmkZWWsA+vioqEWIQkSlQgmRlvoHqELdGX1E7t0kqA9ygXki22UXUozgoGiEAAtpEtAAjSwAEyRkQATidkQkkU4jKBESj0ZikTBonJhsM2OpLMSDstjlU6FgsEIMszECAAL6cgiQmFwlIE1EYrFsHGOGD45HC2nQMkUqk0rEpQ4rbJVPAYfLuLBczmSDjDBx0o6rXJfe5sYbSaBBamy1L0s1ETXobVCXVsCYuXQO1AAYQAqnQPfAAGqDNghKa2p2XZS3LBsACOAqCYGB6E5QA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.32.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: / Express
Resource Hash: c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 11 Jun 2021 16:18:20 GMT
x-powered-by: Express
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: image/gif

GET
H3-29 200 integrator.js Show response
adservice.google.ch/adsid/ 107 B
122 B 18ms
17ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 346 B
177 B 458ms
458ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=3597501757326547&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=1&rcs=5&prev_scp=iid10%3D949364%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C253%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D6%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dbillofsale_form_com-box-2-949364%26eb_br%3D45a351e981f435b4c20fafca8a5d741c%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D1%26acptad%3D1%26br1%3D600%26br2%3D10000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%252C117%252C120%252C67%252C51%252C116%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D27%2C815%2C817%2C899%2C903%2C919%2C782%2C26%2C24%2C25%2C26%2C22%2C23%2C24%2C25%2C26%2C21%2C22%2C23%2C24%2C25%2C26%2C21%2C22%2C23%2C24%2C25%2C26%26lb%3D1300%26reqt%3D1623428300326&eri=1&cookie=ID%3Dc4c823f0ff2239a2%3AT%3D1623428297%3AS%3DALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw&bc=31&abxe=1&lmt=1622671121&dt=1623428300330&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=308&adys=183&adks=3053355510&ucis=c&ifi=12&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90&msz=728x90&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

cc6bab21c939bcb6b4020b9afef6dcc9aa1a2b3b658c30aa3210a2a01ef563bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 148
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.ch/adsid/ 107 B
122 B 17ms
16ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 85 KB
27 KB 342ms
342ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=2388004357949337&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=6&prev_scp=iid10%3D925964%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C251%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D7%26at%3Dbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbillofsale_form_com-medrectangle-1-925964%26eb_br%3Dzero%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D28%26bvm%3D2%26bvr%3D5%26shp%3D3%26acptad%3D1%26br1%3D0%26br2%3D7000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D85%252C163%252C207%252C4%252C95%252C122%252C92%252C20%252C26%252C209%252C205%252C31%26deal1%3D782%2C26%2C25%2C26%2C24%2C25%2C26%2C24%2C25%2C26%2C23%2C24%2C25%2C26%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%26lb%3D2700%26reqt%3D1623428300364%26ss38%3D1%26ss9%3D1&eri=1&cookie=ID%3Dc4c823f0ff2239a2%3AT%3D1623428297%3AS%3DALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw&bc=31&abxe=1&lmt=1622671121&dt=1623428301368&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=482&adys=5307&adks=3853710753&ucis=d&ifi=13&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x266&msz=300x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=7&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

a33b771d3b724d60169aa2bbcf1b92dd1ebd24c1a9f83e9a0d51532531aa9f45

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17133130963487737399/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17133130963487737399/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=COu_5tn9j_ECFULKuwgdxYoBCw&gqi=&layout=/sadbundle/%24csp%253Der3%24/17133130963487737399/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17133130963487737399/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17133130963487737399/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=COu_5tn9j_ECFULKuwgdxYoBCw&gqi=&layout=/sadbundle/%24csp%253Der3%24/17133130963487737399/index.html
content-encoding: br
x-content-type-options: nosniff
google-creative-id: -1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28049
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
date: Fri, 11 Jun 2021 16:18:21 GMT
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.ch/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 14 KB
8 KB 511ms
510ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3298302919766932&correlator=4428019097219981&output=ldjh&impl=fif&eid=31061040%2C31061362%2C31061181&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=2&rcs=6&prev_scp=iid10%3D949364%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C253%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D7%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dbillofsale_form_com-box-2-949364%26eb_br%3D43aa1607a0c08c74b14a9039e7b909b4%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D1%26acptad%3D1%26br1%3D220%26br2%3D10000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%252C117%252C120%252C67%252C51%252C116%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D27%2C815%2C817%2C899%2C903%2C919%2C782%2C26%2C24%2C25%2C26%2C22%2C23%2C24%2C25%2C26%2C21%2C22%2C23%2C24%2C25%2C26%2C21%2C22%2C23%2C24%2C25%2C26%2C20%2C21%2C22%2C23%2C24%2C25%2C26%26lb%3D600%26reqt%3D1623428300832&eri=1&cookie=ID%3Dc4c823f0ff2239a2%3AT%3D1623428297%3AS%3DALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw&bc=31&abxe=1&lmt=1622671121&dt=1623428301843&dlt=1623428291489&idt=540&frm=20&biw=1600&bih=1200&oid=3&adxs=308&adys=183&adks=3053355510&ucis=e&ifi=14&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90&msz=728x90&ga_vid=2054788727.1623428292&ga_sid=1623428292&ga_hid=598433398&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

7c4b0bea8e1d3a421f9e3f83c220206e002e828dc48c713cdc00f60638a62575

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:22 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8504
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 ptmdP
dt.clnmde.com/ 7 B
328 B 112ms
111ms Ping
text/html 52.200.32.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://dt.clnmde.com/ptmdP
Requested by: Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU4593V4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.32.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: / Express
Resource Hash: aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 11 Jun 2021 16:18:22 GMT
vary: Accept-Encoding
x-powered-by: Express
etag: W/"7-Jgyp3YpFd/wAt71YECmAdg"
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
content-length: 7

GET
H2 200 container.html Show response
4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 74CE 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Fri, 11 Jun 2021 16:18:12 GMT
expires: Sat, 11 Jun 2022 16:18:12 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 10
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 35ms
15ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34e9a619897b9223115c6588f352612268c90c3d83990829768973759b0d1a6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:22 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623263566164500"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28162
x-xss-protection: 0
expires: Fri, 11 Jun 2021 16:18:22 GMT

GET
H3-29 200 greenoaks.gif Show response
www.billofsale-form.com/detroitchicago/ 0
671 B 49ms
49ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9sb2FkIiwidmFsIjoiMTA4ODEifV19XQ==
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MjgyOTAsImRhdGEiOlt7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9sb2FkIiwidmFsIjoiMTA4ODEifV19XQ==
pragma: no-cache
cookie: __gads=ID=c4c823f0ff2239a2:T=1623428297:S=ALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw; ezouspvv=220; ezouspva=1; ezouspvh=220
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:22 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9d771e2a000097d22ab35000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=hpqSSkQTwh6853EmDCwQ5vireodaWHhqSINAZjv3yf9N2pSUuUaYFSGp%2FrnVOXIkCnFXiYmM%2FdUZYbiURixzH3CgVBojmyfqIr8ZicyBI3zvT4mROIFbZ6ZMyhyN8jSPTlCz5QfkGY8CFqAtuhJhvWo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dc27a9d84297d2-FRA
expires: Thu, 10 Jun 2021 16:18:21 UTC

GET
H3-29 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
673 B 40ms
39ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDgzLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijk0OTM2NCIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQyODI5MCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDQ4MywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjQzYWExNjA3YTBjMDhjNzRiMTRhOTAzOWU3YjkwOWI0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5NDkzNjQiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MjgyOTAsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMjIsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDIyLCJiaWRfZmxvb3JfcHJldiI6MC4wMDYsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjU4NDIzODRjLTk0YmMtNGIxZS01Y2VkLWQzODkyODhiOWE2MyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0ODMsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5NDkzNjQiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MjgyOTAsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjU4NDIzODRjLTk0YmMtNGIxZS01Y2VkLWQzODkyODhiOWE2MyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0ODMsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDAzNDQ4MyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDgzLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDgzLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijk0OTM2NCIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQyODI5MCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDQ4MywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjQzYWExNjA3YTBjMDhjNzRiMTRhOTAzOWU3YjkwOWI0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5NDkzNjQiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MjgyOTAsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMjIsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDIyLCJiaWRfZmxvb3JfcHJldiI6MC4wMDYsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjU4NDIzODRjLTk0YmMtNGIxZS01Y2VkLWQzODkyODhiOWE2MyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0ODMsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5NDkzNjQiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MjgyOTAsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjU4NDIzODRjLTk0YmMtNGIxZS01Y2VkLWQzODkyODhiOWE2MyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ0ODMsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDAzNDQ4MyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDgzLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=c4c823f0ff2239a2:T=1623428297:S=ALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw; ezouspvv=220; ezouspva=1; ezouspvh=220
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:22 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9d771e2b000097d2301f8000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=yWBqdOOKmq1ZWY7tW8RiPFPtHKiGZBqR4OFpc44pX2MNztiAuI%2BB9zXihuW3Qo0BS9eZZRuR4eFvzmuAPHd70%2F%2BCnBEUA4BlKaQlLqsASMCR6ghhVElKyexMiQaOSPuIjqn3okRlC4dlD2U%2Bg%2BmMT30%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dc27a9d84597d2-FRA
expires: Thu, 10 Jun 2021 16:18:22 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
93 B 72ms
22ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/porpoiseant/banger.js?cb=194-2&bv=19&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 11 Jun 2021 16:18:22 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H3-29 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
672 B 48ms
47ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDgzLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNi0xMSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE4In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjUifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDgzLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNi0xMSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE4In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjUifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=c4c823f0ff2239a2:T=1623428297:S=ALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw; ezouspvv=220; ezouspva=1; ezouspvh=220
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:22 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9d771e2b000097d245991000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2Bd0MEDQdUgwfQ%2Bh3UgFF0tpdp5Xrzfr%2FbjiBq4DqOFDmNegFJubgYXr1iA1vog59oqIE6SXt3s3OGRjFXWvJRzy1S9LY6VXk6%2BcCoPhrJx9u9w9T%2Bn2d9y6Bwyg3LpdcT3irtZLchXi5z9tGKOM6CX0%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dc27a9d84697d2-FRA
expires: Thu, 10 Jun 2021 16:18:22 UTC

