secretmsg.xyz Open in urlscan Pro
185.214.124.198 Public Scan

Software

cafe /

Resource Hash

33020ab78c87ad0290d60e734e7c530e718cd7d3a42aa15c67961de08b55341f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
Origin: https://secretmsg.xyz
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:44 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51344
x-xss-protection: 0
server: cafe
etag: 10337575063586280768
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
expires: Sat, 10 Feb 2024 17:22:44 GMT

GET
H2 200 loader_img.gif
secretmsg.xyz/images/ 44 KB
44 KB 53ms
52ms Image
image/gif 185.214.124.198
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secretmsg.xyz/images/loader_img.gif

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.214.124.198 Singapore, Singapore, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

ba67f5cbb26d1c913527475815f0c8d4c4519b092a7544f015cc021360240275

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:43 GMT
content-security-policy: upgrade-insecure-requests
last-modified: Mon, 07 Nov 2022 19:08:31 GMT
server: LiteSpeed
etag: "b15c-636957af-6670139c898da139;;;"
content-type: image/gif
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
content-length: 45404
expires: Sat, 17 Feb 2024 17:22:43 GMT

GET
H2 200 secret-message-logo.png
secretmsg.xyz/images/ 7 KB
7 KB 17ms
16ms Image
image/png 185.214.124.198
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secretmsg.xyz/images/secret-message-logo.png

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.214.124.198 Singapore, Singapore, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

3e0b73d79786b75763ed5a6376cf64a27000d511da5a470fc96e04386d6769ab

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:43 GMT
content-security-policy: upgrade-insecure-requests
last-modified: Thu, 26 Jan 2023 19:17:57 GMT
server: LiteSpeed
etag: "1b9a-63d2d1e5-3cbf2a20a3fa9970;;;"
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
content-length: 7066
expires: Sat, 17 Feb 2024 17:22:43 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/ 88 KB
28 KB 365ms
25ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1890909
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27990
last-modified: Fri, 26 Aug 2022 18:34:13 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "63091225-6d56"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CyQFSHvYC8cMAIbMeb5oylhdNokn%2BftghkgUv4OZ4SpDo6nMPEwiBJO3S7UUF0Uu6eiMuFHBCOsOceFgMROtf5UvkE%2BcGOZqfGT0xdAP93ISCdh4%2Fu30Bm2kLXAa0%2B3XYoyFLiYR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 853609320b053e02-SIN
expires: Thu, 30 Jan 2025 17:22:44 GMT

GET
H2 200 custom.js Show response
secretmsg.xyz/js/ 9 KB
2 KB 17ms
15ms Script
application/x-javascript 185.214.124.198
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://secretmsg.xyz/js/custom.js?v5

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.214.124.198 Singapore, Singapore, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

3a4481a3ddb09d8abef5091ac1d8fadd83ec5afe2ff146ec32be8bfcec5ba1b4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:43 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
last-modified: Sat, 04 Nov 2023 20:46:02 GMT
server: LiteSpeed
etag: "24d4-6546ad8a-3849d9baa50bf00a;br"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
content-length: 2309
expires: Sat, 17 Feb 2024 17:22:43 GMT

GET
H2 200 icomoon.ttf
secretmsg.xyz/css/fonts/ 6 KB
4 KB 17ms
17ms Font
application/x-font-ttf 185.214.124.198
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://secretmsg.xyz/css/fonts/icomoon.ttf?cu8j5t

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/css/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.214.124.198 Singapore, Singapore, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

3d3169393acc66fdc119e786db90ed44c0c67c07d50cd2c1e28eee1965fd980c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://secretmsg.xyz/css/fonts/fonts.css
Origin: https://secretmsg.xyz
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:43 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
last-modified: Mon, 07 Nov 2022 19:08:27 GMT
server: LiteSpeed
etag: "17a8-636957ab-ff176a3b67433b26;br"
vary: Accept-Encoding
content-type: application/x-font-ttf
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
content-length: 3882
expires: Sat, 17 Feb 2024 17:22:43 GMT

POST
H2 200 ajax.php Show response
secretmsg.xyz/ajax/ 39 B
110 B 18ms
18ms XHR
text/html 185.214.124.198
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://secretmsg.xyz/ajax/ajax.php

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.214.124.198 Singapore, Singapore, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed / PHP/8.2.5