GET
H3-29 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
671 B 44ms
43ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhdWN0aW9uX2Vwb2NoIjoxNjIzNDI4MzAyLCJhZF9wb3NpdGlvbiI6MTExMiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjU4NDIzODRjLTk0YmMtNGIxZS01Y2VkLWQzODkyODhiOWE2MyIsImJpZF9mbG9vcl9pbml0aWFsIjoxMDAwMCwiYmlkX2Zsb29yX3ByZXYiOjYwMCwiYmlkX2Zsb29yX2ZpbGxlZCI6MjIwLCJhdWN0aW9uX2NvdW50Ijo3LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo1MjUsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhdWN0aW9uX2Vwb2NoIjoxNjIzNDI4MzAyLCJhZF9wb3NpdGlvbiI6MTExMiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjU4NDIzODRjLTk0YmMtNGIxZS01Y2VkLWQzODkyODhiOWE2MyIsImJpZF9mbG9vcl9pbml0aWFsIjoxMDAwMCwiYmlkX2Zsb29yX3ByZXYiOjYwMCwiYmlkX2Zsb29yX2ZpbGxlZCI6MjIwLCJhdWN0aW9uX2NvdW50Ijo3LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo1MjUsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
pragma: no-cache
cookie: __gads=ID=c4c823f0ff2239a2:T=1623428297:S=ALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw; ezouspvv=220; ezouspva=1; ezouspvh=220
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:22 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9d771e2c000097d249b61000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=7jjASfBaEDc10GBz%2BY%2Bdj3eQ%2FycrX8IBv6ycnQ8plOAR8gk0B9lEEoqXl5fRk8w43ySf4wz737CX2ktxMl8HzToZ%2B8xXRScaHdqvvd0Mzb7Ubpe7Jir5kFxyJMSrtMxeN3O4DB5EH5kxAsbjgRxgHm4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dc27a9d84797d2-FRA
expires: Thu, 10 Jun 2021 16:18:21 UTC

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame F9D0 478 B
303 B 16ms
16ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNXM3MYCELaCisgCGNCEqqYBMAE&v=APEucNV8HXz-48twuXkMxcSxqTBDC-QJJKaHWiy_A8SvLoewXtUuP22FwzHGMW_WiKTob9FCVttBT2xBZd-izshSDhWOZPAamg

Requested by

Host: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0414d0221112224b4c926de91a6e316f9d9aba685aa8b05fd0654848d8fcdf55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CNXM3MYCELaCisgCGNCEqqYBMAE&v=APEucNV8HXz-48twuXkMxcSxqTBDC-QJJKaHWiy_A8SvLoewXtUuP22FwzHGMW_WiKTob9FCVttBT2xBZd-izshSDhWOZPAamg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlTmzPF4U73MytOGslhALL0ovTgtOQajX3e9xJFdNA66F95iubV1lU0sWzofsI
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 11 Jun 2021 16:18:22 GMT
server: cafe
cache-control: private
content-length: 230
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 74CE 61 KB
24 KB 48ms
47ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bil3TTS8C5l3TnOBUrRuTa1_ckCwpmMEeRFCRSGB81XtPF6oqrCWKvX4F77q6DKbR2sbbXb5ILezT9MjxI47uiM8XGXzox_qfKYBLndv0-SOAx-k0znB5Be_-HLmCYBhmTP4mzPn8E-Qxn4-HGFEfXB0u49A&dbm_d=AKAmf-AlCxxiCvY__F9LY8ReP4m7wRnt3L3o6BqieMK7cVyHNXYpjZs1OaKkwoBrUMqcBXt8GR5-V5IAvQ1Kmrb1RFPZqZuI_aYQ67-VgMiPTpZeODqZoU0wMHepbIcA_rGvYxFgtVF2zB0eLgI06dD9OM9Utv4_V9SAiHaXqI6nO9GXPrs-yEME6Sxpj4lHN4CtHh6Z6Fr-z1bgy_6s_UPPbWxjiVTOSvqUmbdlcpUC07hWqXT0JsjxItfmvWv4XfxG4er2GrY403K8a742pz3XdF6Q0Yyb0F9IOeqxr30s-svyxpDRWDzFQZUDcNBqI-Hon3wTKLueDEZP1QKkvC4rDUfy6QHWJA2-tGMFA6MLAirwVpCwcIvXpi8kVqyteXHjsAndDGE_73Gm7iLrspXClVlxdMpUwHhSuvz-2YjVD5ydztuiENeTwp_V1oFXDZ_WpB_1PXrZGh9g9WCuo6N2eiAB2VgI2-lHAzYzC4Vz5dpKMLYFqEvt1QbJ4glQ0hvmgu2uf2taSvoENiap8atclPomjBMyCYSP3dFwHh4UcEmuGW2G7MI4ErI-zRHvQAQGIN99BTiMhipCwaYZR7P5GMBO6eLbXtIXHlacmTrQtA83wiA2P5cOyXvM0W8s6J_9QAkLRWgxAMuJQM4PQqrklK7mQkHX6au74uuxhkZuvbyQr3HKuZ10C2W0D226pdJ8OY7qDzfimk1lPnkTg_rfIdcqLigLVO5VgdXsZszyqzUXuIHHtOili7HsxCaZCVI0ygGzQ62vqXnidq9rX6CivkzSHcjenVEkZ9zi--6fuluK15FRDJ12Qo_e6iwHpYWwg1Hdl2Tof_Q4r-cc5MYwANW8BKc-7ZAPcj1b3nqUEq-gS8EVNskSgvY-ISu-YilM5rJ-d6KVNs2SQkWZzIeycG5rwIqGwYm_cJfe90Hv6Iv0VBogzv5WOWmeRLT5Yzu5G8DOnBzDtpShuU-L6vxGVA2uF5tSsfV1qlNMA042LksPlvb2QZnPUvRDBiY8Ap-q8OMu5JmngrI2w08sE26cMQpP4RCpk5cP69PqirCREnQ3yvpd3fTAh85DhRdq-SnOD3GuL1-RKOsznu2J_lJzvq44pDQsi_kNf8xYfViFRGRJ0ViB__rcagQ-WHFcBYV7VcSv8bGya61y9Tj7JUrZyq8ydkDjclJo1rg3LiU-x1vh72ypIemvuMM0kibcs7T8vCj4MSabdQwgpuajOxcmm-lybDEpvOxk0rPh9Wi9-8KXGH4OTspebOAzotVli4B7fVYNETtnTh1fBLxanzNjuACBp2I3pxBI3b-7arFsJ7AIpBK01Od984JX8satoFlHotRMOKT--ewgZBay-S3Y9XTSAGVtwmV4742w44qQE_PANwJAn8nI6YQ41W6lFFBfkbnKUnz735ioXCYE4lXAAmCgrOzsNOMH0Mmve3xKFpL1JUpfLhCmVF7W8kKTWaA5u7ovUKAEYhsiq3d2pr80GvLn6zVVoRI-qL_l16B1nxvRebXn6EX70WHWuo9llTvqqWdVM1aH7h_eW6MMiX3IYUETiNKqtWWe82zxpqFNGw9lm1ZjKvi8xs_zfjZN7kbQvneLhKfrlfrfhhjQc2cThVoMYyPg-K5uQ2ANvjf_Wd3ZvIsg26kq1R1NM3vDZ7690qw3j9pHs6az79yux0c78narq8JoO9HEEyEoiKksA8Uq3XReijG7rydy41u--eD3ACcRLXLvv1Bh021taB_cd63KTmaDlO8Tgf7Nn_84B_alVlCMm4VP6Q8C9_um_lixf_sFmclCT8BXhoHIgPZa4wR-wzHbrHkuBC0eLmEYp_wQB1XzsNkLWrrq741pH6-fE7vleVESrJ9WV618aWGf1mTDYZn06Z7a6it1ugnSi5xTLz0Y-UIHT_c0C5BiULAD6CWeNkqSONSKgS5sAY1ptxqzqpaqrpjFOIrC4QJrxtuqnmMVflw3-A5ZJVfixCOzY5mW0VSIlGGFDJFSUAoueKwy1JLx_cgKYbzNxTudT89SQ8YGslenLoKdu3mRCA9guIRFnL1MPVgT_Stf4O2BKdUWxfavN9mEOTTBfkWaX9jaR4AEQQHEMt40ya7zIs-OePlPy5bICQXXfh48CxHqzDbiAe8dZVhjZWRsbS9qBo38dkW5Sf5ADydvFC8tke9vhvVGVYyytbli3DcqfOME4ANyJ500qxQHasFGObD4dAPzT-RaDsNrzdoiX45-QmwM41KR_Le8W9JI9YjCvCExmd7Stt50mvFqDhc0m6PLGGXlhFUnhReasE0v12mh0YxL-MBaaAHLkIUAOmf9I9eVVfz6nnLblAcnSGNgLZT9w8PP8lYC2tpzA4gnxUnTL7VsQkg7p6xEnqwk9QcuhlRS5gBUYJFokuSZEZDZ_u1lywMLXnKAuoUelyyguzANU_ZuMiFyAPekKwxKibguE4w6jDBh_EV2QUSBMOEp0FNA2ZIzn5znDdeIuqQA94F3jiiQ4JlhmXwp4SH3Y1htPN4gxNgP41PkjPmzsHREICFLMxIZF5tdAzCfKB4YSm6zqBso8GuL4ohc6Hi0qfPo2BoO6Jaw0ZZtsJ1O8OzAhkNc92oESrfwE7Iz8tOVPrQ72sx3160BEHanH36BHGFnN2F8sLmGR_goFBr6gqinRRX6wK0ureJpvN-lqz44vWHHkyMu-pwDPmyBgeAQIOQ83cOpdp5hO07jaMr7WUmlyarHF5Tl1S0YQAEF2VF3i_5oniv1e7tHJ_WFMGAuweWPyqjpvq0pb3IvMhisohDXmf5oQgCpjH_amCXwfknLRKn1ymIjJThie8PiFFcY9bC2OCyXdcdV6d-FCN2Oyva5VAeLQ-HEkw_QfWgy126WIFnOH8S7igcvJrdW52ynyAJlYjALShy45SOXqhFhVN0AfYrFRViYGa7OQ1kq4288-YhLwnUZYM3WfrbLTer8iuZW9hG__fedvigFKRGq4HIWvXq6vy5Bkp9hju1_lzC3T5VTq8uIGViGq_p-9Ppu9eO01dTX063QwK2xnkohNT-bpTxgj8psEP78J2M&cid=CAASEuRox5fKLwDnJVt8evTBZmwiOw&rfl=1%2Chttps%253A%252F%252Fwww.billofsale-form.com%252F%240

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

673db1ad7faccdcc0c48a476fa3ad4e5d626e2cc5408de5d08fc39cd2eddcaa8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24803
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 74CE 42 B
515 B 57ms
38ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AaYy4inMZTkk4Sq1wr4esXMlhKO2fv9tru1u6zXWS-rTp9UQTCPUdMiN6jqQTQHWl6oQS5rG2g-lnnRtnJy1fxYNuXRaseEdpibU0Fwh77qKiXnUk

Requested by

Host: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame 74CE 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/window_focus_fy2019.js

Requested by

Host: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:10:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 497
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 25 Jun 2021 16:10:05 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 74CE 122 KB
38 KB 18ms
14ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5e762276ffd20732a10037842bac383dc64a7b230ab1f48f2a0ff7406b8b9c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:22 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623263560240521"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37945
x-xss-protection: 0
expires: Fri, 11 Jun 2021 16:18:22 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame 74CE 13 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:16:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 25 Jun 2021 16:16:27 GMT

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame F9D0 170 B
232 B 29ms
27ms Image
image/png 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_dbm

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNXM3MYCELaCisgCGNCEqqYBMAE&v=APEucNV8HXz-48twuXkMxcSxqTBDC-QJJKaHWiy_A8SvLoewXtUuP22FwzHGMW_WiKTob9FCVttBT2xBZd-izshSDhWOZPAamg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame F9D0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDcf7foFHJqvgbivqOfkyNU&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDcf7foFHJqvgbivqOfkyNU&google_cver=1&C=1

43 B
1014 B

38ms
38ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDcf7foFHJqvgbivqOfkyNU&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNXM3MYCELaCisgCGNCEqqYBMAE&v=APEucNV8HXz-48twuXkMxcSxqTBDC-QJJKaHWiy_A8SvLoewXtUuP22FwzHGMW_WiKTob9FCVttBT2xBZd-izshSDhWOZPAamg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:22 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 11 Jun 2021 16:18:22 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:22 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDcf7foFHJqvgbivqOfkyNU&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Fri, 11 Jun 2021 16:18:22 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame F9D0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMOMzkTA8YYKY4WccSSOewAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDcf7foFHJqvgbivqOfkyNU&google_cver=1

43 B
894 B

33ms
32ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDcf7foFHJqvgbivqOfkyNU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNXM3MYCELaCisgCGNCEqqYBMAE&v=APEucNV8HXz-48twuXkMxcSxqTBDC-QJJKaHWiy_A8SvLoewXtUuP22FwzHGMW_WiKTob9FCVttBT2xBZd-izshSDhWOZPAamg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:22 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 11 Jun 2021 16:18:22 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:22 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDcf7foFHJqvgbivqOfkyNU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 74CE 176 KB
61 KB 27ms
7ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2f126a8957c32db99e94d1bf7c9ed09fcd38ba99bd632ebd048f01f9c5f9c9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 10:46:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19922
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62241
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:47 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Jun 2021 10:46:20 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/ Frame 74CE 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bil3TTS8C5l3TnOBUrRuTa1_ckCwpmMEeRFCRSGB81XtPF6oqrCWKvX4F77q6DKbR2sbbXb5ILezT9MjxI47uiM8XGXzox_qfKYBLndv0-SOAx-k0znB5Be_-HLmCYBhmTP4mzPn8E-Qxn4-HGFEfXB0u49A&dbm_d=AKAmf-AlCxxiCvY__F9LY8ReP4m7wRnt3L3o6BqieMK7cVyHNXYpjZs1OaKkwoBrUMqcBXt8GR5-V5IAvQ1Kmrb1RFPZqZuI_aYQ67-VgMiPTpZeODqZoU0wMHepbIcA_rGvYxFgtVF2zB0eLgI06dD9OM9Utv4_V9SAiHaXqI6nO9GXPrs-yEME6Sxpj4lHN4CtHh6Z6Fr-z1bgy_6s_UPPbWxjiVTOSvqUmbdlcpUC07hWqXT0JsjxItfmvWv4XfxG4er2GrY403K8a742pz3XdF6Q0Yyb0F9IOeqxr30s-svyxpDRWDzFQZUDcNBqI-Hon3wTKLueDEZP1QKkvC4rDUfy6QHWJA2-tGMFA6MLAirwVpCwcIvXpi8kVqyteXHjsAndDGE_73Gm7iLrspXClVlxdMpUwHhSuvz-2YjVD5ydztuiENeTwp_V1oFXDZ_WpB_1PXrZGh9g9WCuo6N2eiAB2VgI2-lHAzYzC4Vz5dpKMLYFqEvt1QbJ4glQ0hvmgu2uf2taSvoENiap8atclPomjBMyCYSP3dFwHh4UcEmuGW2G7MI4ErI-zRHvQAQGIN99BTiMhipCwaYZR7P5GMBO6eLbXtIXHlacmTrQtA83wiA2P5cOyXvM0W8s6J_9QAkLRWgxAMuJQM4PQqrklK7mQkHX6au74uuxhkZuvbyQr3HKuZ10C2W0D226pdJ8OY7qDzfimk1lPnkTg_rfIdcqLigLVO5VgdXsZszyqzUXuIHHtOili7HsxCaZCVI0ygGzQ62vqXnidq9rX6CivkzSHcjenVEkZ9zi--6fuluK15FRDJ12Qo_e6iwHpYWwg1Hdl2Tof_Q4r-cc5MYwANW8BKc-7ZAPcj1b3nqUEq-gS8EVNskSgvY-ISu-YilM5rJ-d6KVNs2SQkWZzIeycG5rwIqGwYm_cJfe90Hv6Iv0VBogzv5WOWmeRLT5Yzu5G8DOnBzDtpShuU-L6vxGVA2uF5tSsfV1qlNMA042LksPlvb2QZnPUvRDBiY8Ap-q8OMu5JmngrI2w08sE26cMQpP4RCpk5cP69PqirCREnQ3yvpd3fTAh85DhRdq-SnOD3GuL1-RKOsznu2J_lJzvq44pDQsi_kNf8xYfViFRGRJ0ViB__rcagQ-WHFcBYV7VcSv8bGya61y9Tj7JUrZyq8ydkDjclJo1rg3LiU-x1vh72ypIemvuMM0kibcs7T8vCj4MSabdQwgpuajOxcmm-lybDEpvOxk0rPh9Wi9-8KXGH4OTspebOAzotVli4B7fVYNETtnTh1fBLxanzNjuACBp2I3pxBI3b-7arFsJ7AIpBK01Od984JX8satoFlHotRMOKT--ewgZBay-S3Y9XTSAGVtwmV4742w44qQE_PANwJAn8nI6YQ41W6lFFBfkbnKUnz735ioXCYE4lXAAmCgrOzsNOMH0Mmve3xKFpL1JUpfLhCmVF7W8kKTWaA5u7ovUKAEYhsiq3d2pr80GvLn6zVVoRI-qL_l16B1nxvRebXn6EX70WHWuo9llTvqqWdVM1aH7h_eW6MMiX3IYUETiNKqtWWe82zxpqFNGw9lm1ZjKvi8xs_zfjZN7kbQvneLhKfrlfrfhhjQc2cThVoMYyPg-K5uQ2ANvjf_Wd3ZvIsg26kq1R1NM3vDZ7690qw3j9pHs6az79yux0c78narq8JoO9HEEyEoiKksA8Uq3XReijG7rydy41u--eD3ACcRLXLvv1Bh021taB_cd63KTmaDlO8Tgf7Nn_84B_alVlCMm4VP6Q8C9_um_lixf_sFmclCT8BXhoHIgPZa4wR-wzHbrHkuBC0eLmEYp_wQB1XzsNkLWrrq741pH6-fE7vleVESrJ9WV618aWGf1mTDYZn06Z7a6it1ugnSi5xTLz0Y-UIHT_c0C5BiULAD6CWeNkqSONSKgS5sAY1ptxqzqpaqrpjFOIrC4QJrxtuqnmMVflw3-A5ZJVfixCOzY5mW0VSIlGGFDJFSUAoueKwy1JLx_cgKYbzNxTudT89SQ8YGslenLoKdu3mRCA9guIRFnL1MPVgT_Stf4O2BKdUWxfavN9mEOTTBfkWaX9jaR4AEQQHEMt40ya7zIs-OePlPy5bICQXXfh48CxHqzDbiAe8dZVhjZWRsbS9qBo38dkW5Sf5ADydvFC8tke9vhvVGVYyytbli3DcqfOME4ANyJ500qxQHasFGObD4dAPzT-RaDsNrzdoiX45-QmwM41KR_Le8W9JI9YjCvCExmd7Stt50mvFqDhc0m6PLGGXlhFUnhReasE0v12mh0YxL-MBaaAHLkIUAOmf9I9eVVfz6nnLblAcnSGNgLZT9w8PP8lYC2tpzA4gnxUnTL7VsQkg7p6xEnqwk9QcuhlRS5gBUYJFokuSZEZDZ_u1lywMLXnKAuoUelyyguzANU_ZuMiFyAPekKwxKibguE4w6jDBh_EV2QUSBMOEp0FNA2ZIzn5znDdeIuqQA94F3jiiQ4JlhmXwp4SH3Y1htPN4gxNgP41PkjPmzsHREICFLMxIZF5tdAzCfKB4YSm6zqBso8GuL4ohc6Hi0qfPo2BoO6Jaw0ZZtsJ1O8OzAhkNc92oESrfwE7Iz8tOVPrQ72sx3160BEHanH36BHGFnN2F8sLmGR_goFBr6gqinRRX6wK0ureJpvN-lqz44vWHHkyMu-pwDPmyBgeAQIOQ83cOpdp5hO07jaMr7WUmlyarHF5Tl1S0YQAEF2VF3i_5oniv1e7tHJ_WFMGAuweWPyqjpvq0pb3IvMhisohDXmf5oQgCpjH_amCXwfknLRKn1ymIjJThie8PiFFcY9bC2OCyXdcdV6d-FCN2Oyva5VAeLQ-HEkw_QfWgy126WIFnOH8S7igcvJrdW52ynyAJlYjALShy45SOXqhFhVN0AfYrFRViYGa7OQ1kq4288-YhLwnUZYM3WfrbLTer8iuZW9hG__fedvigFKRGq4HIWvXq6vy5Bkp9hju1_lzC3T5VTq8uIGViGq_p-9Ppu9eO01dTX063QwK2xnkohNT-bpTxgj8psEP78J2M&cid=CAASEuRox5fKLwDnJVt8evTBZmwiOw&rfl=1%2Chttps%253A%252F%252Fwww.billofsale-form.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:14:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 223
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 25 Jun 2021 16:14:39 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/ Frame 74CE 22 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cabbde8502a6598896a3c812c89ecd99ecfb3e9ca68f632c8c9b3f2a7f6e0046