Resource Hash

4e690b732299f41bf6d587145ec91940bf680ad2d1ac6c986905d48170315462

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Accept: */*
Referer: https://secretmsg.xyz/
X-Requested-With: XMLHttpRequest
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:44 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
server: LiteSpeed
x-powered-by: PHP/8.2.5
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate
platform: hostinger
content-length: 43
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 179 KB
65 KB 27ms
26ms Script
application/javascript 64.233.170.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-247265906-1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3J7RSVDGR0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sg-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

bccf147207f0b91b655a41710a8dcdab0aa9ca5a49b5906ca783c0ce764e7b3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66710
x-xss-protection: 0
last-modified: Sat, 10 Feb 2024 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 10 Feb 2024 17:22:44 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
161 B 374ms
27ms Ping
text/plain 142.251.175.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-3J7RSVDGR0&gtm=45je4270v895896798za200&_p=1707585763871&gcd=13l3l3l3l1&npa=0&dma=0&cid=1960488337.1707585764&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1707585764&sct=1&seg=0&dl=https%3A%2F%2Fsecretmsg.xyz%2F&dt=Secret%20Message%20link%202024%20for%20friends%20to%20receive%20anonymous%20messages&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1431
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3J7RSVDGR0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.175.101 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: sh-in-f101.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:44 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secretmsg.xyz
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/ 406 KB
138 KB 394ms
58ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2462751652998210

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a872ea8db254f402bac41ae5ceacb30241a6ee24f797bcd032d18067f3d08d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:44 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 140873
x-xss-protection: 0
server: cafe
etag: 15856225638710865566
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:22:44 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240207/r20190131/ Frame 4BC8 9 KB
5 KB 373ms
20ms Document
text/html 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240207/r20190131/zrt_lookup_fy2021.html?hello=world

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2462751652998210

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

age: 80697
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 18:57:47 GMT
etag: 3890843268177463596
expires: Fri, 23 Feb 2024 18:57:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 299ms
26ms Script
text/javascript 142.251.175.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-247265906-1&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.175.101 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

sh-in-f101.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 10 Feb 2024 16:29:10 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3214
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sat, 10 Feb 2024 18:29:10 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
91 B 14ms
13ms XHR
text/plain 142.251.175.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1154613952&t=pageview&_s=1&dl=https%3A%2F%2Fsecretmsg.xyz%2F&ul=en-us&de=UTF-8&dt=Secret%20Message%20link%202024%20for%20friends%20to%20receive%20anonymous%20messages&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=959595897&gjid=1551673411&cid=1960488337.1707585764&tid=UA-247265906-1&_gid=1100264873.1707585765&_r=1&gtm=457e4270z8895896798za200&gcd=13l3l3l3l1&dma=0&jsscut=1&z=1794527919

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.175.101 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

sh-in-f101.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secretmsg.xyz/
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:44 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secretmsg.xyz
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 127B 464 KB
101 KB 594ms
593ms Document
text/html 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&adk=1812271804&adf=3025194257&lmt=1707585764&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=260x1080_l%7C260x1080_r&format=0x0&url=https%3A%2F%2Fsecretmsg.xyz%2F&pra=5&wgl=1&easpi=1&asro=0&aslmt=0.4&asamt=-1&asefa=1&aseiel=1~2~4~6~8&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764327&bpp=4&bdt=514&idt=429&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2334593397714&frm=20&pv=2&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=453

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

24f17876b75f231a65fc5c15076287f17a6cf24e5a026015b7b47028f238918c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 103480
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Feb 2024 17:22:45 GMT
expires: Sat, 10 Feb 2024 17:22:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E51F 31 KB
13 KB 389ms
388ms Document
text/html 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e5bb4042cea39ce540ec8b23698138ccb3b5b7de6b2abf746e05a89f62d1bb84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 12687
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Feb 2024 17:22:45 GMT
expires: Sat, 10 Feb 2024 17:22:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 36BA 88 KB
39 KB 340ms
339ms Document
text/html 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=50&slotname=3777455338&adk=1492855027&adf=1801062927&pi=t.ma~as.3777455338&w=320&lmt=1707585764&format=320x50&url=https%3A%2F%2Fsecretmsg.xyz%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764333&bpp=1&bdt=521&idt=470&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C400x280&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=1150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfE%7C&abl=CF&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=473