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:16:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 135
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 18280575870105241958
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 25 Jun 2021 16:16:07 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 74CE 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 12:04:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15262
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 11 Jun 2022 12:04:00 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 336C 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Thu, 10 Jun 2021 19:15:34 GMT
expires: Fri, 11 Jun 2021 19:15:34 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 75768
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 74CE 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6de0868ae6b9e34e8f3eea38c576415bf3cc7a73f2c2e1fd68d58efdd5145c2a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FE29 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Fri, 11 Jun 2021 11:11:48 GMT
expires: Sat, 11 Jun 2022 11:11:48 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 18394
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/ Frame A0FF 124 KB
25 KB 28ms
14ms Document
text/html 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

629f717d732e824cb630905dd81a15f1abca9908dce0d23092a89792c71f5fde

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 25157
date: Fri, 11 Jun 2021 16:18:22 GMT
expires: Sat, 12 Jun 2021 16:18:22 GMT
cache-control: public, max-age=86400
last-modified: Sun, 02 Jun 2019 18:05:19 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 74CE 0
592 B 101ms
59ms Ping
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv2W7-vKcGf2SEuM9IMajANjLOwKUFSJrxqACxLaiYm0atMYpRAXcYN74Tg6BnPYn7UTSsDNIzVGKLmWzBnSx71Z7V_BV521xLJUElVJJdn8j_AUt4ojnhzm2FCvy4S9EcvJ0z7e8glC4cE6ZY5-JyidiaqfOczLsdXdnUPgoaUz5x8x-Td9aRv_8NYYOwYdZxwl3skJF_dY_lzgGVanvG3OtnjEpxJS62s5e1EXbKonADzqTKuvyS2_v2j3rP5FnXzdxjUGd7YWRSy_lRyvKN233dNZj3PsJtm9dMc9SKdPN_WCWsjxB04EmriCEqcyY_5MTOxRq4NYyh2Dy72BHaCFoiQPk67Ewd53db8WIkrcXvyWZk4JWo8o20zhqDnFwi8_qM1ghEeOaSkA0Y7M_MDvOQR1d5_q9AzID36uTPSMb9F8HKyxcNYrXwHR5Ev33qUDSxJgBW2Nri9M7ocpaFcXeBAuNh4MolqOFkkTghIq32zLlzgqKi0pvMVv3s06Myb7FSS0jil6O_IbHwfMiytixSfh-CfFjFc8iYLb2rBzKEIdXBfuJtTBVPjZ_SffL3TAKPPT8a2X5exi1Qp4M5qZCsl63gCCR4NTgaXEVw52BMTaDmILWSGcNDWiDeazlxBt6SbtCTbHXx0PD5FtMDS8SLXlvmQ-zPSh8S_bu5eoOBzIT1Cn0jwNaRQrseTr2Bx9WvOkMgL3IMxYNwPtrIa4Zc9S8JOhfmGRIkdO-srRfB6tbl-xHps5LtwXsGv85Q312JAHTszlsCJ73rT0P6javvqqDuj6zeth9I45rFKjJWpF9uSvjkQaHzKbxeGArsfLJckaDfFxiOpJjiieX5Yagnef7RA3G3gJX4oS-XDuVv9MOZ12shRq7M37k4XJvRFDk2E-7iVziC8lwsLz5AurWvzWL40-yf499oSL75GHBqM7JE0Fgr_kXqDuXsagSYnnAsFTxnYwfQBm1lUq2gS3qp_prd9ewQViYt7flUikJ5iO72Tmkrc8AyJtTLXoUSEu4-tcChTthX6w84XwS6eWN7CrFlGfzvzi9x7ZcY_9Uwoz1CGNnR1rBcYawyxG4JgdotCBOvT-W1X_1pMzBjG4_FHYfvdr5ZsF31c8X7uLOtFfYEOCk1FoFcsS3PvXImQPb2NwSyfP8s9BHyNVsKvoxCmNvIb7rnCkXI3MMUizph_USv92t1uqv4QpTlD2VCHePOZNmD9FdH5jOGtweci-EB6uV5PqKfHqFKJDdv1hsB5a5YcIPY3j-Sf-BuULoLjPfSMdbYEvA&sai=AMfl-YRhPb4qwudX0s5IGZoIyYVi5XekTAxVuBSheF9kwaiVATi52AlThW3cqhhBmsspxBo7zo6tNFf7qsY9IqER89xgpKi3SeITqUqxNgOyMALmpNowl-bWGbAzf06RyOCuhqiPtARoUeNzYZcERfCt-ssfm0c1HeSBMsEOd5qoodQZmNU_hCko3Gg&sig=Cg0ArKJSzN_q6nhOkwLoEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=95&cbvp=1&cstd=89&cisv=r20210607.31171&adurl=

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Fri, 11 Jun 2021 16:18:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 336C
Redirect Chain

https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEO9kfddxGQlArc12h1iVY-Q&google_cver=1&google_push=AYg5qPIGTH1NEncuOwiWf_SGRUJ3p4_EsYjiEEu0mkaC_7LQ1iDIEDUP8J_Wu...
https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEO9kfddxGQlArc12h1iVY-Q&google_cver=1&google_push=AYg5qPIGTH1NEncuOwiWf_SGRUJ3p4_EsYjiEEu0mkaC_7LQ1iDIEDUP8J_Wu...
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=xJfv5pMPiIpVidzusEkKGw&google_push=AYg5qPIGTH1NEncuOwiWf_SGRUJ3p4_EsYjiEEu0mkaC_7LQ1iDIEDUP8J_WuIePjc5xcsqtxL7_ymd0H...

170 B
188 B

29ms
29ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=xJfv5pMPiIpVidzusEkKGw&google_push=AYg5qPIGTH1NEncuOwiWf_SGRUJ3p4_EsYjiEEu0mkaC_7LQ1iDIEDUP8J_WuIePjc5xcsqtxL7_ymd0Hh1z3fRc0irVkkPUgKe6

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 11 Jun 2021 16:18:22 GMT
Server: nginx
Vary: Accept
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=xJfv5pMPiIpVidzusEkKGw&google_push=AYg5qPIGTH1NEncuOwiWf_SGRUJ3p4_EsYjiEEu0mkaC_7LQ1iDIEDUP8J_WuIePjc5xcsqtxL7_ymd0Hh1z3fRc0irVkkPUgKe6
Connection: close
Content-Type: text/plain; charset=utf-8
Content-Length: 238

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 336C
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEEtLmiy8eVabWDRp82u-88g&google_cver=1&google_push=AYg5qPIM_CZJXVawVC-lfsZSoAxqtiABuMdukux_VD-_3o4tPRuKjCbD44QfSvjD3-XaamCCYBG_dTd_EwznaqvZmOfK...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEEtLmiy8eVabWDRp82u-88g&google_cver=1&google_push=AYg5qPIM_CZJXVawVC-lfsZSoAxqtiABuMdukux_VD-_3o4tPRuKjCbD44QfSvjD3-XaamCCYBG_dTd_Ewznaq...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIM_CZJXVawVC-lfsZSoAxqtiABuMdukux_VD-_3o4tPRuKjCbD44QfSvjD3-XaamCCYBG_dTd_EwznaqvZmOfK2JhfSD3U&google_hm=1u7lhcUMRcSqvSty2EcKqQ==

170 B
188 B

28ms
27ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIM_CZJXVawVC-lfsZSoAxqtiABuMdukux_VD-_3o4tPRuKjCbD44QfSvjD3-XaamCCYBG_dTd_EwznaqvZmOfK2JhfSD3U&google_hm=1u7lhcUMRcSqvSty2EcKqQ==

Requested by

Host: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIM_CZJXVawVC-lfsZSoAxqtiABuMdukux_VD-_3o4tPRuKjCbD44QfSvjD3-XaamCCYBG_dTd_EwznaqvZmOfK2JhfSD3U&google_hm=1u7lhcUMRcSqvSty2EcKqQ==
date: Fri, 11 Jun 2021 16:18:22 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 336C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGWwWSICKw40zEOPC3DDOQ0&google_cver=1&google_push=AYg5qPJ1Ok83s0jye7V1HvxVQSGs8gGnYZzNQu0yHnXNgUte-YmNtvJ3IqA2SY0atDw5zgHMMvU...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BTSkFONk0tMTItR09HWA==&google_push=AYg5qPJ1Ok83s0jye7V1HvxVQSGs8gGnYZzNQu0yHnXNgUte-YmNtvJ3IqA2SY0atDw5zgHMMvUCM2zKpSrzegttsOU5IUec7Ho

170 B
188 B

28ms
28ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BTSkFONk0tMTItR09HWA==&google_push=AYg5qPJ1Ok83s0jye7V1HvxVQSGs8gGnYZzNQu0yHnXNgUte-YmNtvJ3IqA2SY0atDw5zgHMMvUCM2zKpSrzegttsOU5IUec7Ho

Requested by

Host: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BTSkFONk0tMTItR09HWA==&google_push=AYg5qPJ1Ok83s0jye7V1HvxVQSGs8gGnYZzNQu0yHnXNgUte-YmNtvJ3IqA2SY0atDw5zgHMMvUCM2zKpSrzegttsOU5IUec7Ho
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Expires: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 336C
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESEIHWWwijHaaQiNJo-MnQ8G0&google_cver=1&google_push=AYg5qPKzU8ZDR2PV0hJORjKCEKfiMFo9zWjvopIo-pejdnFp4SvgUiJ_GQ-AkAC86gYcLCFhafyroh-N5eXj1vlcqflcvuqxQ5ZK
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPKzU8ZDR2PV0hJORjKCEKfiMFo9zWjvopIo-pejdnFp4SvgUiJ_GQ-AkAC86gYcLCFhafyroh-N5eXj1vlcqflcvuqxQ5ZK&google_hm=Z2YzOTFmNDQ4MjZiMjk3...

170 B
188 B

27ms
26ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPKzU8ZDR2PV0hJORjKCEKfiMFo9zWjvopIo-pejdnFp4SvgUiJ_GQ-AkAC86gYcLCFhafyroh-N5eXj1vlcqflcvuqxQ5ZK&google_hm=Z2YzOTFmNDQ4MjZiMjk3NDc3OWY=

Requested by

Host: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:22 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPKzU8ZDR2PV0hJORjKCEKfiMFo9zWjvopIo-pejdnFp4SvgUiJ_GQ-AkAC86gYcLCFhafyroh-N5eXj1vlcqflcvuqxQ5ZK&google_hm=Z2YzOTFmNDQ4MjZiMjk3NDc3OWY=
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H/1.1 200
OK sync
rtb2-useast.e-volution.ai/ Frame 336C 42 B
233 B 319ms
108ms Image
image/gif 174.137.133.49
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEBhO-nj6X4yBCWc_1l0h2gE&google_cver=1&google_push=AYg5qPKqOtSqkGZf752rBHu1tfDF_riosy1EyLUvq7DkQIHwYnBY2a0subtwzW_q41u6kXfBppdFi6Gbf86ZF_2rLfwcbCstKOnD
Requested by: Host: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 16:18:22 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: keep-alive
Content-Length: 42

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 336C
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEHPZ2r-2EufPcxpW775Z3Qg&google_cver=1&google_push=AYg5qPKjZQGdP3UGvh-gCc6ZErgcUtmR1oHaT7sAm82_in-mm9cAk4dSB6Te4_Ia9QvwaDTyoWd1UrvLUcdco009wTwh5BE...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPKjZQGdP3UGvh-gCc6ZErgcUtmR1oHaT7sAm82_in-mm9cAk4dSB6Te4_Ia9QvwaDTyoWd1UrvLUcdco009wTwh5BEqEmkWvQ&google_hm=MTM0ODE3M...

170 B
188 B

27ms
26ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPKjZQGdP3UGvh-gCc6ZErgcUtmR1oHaT7sAm82_in-mm9cAk4dSB6Te4_Ia9QvwaDTyoWd1UrvLUcdco009wTwh5BEqEmkWvQ&google_hm=MTM0ODE3MTg3NzkzNzAzOTM0MA==

Requested by

Host: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPKjZQGdP3UGvh-gCc6ZErgcUtmR1oHaT7sAm82_in-mm9cAk4dSB6Te4_Ia9QvwaDTyoWd1UrvLUcdco009wTwh5BEqEmkWvQ&google_hm=MTM0ODE3MTg3NzkzNzAzOTM0MA==
Date: Fri, 11 Jun 2021 16:18:22 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 336C
Redirect Chain

https://sm.rtb.mts.ru/p?ssp=googlevid&pm=1&google_gid=CAESEAhMRywZy_kT7DiPEi9uQE0&google_cver=1&google_push=AYg5qPIcD_CJZrpTWM4lMS93O_E33jfmRgI_kWsjrm4NsBbonQsDqR6sNP-mOHcBOdVlfyuRCBx5YTq7lKVnSAyi0...
https://sm.rtb.mts.ru/match/second?r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc_2%26id%3Dba517a1e-011d-479d-b1c2-625ce53863da%26google_push%3DAYg5qPIcD_CJZrpTWM4lMS93O_E33...
https://tech.rtb.mts.ru/?dsp_uid=ba517a1e-011d-479d-b1c2-625ce53863da&return_url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc_2%26id%3Dba517a1e-011d-479d-b1c2-625ce53863da%2...
https://cm.g.doubleclick.net/pixel?google_nid=stream_llc_2&id=ba517a1e-011d-479d-b1c2-625ce53863da&google_push=AYg5qPIcD_CJZrpTWM4lMS93O_E33jfmRgI_kWsjrm4NsBbonQsDqR6sNP-mOHcBOdVlfyuRCBx5YTq7lKVnSA...