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f999e38e66fe89ff57625369e5c6d02eb9debe0cc77e82c18f888bdc95e04b03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 40141
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Feb 2024 17:22:45 GMT
expires: Sat, 10 Feb 2024 17:22:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 36BA 42 B
173 B 59ms
58ms Image
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C0VfDDtCZLq1Z4a3Er5cQwUUhVjAgxIP-HSPo9DLdqdCdn3mHupvGq3BlngpCN70OrwhM3vdOCJzx0z_bMaN2oIsKMOBoZ9J1IZITaQKuAXSwkRyA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=50&slotname=3777455338&adk=1492855027&adf=1801062927&pi=t.ma~as.3777455338&w=320&lmt=1707585764&format=320x50&url=https%3A%2F%2Fsecretmsg.xyz%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764333&bpp=1&bdt=521&idt=470&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C400x280&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=1150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfE%7C&abl=CF&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=473

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 36BA 3 KB
1 KB 369ms
25ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 16:41:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2468
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 16:41:37 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 36BA 20 KB
8 KB 366ms
24ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 14:45:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9436
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 14:45:29 GMT

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 36BA 203 KB
61 KB 18ms
18ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

23d11567502488b4905a85c8ce6a03d6ce539620fa559b8f24a2a95b292a2c6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 16:26:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3371
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62553
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:26:34 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2CDB 624 B
509 B 23ms
23ms Document
text/html 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYwtWEhAIwAQ&v=APEucNV6WzR_q7pduJmmof_dSO-7Vjw6YX3lkJ4QppEUo8f46qbv1E5XVxfy1P-ipjEtAT8iIN0fPwYu5ufnJEXHzlH9FYO0gw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=50&slotname=3777455338&adk=1492855027&adf=1801062927&pi=t.ma~as.3777455338&w=320&lmt=1707585764&format=320x50&url=https%3A%2F%2Fsecretmsg.xyz%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764333&bpp=1&bdt=521&idt=470&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C400x280&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=640&ady=1150&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfE%7C&abl=CF&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=473
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Feb 2024 17:22:45 GMT
expires: Sat, 10 Feb 2024 17:22:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/ Frame 36BA 23 KB
9 KB 22ms
21ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 22:24:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68323
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 3610546441309021303
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 22:24:02 GMT

GET
H2 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/ Frame 36BA 8 KB
3 KB 22ms
21ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/omrhp_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 22:03:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69553
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 22:03:32 GMT

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 36BA 0
0 118ms
69ms Fetch
image/gif 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvv8HnEJ1VTjZXrWYIX-NEbYzuPIGyzJ_I2ZXcxEnjcw-LkFJpSxT5diWzEE9zq85TleHyT4tfWg79wlPbPCOPCL-rK_yqHPtWNKIg98IaFSnSAvEjMoMg-UhlKT_R9UOg6sCh6AXmJwPvIoNgIpq3XwEKSN9dLkTV0TyyaPMKgGLL0Qhbot_y0ms8mE03jAw78wXqGX1J7N2Q2_ownlbcRuPxU9_L76iXoWg2CUVcksrCgtqbVwc0AjsD_JZR5Kd-fam6hshO-b7herS8HL-hJxeTvCrIKf1A6uqqY5k-9pGxqDA_lu19ODsMtngbnUjZBNfOi0t9MpTNNM-jMt9_OQg4nk2CJP1f5YSUd-pGEQNL7tLPggCKPpMPj3HKQrp1YKUrZsJeeDyk4tcz-DrXlghZRXtBl6luZa2AiOCbAYEFO-vOWkN7j0pCM9oZEVvFsXuhoCkejz_4dBDYb3C_44IOQyjvbQh-CelGn5FWcPQFA_luxsFQSATTERWcnJ1A3qTJ_m9QbSpbGpT50c9TKPIhcoBP2C143OFUAM63fou3oYKWcJ_MZ21EpII5uI8SmebnYiXMfAYb2TpGSLL19p341LpsaqNKKA1Md6Zp_9tIPOGEx-jdB0NPYi4P1Bhg1eKR9tYnW1DjnRam5cBY5UajIY2fSydkudRqiQ6TNtFR8-kCF6Xk46lSN1xWImwSdf1Drs5FbGEHDthESc9TaLrid3-sFTLkzTarQdpuG3zwg9GAX0LKfE3s3mYzPy8ltrvzcXbT-Qme7N39tTAfB4T7pphOgRgTaayoRcZsY1Bl6LtL3B2hYEKl2qR3rVfHDolfFmKNcT--w858yGuu_2KAiImMJ8xHkRZu91Rb7VTPj9uQ3ujGfIAXESJVOPJIvV9gO1aIstpclePL0t216wT4iDi9EkRvs5ojCFNbDooFmn7K7Vzms6r1Hg90VYVsXbWcozFfLsOirUKH5BjgtUQp3-F6eUUmNvSlGYTIsZfIdZvpzeGghtJh8NOkzTznh3fW7CLvZMMbGvNDeSIDU41s6r9EbSOpstHPcDC8znE2cLx_F3-UXlpKVRkBYCFQbfU7FTQv5u1yFXX7ot_AKIvaX4LkfK0LWi9K9ZbzU6JSOUGda5YInpdWqqzqLxV8zzWMNKulzZe4s7wBl1WqGtGRCIiDcOHrZg5ib8guoREy1jfBmMkq0nTkivy7D4F8g_cnsdJEtCK8EQKO3_RiZ7yCsrY2ovHeTEY_WKWt9gQ1El0W9oeA9R0uzqbWZ2V_2GgY-5ylNtXlaglUGQlxe8ZlztzFmHSrhkkiJsa5iyhdZM-_qfw&sai=AMfl-YSYR5P_SYNRMabjQ--OApa3eeIjrQRJgx0Lz00m4OLA767PVH1MtcRPn8XbtKnQs7Ia1oYxBgKRS_XpCtGg6MRvjoaQ8F83tDPcINjXP3xnDLk5xScf5f_aQkNEXjnZzsFzvBvPn3E7OeA-0DUrkdl2qu8yHlqa9P5UwG3qA8BaKw8oTga55PIe-W2zwjm99s8SdebyU3PUMYUgbTtWiz_-2BL7Gwmn7uaR-yFn17wK5a77Kiw3wLmCQ4KA5VsZ-vCfLqhIWC66m9BbBjzY10x7nJlKccPwEDqZG5wZyvu1AAaIHZ-T8CQaJ7yz2y5jS6MCR-ox-m0eM-9DRHqJahc7M5KLzLVrdj-HtB4JqXq78Ttvee_4kkEGOpTiu8UmRK4pmztarDvqZldKTVezkOHwvMHW0u5kZ-wANQk01_p4uyupgPG4rmAzRIAZ01Llod5v39Ue7Ac5IZyiyeZoF516vVCg3ATgkPyAMdA2cpHV_VKsPvToiP_XyoJdjMVJmusUOUi1b2P-CQ&sig=Cg0ArKJSzPqdyt5X8cfkEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9zaG9waWZ5LmNvbQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20240207.96695&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 10 Feb 2024 17:22:45 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:22:45 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 36BA 41 KB
14 KB 355ms
26ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 16:38:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 89028
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Feb 2025 16:38:57 GMT