170 B
188 B

27ms
27ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stream_llc_2&id=ba517a1e-011d-479d-b1c2-625ce53863da&google_push=AYg5qPIcD_CJZrpTWM4lMS93O_E33jfmRgI_kWsjrm4NsBbonQsDqR6sNP-mOHcBOdVlfyuRCBx5YTq7lKVnSAyi0MKO8DFRypEYvQ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 11 Jun 2021 16:18:22 GMT
Server: nginx/1.13.12
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=stream_llc_2&id=ba517a1e-011d-479d-b1c2-625ce53863da&google_push=AYg5qPIcD_CJZrpTWM4lMS93O_E33jfmRgI_kWsjrm4NsBbonQsDqR6sNP-mOHcBOdVlfyuRCBx5YTq7lKVnSAyi0MKO8DFRypEYvQ
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 336C 0
12 B 26ms
24ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LCLK4rWQGsBffEiaSZHHcZdIsdjgHkywjhiGB1EyezaeLoITeKF3x-yxgEO79Q9GMXO2WCbaln

Requested by

Host: 4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
URL: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:22 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 tE64XG1cXAHgdRZqLuUmMLCyOuQ9s7LE_kL_xOEQzyo.js Show response
pagead2.googlesyndication.com/bg/ Frame FE29 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/tE64XG1cXAHgdRZqLuUmMLCyOuQ9s7LE_kL_xOEQzyo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b44eb85c6d5c5c01e075166a2ee52630b0b23ae43db3b2c4fe42ffc4e110cf2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 10:47:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19823
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5784
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 11 Jun 2022 10:47:59 GMT

GET
H3-29 200 Enabler_01_236.js Show response
s0.2mdn.net/879366/ Frame A0FF 105 KB
36 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_236.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

484d7e7e3fb0829086a0228660693a28cab169e45be6ee1a16e39522551cfef9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 15:51:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1625
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36739
x-xss-protection: 0
last-modified: Mon, 06 May 2019 18:34:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Jun 2021 15:51:17 GMT

GET
H3-29 200 PublicoHeadline-Bold-Web.woff
s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/ Frame A0FF 58 KB
58 KB 8ms
7ms Font
font/woff 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/PublicoHeadline-Bold-Web.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8b936a0e76b2601b12209208315d91de3529f5c638c2bfc556ac3e2e9ca52b0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 12:33:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 02 Jun 2019 18:05:19 GMT
server: sffe
age: 13464
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59755
x-xss-protection: 0
expires: Sat, 12 Jun 2021 12:33:58 GMT

GET
H3-29 200 SourceSansPro-Semibold.ttf
s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/ Frame A0FF 286 KB
127 KB 11ms
10ms Font
font/ttf 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/SourceSansPro-Semibold.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b440fd42fd5a54e1b252731deca9cc86604bee6ffa99281f5874c3476eb17eae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 12:33:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13464
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 129903
x-xss-protection: 0
last-modified: Sun, 02 Jun 2019 18:05:19 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Jun 2021 12:33:58 GMT

GET
H3-29 200 SourceSansPro-Light.ttf
s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/ Frame A0FF 286 KB
127 KB 12ms
12ms Font
font/ttf 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/SourceSansPro-Light.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d9cd89e3cdbcc08f95fea442b3ce366958ba30104d678e9604126e5fd2565d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 12:33:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13464
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 129503
x-xss-protection: 0
last-modified: Sun, 02 Jun 2019 18:05:19 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Jun 2021 12:33:58 GMT

GET
H3-29 200 SourceSansPro-Bold.ttf
s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/ Frame A0FF 285 KB
126 KB 14ms
14ms Font
font/ttf 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/SourceSansPro-Bold.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2efc3a95d076f2d04c5928c0ad698b7c61cc302d6f6e79e9643cd3722f7becc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 12:33:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13464
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 129304
x-xss-protection: 0
last-modified: Sun, 02 Jun 2019 18:05:19 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Jun 2021 12:33:58 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 74CE 0
23 B 81ms
55ms Ping
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 16:18:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 red-shape_Storer_BG.png
s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/ Frame A0FF 4 KB
4 KB 9ms
8ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/red-shape_Storer_BG.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a9c9d50d1493dbba6bdf41d6057f558f54a72aa014d70adfb4f37c95a44b2c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 12:33:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 02 Jun 2019 18:05:19 GMT
server: sffe
age: 13464
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4582
x-xss-protection: 0
expires: Sat, 12 Jun 2021 12:33:58 GMT

GET
H3-29 200 axa-white.png
s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/ Frame A0FF 4 KB
4 KB 8ms
7ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/axa-white.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bac92cdf0320b807e091bc516aea9b32055fffae574c236255bc8b36e106bb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 12:33:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 02 Jun 2019 18:05:18 GMT
server: sffe
age: 13464
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3635
x-xss-protection: 0
expires: Sat, 12 Jun 2021 12:33:58 GMT

GET
H3-29 200 728x90-blue-bg.png
s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/ Frame A0FF 3 KB
3 KB 10ms
9ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/728x90-blue-bg.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f474ee201e0adf1065e3218e655cd8de2b72c05c4925980de64c4d03cc96d29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 12:33:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 02 Jun 2019 18:05:19 GMT
server: sffe
age: 13464
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2602
x-xss-protection: 0
expires: Sat, 12 Jun 2021 12:33:58 GMT

GET
H3-29 200 thump.png
s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/ Frame A0FF 12 KB
12 KB 9ms
9ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/thump.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35b36dbd58d268f33b369270a18659c08888b4f41c49eeca07c3f87f210154a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 12:33:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 02 Jun 2019 18:05:18 GMT
server: sffe
age: 13464
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12047
x-xss-protection: 0
expires: Sat, 12 Jun 2021 12:33:58 GMT

GET
H3-29 200 green-box.png
s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/ Frame A0FF 11 KB
11 KB 9ms
8ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/green-box.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

982d9a8b1fdb1c0cda2a6aec453aa4d732e50ec3eb04fdb8a5cd32972629b07b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 12:33:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 02 Jun 2019 18:05:18 GMT
server: sffe
age: 13464
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11086
x-xss-protection: 0
expires: Sat, 12 Jun 2021 12:33:58 GMT

GET
H3-29 200 728x90-blue-bg-Motorrad.jpg
s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/ Frame A0FF 10 KB
10 KB 10ms
9ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/728x90-blue-bg-Motorrad.jpg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e4c2413edbe2669464882c4c964b8fd5efa49592594c175a7fd21fa3a565a3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61137057/20190602110518867/index.html?e=69&leftOffset=0&topOffset=0&c=1lBe6fBSQ0&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 12:33:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 02 Jun 2019 18:05:19 GMT
server: sffe
age: 13464
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9779
x-xss-protection: 0
expires: Sat, 12 Jun 2021 12:33:58 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FE29 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BjWbWzozDYJGtGMXI3gPBzoOgDgAAAAA4AeAEAg&bg=!7e6l7qrNAAY6sG-_OrA7ACkAdvg8WheKtdKVoS1VmS9oKn4mPC_y1wtmM5paAAZM_ZjW8fi9oymifwIAAACZUgAAAAxoAQeZAsyPxgoKiTpUZtCmYU4yWf5VYrSTRKB-VqYwG-tSavlwQL2gGpi5i3hRfLu1RBE-cXw1pxy0jFcj32t0ed0MBkvfNT4UVRT9FGBka1NvSzcYgMUH7EMNMBUkqVzV6Je5k3dS29vkJ4hwuG6QnIFMHt7mhADKaBNQx4qUKJa1jG8BKst9j7YfBuOQ0XC22o0PjrUfD6RzwIhudcGfFDfbYWYCt3Or30RejnZUMq9j9fFdslzICLmq251h3nmP55D9aH4Wu4_CQn4WwK4P1qpIB8Rd7bhwK3NuUTlb8gPaw_D4sv1R4W7KvN1ecio9i22qj1AQj45tTp-vZFOFzoB8Cj5YXnQawI287_FQIBc70j7jlGMPhekU9pbCxv0sg0B-ryj6aA8UjetG6s-Lae9XmBAmbuWPzZIjRC45VRphNy2on-9jpfvZhzvr7du67-JXgFqZsMVN_gujDVdB8sZrT6LMoF4GGfFO5aTt1cV_HG5B1pM7wLHuGWe9XF6Gup5NwoRbRU7muuipi6dw6H3QbpQHakYsQa3idYRzfNk8wp7y0dU6AjMB5kkTyLAweQ_A-_hrrjnjYb0OYwvzh01P3T1jffIGErbUtxVL2gVC-i5A9rze-ZjayO2KjlK8wTROzNbvc-csgG1AfJkbCIuhvhxfP-MQx88mi_hXAtM_tZ-S-hcekaNoW47BNPDG8Q95m34i4C8HUZRc76XjW8q1e43VrWfYQjKjSYDfh4N97nh3NOH4FOKFy7MIdHEzD48fgjODtpGNxX0eTxcjUf8iol5l5GgnslwNYZbvXWsklUprew58eAcZfCkEo2tKoEOU8EErLe55xbtZYKE9mlQvLJsswEQlMVKFmg9GJV5UkZwNCEALvH0d1PSCrG5ADWtFB4xTbLowgQ7nGcDe60jYCKDq5-ZU8W6qU3n06pZlhZYVvPxO3aDq5RMiEkhHUA

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 74CE 42 B
64 B 50ms
37ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvXGmdZB3TJic6EtK6ZegW6xgeJaAi6ceyPYnbBYihbs9QfaF-DoLzt7bW5uG72NzMt_3-Vycs5iXrd5qce2ppXb69VrnuxLIa_riwszQ4cNeeDXhRMt72tTqI&sai=AMfl-YQ1UOo_N1vszsdDC638tN2Z--SMABkE7EL5-8BGyvwRRUoGv0qyloPHGAe4StP2BTovGxpkR97h-pqNyLOK9Jc3-2E8xciwAENR4goOzZ0FQZKreRNhToeAukcd&sig=Cg0ArKJSzO9Hr0XmJgH7EAE&cid=CAASEuRox5fKLwDnJVt8evTBZmwiOw&id=lidar2&mcvt=1000&p=183,308,273,1036&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210609&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3053355510&rs=4&met=ce&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ%3D%3D&vs=4&eosm=0&rst=1623428302369&dlt=8&rpt=141&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 16:18:23 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
675 B 34ms
34ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDgzLCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDgzLCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=c4c823f0ff2239a2:T=1623428297:S=ALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw; ezouspvv=220; ezouspva=1; ezouspvh=220
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:23 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9d7722cb000097d22e380000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=glBaoK6o6ks9f8Erts%2BSYUyK6JWHIQ%2BazV3rBMIXeMXfzmTtOwv4cvzPFc6qLaIqdwqYPJRev6xHo%2Fr%2FTl%2Bn1Euz%2FQkbLZ9uaLkSfMl9OW7tb7leD7NsFEYdjDrtQ%2BA9HTinA7Q1XMDaUE7VD2HqRzE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dc27b14cca97d2-FRA
expires: Thu, 10 Jun 2021 16:18:23 UTC

GET
H3-29 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
670 B 40ms
39ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDgzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbNzI4LDkwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDgzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijk0OTM2NCIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQyODI5MCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDQ4MywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIxMTcifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDgzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbNzI4LDkwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTQ5MzY0IiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDI4MjkwLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1ODQyMzg0Yy05NGJjLTRiMWUtNWNlZC1kMzg5Mjg4YjlhNjMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDgzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijk0OTM2NCIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQyODI5MCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTg0MjM4NGMtOTRiYy00YjFlLTVjZWQtZDM4OTI4OGI5YTYzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDQ4MywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIxMTcifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: __gads=ID=c4c823f0ff2239a2:T=1623428297:S=ALNI_MYUoVx0XN46qEwmwGIX_bHUioZRjw; ezouspvv=220; ezouspva=1; ezouspvh=220
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:18:23 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9d7723ff000097d230246000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=SenDJwHQNZ8AW%2Faq1KEcKosGEjBpDaVk6JamMz53z0SuEaGccE472shkpoSr1STQGJADlKla9lljf%2FvR5GTq%2Bp8pCJzUcBSpoEgaqVjyQOMAyCMpbBvhU%2BKHrYNaAMt1W29vN21Ff7r1niTv72fSQwE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dc27b33dbd97d2-FRA
expires: Thu, 10 Jun 2021 16:18:23 UTC

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: blank
URL: about:blank

Verdicts & Comments Add Verdict or Comment

259 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.pxlclnmdecom-a.akamaihd.net/	1970-01-23 06:41:45	Name: bafp_t Value: 9e6d65b0-cad0-11eb-9e46-1f6a360346bb
.pxlclnmdecom-a.akamaihd.net/	1970-01-19 18:57:10	Name: bfp_sn_td_73e4745982ad7aeec38955aa80c745fd Value: 1623428292_288831751785_73e4745982ad7aeec38955aa80c745fd
.pxlclnmdecom-a.akamaihd.net/	1970-01-19 18:57:10	Name: bfp_sn Value: 1623428292_288831751785
www.billofsale-form.com/	1970-01-20 03:42:44	Name: ezux_lpl_26431 Value: 1623428292798\|5842384c-94bc-4b1e-5ced-d389288b9a63\|false
.pxlclnmdecom-a.akamaihd.net/	1970-01-19 18:57:10	Name: bfp_sn_t_8b2087b102c9e3e5ffed1c1478ed8b78 Value: 1623428292_288831751785_8b2087b102c9e3e5ffed1c1478ed8b78
.billofsale-form.com/	1970-01-20 04:18:44	Name: __gads Value: ID=b8c5807911c55794-22527cbc5dc8007b:T=1623428292:S=ALNI_Ma3ZREIBVLxEMyIs8QF-mUD0mGVdQ
.www.billofsale-form.com/	1970-01-23 06:41:45	Name: bafp Value: 9e6d3ea0-cad0-11eb-a9be-772629367fb7
.billofsale-form.com/	1970-01-20 04:21:37	Name: __qca Value: P0-1421005504-1623428292091
.billofsale-form.com/	1970-01-19 18:57:10	Name: bfp_sn_pl Value: 1623428292\|1_288831751785
.billofsale-form.com/	1970-01-23 06:41:45	Name: bfp_sn_rt_8b2087b102c9e3e5ffed1c1478ed8b78 Value: 1623428292157
.billofsale-form.com/	1970-01-23 06:41:45	Name: bfp_sn_rf_8b2087b102c9e3e5ffed1c1478ed8b78 Value: Direct