GET
H2 200 2726653330840658719
s0.2mdn.net/simgad/ Frame 36BA 100 KB
100 KB 366ms
20ms Image
image/gif 142.251.175.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/2726653330840658719

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.175.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

836afd444c2fbbc8fa62222d71918bc7737409430e5cb1f7ebabb2a6fbad7962

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Sat, 08 Feb 2025 23:16:41 GMT
date: Fri, 09 Feb 2024 23:16:41 GMT
x-content-type-options: nosniff
age: 65164
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 101889
x-xss-protection: 0
last-modified: Wed, 17 Jan 2024 08:06:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 2CDB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB2kzIpPo8CSRFxFEZRWTIU&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB2kzIpPo8CSRFxFEZRWTIU&google_cver=1&C=1

43 B
339 B

50ms
50ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB2kzIpPo8CSRFxFEZRWTIU&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYwtWEhAIwAQ&v=APEucNV6WzR_q7pduJmmof_dSO-7Vjw6YX3lkJ4QppEUo8f46qbv1E5XVxfy1P-ipjEtAT8iIN0fPwYu5ufnJEXHzlH9FYO0gw
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YDrBfULH2hbAQrSwcZC7yYDuITV0C1Fr8edqRWQmM8YMpkLFN%2BY1f2RIWo2sDn7NDU8yIaqfGn0PHD%2BOnl5N%2FpBtdeEy2xs4eXXpk3GSa%2FyCfQTQcGb0kOJGybxZF6OJn3t7vAKXf4K9sw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 853609394b2a3f5e-SIN
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oH5%2FBnRxRNg%2FS%2FJJotI9xsR0v9LuiWDYZvOLOmBBa9Rlx3qXR5rz7IGgEgIUQGaGUYeLCpkWMakmEzEAV9UVem7GQzQDZTbP3KrYVKRiBQlcBFBVJqpRLt1N98vLhbfHIO%2BjJIFhNL5J8Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEB2kzIpPo8CSRFxFEZRWTIU&google_cver=1&C=1
cache-control: no-cache
cf-ray: 853609390ac13f5e-SIN
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 2CDB
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zcew5YsFVp8AABKgABNiIQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1

43 B
734 B

34ms
34ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYwtWEhAIwAQ&v=APEucNV6WzR_q7pduJmmof_dSO-7Vjw6YX3lkJ4QppEUo8f46qbv1E5XVxfy1P-ipjEtAT8iIN0fPwYu5ufnJEXHzlH9FYO0gw
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QuEJLXh8sysTnpYiIAa7oTZEla8SLwD7Ixr5fJicsMN%2FBaeq6BBIAk0UZg6tGUK%2FuaYy1pHuC3HLcbUkras81duIH3I8QTOBTHwm7JfgVCvUYJlG12SEv1tsgdAlT%2BmXIq%2ByymRBk%2FAR0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 85360939890f019b-SIN
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 2CDB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMbhs7Os9nQX86QKNuw0XUA&google_cver=1

43 B
1 KB

68ms
66ms

Image
image/gif

103.43.90.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMbhs7Os9nQX86QKNuw0XUA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYwtWEhAIwAQ&v=APEucNV6WzR_q7pduJmmof_dSO-7Vjw6YX3lkJ4QppEUo8f46qbv1E5XVxfy1P-ipjEtAT8iIN0fPwYu5ufnJEXHzlH9FYO0gw

Protocol

Server

103.43.90.117 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
an-x-request-uuid: 23c48b5b-b357-4ce8-a14b-cfe126ef1157
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 222.164.167.113; 222.164.167.113; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMbhs7Os9nQX86QKNuw0XUA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2CDB
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D

170 B
188 B

22ms
22ms

Image
image/png

142.251.175.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D

Requested by

Protocol

Server

142.251.175.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
an-x-request-uuid: 03a5f14d-cadc-4219-aa71-d86e616254b2
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D
x-proxy-origin: 222.164.167.113; 222.164.167.113; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 693A 624 B
285 B 31ms
29ms Document
text/html 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKPuxwEQsPHS-QUYzJuahgIwAQ&v=APEucNW7fUXboISO8wdhpVzI62cToAirv1PCJY-Idqzb-uVQByZLAkj6fmZiEAUGyMNnwN2nCE_-QUMq01xOichIwsmf7UJBaQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Feb 2024 17:22:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 041F 93 KB
33 KB 27ms
25ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:22:45 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 041F 3 KB
1 KB 320ms
24ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 16:41:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2468
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 16:41:37 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 041F 20 KB
9 KB 318ms
22ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 14:45:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9436
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 14:45:29 GMT

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 041F 203 KB
61 KB 19ms
17ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

23d11567502488b4905a85c8ce6a03d6ce539620fa559b8f24a2a95b292a2c6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 16:26:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3371
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62553
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:26:34 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 041F 42 B
107 B 60ms
58ms Image
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ArjIo9jTpPEBf86Sk0vguW9nA0WpzqTW59YVePUbflBbroOU0V8ETAFQnGZHERXWVOsD8pcFF_gULfBNU0RqD-kY1SyO3eGrtDnkxOVARoLH4tnLI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 693A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB2kzIpPo8CSRFxFEZRWTIU&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB2kzIpPo8CSRFxFEZRWTIU&google_cver=1&C=1

43 B
768 B

50ms
50ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB2kzIpPo8CSRFxFEZRWTIU&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKPuxwEQsPHS-QUYzJuahgIwAQ&v=APEucNW7fUXboISO8wdhpVzI62cToAirv1PCJY-Idqzb-uVQByZLAkj6fmZiEAUGyMNnwN2nCE_-QUMq01xOichIwsmf7UJBaQ
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dRZnM9uVdZ0awrWqPPUfYyjXgNT58h71BiL1hswioGqszdJyUoFP0EYXqskkCTci%2B9FErfujrqZD6F59GsVIjRNQhthbIApVnWz2URhZQ37m%2FEx3AAitSa6t%2FKUNTaBGHhyLZOfDU6LVaQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 853609396901019b-SIN
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WpsBVSNQDZZ%2BHVoh6qVqetngmpJKpX36uRKwk0KFOeAE0rm1XSZycxdG4ZR%2FQvJZ8TIdPJg50rsoEpzHiyiXjIy6IkCetHtPCsHuGeVCjjCzOtNTjlfwGBRpmKqapmbSJI83zHY%2FzFeDAg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEB2kzIpPo8CSRFxFEZRWTIU&google_cver=1&C=1
cache-control: no-cache
cf-ray: 853609392af53f5e-SIN
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 693A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zcew5YsFVp8AABKgABNiIQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1