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.billofsale-form.com/wp-content/cache/autoptimize/js/autoptimize_f5ddbee1756ef961868f5222da593f8e.js(Line 1) Message: JQMIGRATE: Migrate is installed, version 3.3.2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4808e2ca73c836636defcd59bfe301d8.safeframe.googlesyndication.com
a.rfihub.com
acdn.adnxs.com
ads.adaptv.advertising.com
ads.avct.cloud
ads.yieldmo.com
adservetx.media.net
adservice.google.ch
adservice.google.com
atemda.com
bh.contextweb.com
bid.contextweb.com
blank
btlr.sharethrough.com
c.deployads.com
cdn-5.billofsale-form.com
cm.g.doubleclick.net
contextual.media.net
cs.chocolateplatform.com
demand.trafficroots.com
dsum-sec.casalemedia.com
dsum.casalemedia.com
dt.clnmde.com
dt6.clnmde.com
eb2.3lift.com
fonts.googleapis.com
fonts.gstatic.com
g.ezoic.net
g2.gumgum.com
go.ezodn.com
go.ezoic.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gum.criteo.com
i.liadm.com
i6.liadm.com
ib.adnxs.com
id5-sync.com
image2.pubmatic.com
lg3.media.net
loadm.exelator.com
match.adsrvr.org
match.prod.bidr.io
match.sharethrough.com
match.sync.ad.cpe.dotomi.com
mug.criteo.com
navvy.media.net
onetag-sys.com
pagead2.googlesyndication.com
partners.tremorhub.com
pixel-sync.sitescout.com
pixel.advertising.com
pixel.onaudience.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.tapad.com
public-prod-dspcookiematching.dmxleo.com
pulsepoint-match.dotomi.com
px.owneriq.net
pxlclnmdecom-a.akamaihd.net
qsearch-a.akamaihd.net
red.erne.co
res-a.akamaihd.net
rtb-csync.smartadserver.com
rtb.gumgum.com
rtb2-useast.e-volution.ai
rules.quantcount.com
s.amazon-adsystem.com
s0.2mdn.net
secure.quantserve.com
securepubads.g.doubleclick.net
sm.rtb.mts.ru
sync.colossusssp.com
sync.crwdcntrl.net
sync.mathtag.com
sync.search.spotxchange.com
sync.teads.tv
tech.rtb.mts.ru
tpc.googlesyndication.com
tracking.m6r.eu
trc.taboola.com
ups.analytics.yahoo.com
www.billofsale-form.com
www.google-analytics.com
www.google.com
www.googletagservices.com
x.bidswitch.net
blank
104.111.242.245
104.111.242.53
104.90.192.189
142.250.185.130
142.250.185.162
158.69.224.51
174.137.133.49
178.250.0.157
18.158.98.109
18.159.175.104
18.198.69.109
18.237.96.144
185.29.135.234
185.33.220.242
185.64.190.80
185.86.138.114
185.94.180.125
193.0.160.128
198.148.27.133
198.148.27.139
199.232.137.44
2.16.186.43
2.16.186.67
2.17.123.80
2.18.232.130
2.18.234.21
2.18.235.93
213.87.44.207
216.58.212.162
217.66.147.167
2600:1f18:42df:3a01:6221:c1c3:43e5:87c9
2600:1f18:444a:4602:c18d:4a5:dcb1:ed3e
2600:1f18:612b:4216:b3d7:e742:13a8:bd05
2600:9000:206e:7600:6:44e3:f8c0:93a1
2600:9000:20eb:d200:2:cb38:840:93a1
2606:4700:3035::6815:4c02
2606:4700:3035::ac43:bf24
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2a00:1450:4001:802::200a
2a00:1450:4001:803::2006
2a00:1450:4001:808::2002
2a00:1450:4001:809::2003
2a00:1450:4001:809::2004
2a00:1450:4001:80f::2002
2a00:1450:4001:812::2001
2a00:1450:4001:813::2001
2a00:1450:4001:827::200e
2a00:1450:4001:828::2002
2a00:1450:4001:829::2002
2a00:1450:4001:829::2003
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:831::200e
2a02:2638:1::13
2a02:fa8:8806:12::1460
2a02:fa8:8806:16::1400
3.123.191.65
3.126.56.137
3.126.63.176
34.102.149.62
34.120.25.144
34.253.109.165
35.156.158.150
35.157.224.42
35.158.176.66
35.190.113.31
35.212.101.174
35.227.248.159
51.210.112.236
51.89.7.199
51.89.9.253
52.17.151.21
52.200.32.3
52.30.95.9
52.49.40.147
54.171.104.170
54.194.104.251
54.239.17.112
54.84.90.110
66.155.71.25
69.173.144.138
72.251.244.140
76.223.111.131
88.214.193.99
00a7f30cba5ffdca996801a316a2dd4d9a484c22240e32e4e302a2bfc16e1551
01d4dd3082ee2fa86ca800af378341f54e4980badbe1448ffd39d0e3bc98a7f9
0414d0221112224b4c926de91a6e316f9d9aba685aa8b05fd0654848d8fcdf55
0665f5f3dfc038e410e2f0004a1a5ff6d2d91f392dd32208606eb8ff51195172
06c572e99c878362d40d1f358efdfe400ae1310f35cf22174dcdd5db022dd810
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
094c1111eeb737673d376e2598c9abfad2c1dadeab91522940bbf5d2ff512a72
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
0f563769bc10d7f4f9daad8c0992d4749482a80ad5bafd4fda3024655a108aa9
10d4b728888654e0b85c706a9310b551087d3321fb8ebfff147d07b13fa73bf0
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1a93848c085efc9f585f788e97acaccd8e4b19ea4b81e1b82c72900a53d233a3
1b113cf7d5e8230f2c635ef644ee8ab1533228b80b42d953bc6ca10ec2d2a8cf
1c5ad2fd42dffdf04a0f1d757c1cccb4d840218d7ecada79d6cc9db33ca40319
1d6f7818a09adfc9c11ff7110eb866179ef9d36a3625cd1c02e23292d315daaa
1e4c2413edbe2669464882c4c964b8fd5efa49592594c175a7fd21fa3a565a3b
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4
202bd56541955467d5f146d2327d07cf24d15c1a4cec190b4422e0b05e6aa521
222be95c7ff40d94b726ac2746b9f466db3b60d26265d13d0c2b72eb9cd78774
23c79bb552706be2ca97bdb259921e3269a5263326b147676c2f7909a45b58c9
27e7b832c635b63fa25125efa6d44dd2f6d89210c5fa8dbab63d2adb828fcd69
2a0cdabe2126b0e6f598bd087b4a83333c9d074c21d396bfe83b9f097088f34c
2a354649f57a81405daccfd6b5785da5f73ba638f2db591992cb7b739dac3135
2b2016f58510908bc9ef7f3a931ace0d37f779f53412550b755a813fedcf1288
2b258af03c5ea1ab8e9dae28c94b2081036b71bf2949810780ba628607001ff5
2bf593112504d6cf7ef713e8648777ba85e0cf0fe4930933960d83ce041b19dc
2c16267b73be934e47fa59b248a66488479092eef5d06d02977630f01b6015d6
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2d332aebd18170d0625679e60cba044e5fd1ddcbc6fd9bcbeaec4bca0d0253ec
2ecd439062761adb903783ef159ab195a150909cfa769f2efe7c70feefddab84
2efc3a95d076f2d04c5928c0ad698b7c61cc302d6f6e79e9643cd3722f7becc2
326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
32b2fbe18c177f7eed99b4ab51fb875e4ea80fd7731b27be9cf6391b9e273fad
34e9a619897b9223115c6588f352612268c90c3d83990829768973759b0d1a6e
35b36dbd58d268f33b369270a18659c08888b4f41c49eeca07c3f87f210154a4
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
385010b2baf8e0770b72bda5e96434d98bb716cfe29968e27a8eb51ee4ffde68
3a4e4fabacb0f91e3f1ead1b56d8ea8b20105640718307950f5491d2a0ad9a34
3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
484d7e7e3fb0829086a0228660693a28cab169e45be6ee1a16e39522551cfef9
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d3a8098f56d6b35db597d7bc9aeac3e5952a19a34126a12fa71f9c1baba0a4d
4daaedf2684f7f848abb29ad5a01cf685ad51206a14f73a3039f066897a64cf6
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
508a8b73dfefe6e9998cca8a66aef5f7b9b5a8b24b35ae0e6e8a02f37d4a2c93
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
586929a8b177baed0450109ab7696a56540fca0011ebaffaf63f58138e0b588a
58bd47f3f007b720189b832527c45ca568eba4917e32863f85a8f4122766b4b2
59cb29c5ae0173aefe10cf4fda280b5da604c342c7067ae69e49bfa8d5340c39
5a9c9d50d1493dbba6bdf41d6057f558f54a72aa014d70adfb4f37c95a44b2c7
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
6039cdb2c8028b73ddb9d711e7eb22834a8e11ba865283a7ed2fd2c75a401040
629f717d732e824cb630905dd81a15f1abca9908dce0d23092a89792c71f5fde
661cbae1050193b339c2f4753348eee3b11a0fe3c8c6b3954426b7cf347cabd0
663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707
673db1ad7faccdcc0c48a476fa3ad4e5d626e2cc5408de5d08fc39cd2eddcaa8
6bac92cdf0320b807e091bc516aea9b32055fffae574c236255bc8b36e106bb4
6de0868ae6b9e34e8f3eea38c576415bf3cc7a73f2c2e1fd68d58efdd5145c2a
6f57fd658644f23df86a2b6859fb3a01831bc41d99c9cb6a38ecf0641d89a722
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7a516874d943ea432dd6503893eaac720d725da5e966910e2bb36456149237f8
7a6ac6e588a725241e6f43feaad46fb36de9682576f5f29c570edc3ec5247477
7aa8f89d9629c52abf1948b041e78560978a7f601876aa634852f0b2e58cbcf9
7c4b0bea8e1d3a421f9e3f83c220206e002e828dc48c713cdc00f60638a62575
890b0403f7de1272c790ca332a61e69c6e57127aee8c33b51069a02d5fc8dff2
8b936a0e76b2601b12209208315d91de3529f5c638c2bfc556ac3e2e9ca52b0f
8c3191ba75f7a27d0acdb3596e4fbd009e6d7230c40021c8ca8ea946e2d2c1a8
8d9cd89e3cdbcc08f95fea442b3ce366958ba30104d678e9604126e5fd2565d8
8f474ee201e0adf1065e3218e655cd8de2b72c05c4925980de64c4d03cc96d29
95e53ac1aeaa2243bb6dba0e5cfb3f7335cea1c895e22a96aee668bd9685e5e4
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
982d9a8b1fdb1c0cda2a6aec453aa4d732e50ec3eb04fdb8a5cd32972629b07b
98d453d14213adc82358775170098980cfdeab09e53543d0273924ad13cf77ec
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9d391cff26c4263fb63bd1ec57cb0cbd9c9693a4e7f6c8451d073438f2a6bd6e
9fdb19a71e00bb21dfedda32adce5776cf86de33a1b4b2aebafdbd6f94cebc88
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1fb72b70ca195cd74873d1ef1270da18aa6d8c7721295f7d069434cfbb28b8c
a33b771d3b724d60169aa2bbcf1b92dd1ebd24c1a9f83e9a0d51532531aa9f45
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a51b6c9c02a24f8f7d1f85ed85fe49a07232bcfcc176b85ff1a27469f7736b26
a5e762276ffd20732a10037842bac383dc64a7b230ab1f48f2a0ff7406b8b9c8
a615849237c0ce94e73fc69d86e5f9c58bdaca8d9756a5ff4c88fa86b14e6177
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a73ecc47860fb648aa30a59b9f2673e63e49498fae4a2ec2223a19a15e012a58
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c
ac054159a85ddee2e265bc0a517304e773e8c8db653af949bab52dec5e2a1ed9
ae49854b995c21d9416af58e4f4f666041c14421b1cdf6a136078b9a19ad8e95
ae4de0f52961d7e5fd8fb8aa6df78cb9403d3a924ac9419a81f1f27a639277e3
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b440fd42fd5a54e1b252731deca9cc86604bee6ffa99281f5874c3476eb17eae
b44eb85c6d5c5c01e075166a2ee52630b0b23ae43db3b2c4fe42ffc4e110cf2a
b794ad42af27681a525c1877fb6d8c2fcbd2476be61ffba0f9b082607cf84edf
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c4097db096b40a4c65ebda1889a5c68f17c046139fed626bdced56c5a23eddf0
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
c7ef45a5279928065811180beb6addf5f3dc68c44d4183c4e5aa8cc348f0f3eb
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cabbde8502a6598896a3c812c89ecd99ecfb3e9ca68f632c8c9b3f2a7f6e0046
cc6bab21c939bcb6b4020b9afef6dcc9aa1a2b3b658c30aa3210a2a01ef563bf
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5
d2641613956457a058550707409ced955499e181d4756077e11a0fb1952fbf23
d5b724b7fcc373e0d4b583817d46310f7c5d92c59209d183d24f0b27ae119cf8
d5d4535cc978de1c946554320f48b5b816ebe04e7de3408c9affccb277625138
d976d08f7f80de76d1851904b20c2e6ebbcf18d15e1e421f3d2763363b619940
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc
e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234
e2f126a8957c32db99e94d1bf7c9ed09fcd38ba99bd632ebd048f01f9c5f9c9b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb
e8c2e4d6ab0ad2f055a6cc3c777d31531e665758db5ca815f2613afad72f7088
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3147680701c3bfe6cd9142a9f38cc1415108bd7edaafdba1af2efd664205e28
f377b759aac40c25cc53ca008840e474260854a7f18be7473369b65f16bff5b4
f54b54661acbf5912bc4bbfd9b3c52101f51a670d08053652eb4f7cbd69023f4
f9ceb55dc61f4a59d76a175754dd840f84a3d4e5e3b4797690ecea8fa8bf89cf

www.billofsale-form.com Open in urlscan Pro 2606:4700:3035::ac43:bf24 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

226 Requests

100 %HTTPS

31 %IPv6

62 Domains

87 Subdomains

66 IPs

8 Countries

1844 kBTransfer

4443 kBSize

11 Cookies

6 Outgoing links

Page URL History

Redirected requests

226 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.billofsale-form.com Open in urlscan Pro
2606:4700:3035::ac43:bf24 Public Scan

Screenshot
Live screenshot

Full Image

226
Requests

100 %
HTTPS

31 %
IPv6

62
Domains

87
Subdomains

66
IPs

8
Countries

1844 kB
Transfer

4443 kB
Size

11
Cookies

226 HTTP transactions
3 data transactions