43 B
730 B

34ms
33ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKPuxwEQsPHS-QUYzJuahgIwAQ&v=APEucNW7fUXboISO8wdhpVzI62cToAirv1PCJY-Idqzb-uVQByZLAkj6fmZiEAUGyMNnwN2nCE_-QUMq01xOichIwsmf7UJBaQ
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wVL0WeOk7Swnf0Ey3dLMEqsHd24D34JKPzcRl8aI6H4jYeFvLHtgRhqhrz3gLMHithQyxgYz5daazFnQINJf1NXZ3tLN%2FpMHCCPV5%2FiL8MV20A2zA0GcTooKagMrKvJgBuohrMpVRw3AkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 853609399911019b-SIN
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 693A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMbhs7Os9nQX86QKNuw0XUA&google_cver=1

43 B
1 KB

42ms
42ms

Image
image/gif

103.43.90.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMbhs7Os9nQX86QKNuw0XUA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKPuxwEQsPHS-QUYzJuahgIwAQ&v=APEucNW7fUXboISO8wdhpVzI62cToAirv1PCJY-Idqzb-uVQByZLAkj6fmZiEAUGyMNnwN2nCE_-QUMq01xOichIwsmf7UJBaQ

Protocol

Server

103.43.90.117 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
an-x-request-uuid: 8e90590a-11f0-4e7f-b016-6fff2bf4ed2a
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 222.164.167.113; 222.164.167.113; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMbhs7Os9nQX86QKNuw0XUA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 693A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D

170 B
188 B

22ms
22ms

Image
image/png

142.251.175.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D

Requested by

Protocol

Server

142.251.175.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
an-x-request-uuid: 86adcf88-13ab-4c17-83d4-a827c24747e7
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D
x-proxy-origin: 222.164.167.113; 222.164.167.113; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 041F 0
58 B 66ms
65ms Ping
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2515545185943&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 041F 0
56 B 63ms
63ms Ping
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2515545185943&version=m202401290101&ct=77&x=1&cor=2312400365814632400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 041F 20 KB
14 KB 39ms
38ms Script
text/javascript 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ASp4QCIvvnhkfwMy995RZMZbf2QksJUxOgFRkiAEndqDoJTjBYcAficO-PX0OldZGrqfdPv7WshXNYnoN6rZJH4swx_oZauM8Z6PniK94gvopElaJlgjZmPExZMZuErVc6I_UJz1FS-hvCWyFyrDL9MdCg5VOrovKiil0TU8T6RDxbeO-UckMKQxLhlueV0rHGNl-hn8wx540fj69QQuuLsNjgQMtpzQ9ssK0SF5eTxQTUz64&cry=1&dbm_d=AKAmf-Aw7IqGCtxOapUl3Rdu5gmi6sEq27wx8ZVO6c60nwJHSqDnbOasOF-grFl_SX6c1HyTo4jIxXD3rm7vipQldKF7w_BtvFAuEtM7LtGU1mVkT7f0xYc5SH45qk5eN_Lm9nFzznWVhbLC29AmsdjVSmkA3KAKaSe87S1sqDJWwyJP7jRxJWSAKMJoTdsJIz7IS_anf_XYrt4LbRYokVzywGWk9WEqPwMQeETPp5va_Zpf_MGmAb1ptDHrOwtZoA7LAvlXzw_t8YjfPMrgoN2JFv1pf-Ljn5cRN4qmE9zXzdgjY8FuAJr9510DNslDAXBPuHn7hlrI6toFIn7htasveS-WPa6L13NPsGJnO_8G8O02Y_OKsqivnQLMYXy0WMfOnosYIs_O560ogiwaMcZtix45yn2vIgVMEf3_FRAy4oFzi3cwoIep3q2Tg3DGvcf1ONreWBKRsL72sz62PICluAURAGrr7S2FVHFhPGDMWPw2uUGS2EN2aM45rBp_imoBca9jWSgR2VwU9j2aNMhzKvI3me05ZeQsBlFFFMQ415fQCipGEMkrM7fYzRDL3-iTAZVDVnQj4dRuyycNm9XwhhhOiwCr-5kCLfxh1C8GX-TcQMtd26aTTQB1BdGxeeXr6OesN6bMGI6p0ceoi0d90Ozvj_9TsclxBVJkI_ZruPphLxrEP69r7kLI7rOZJ7_5bbBBbFZsPTyEvcQncp5-KDNoCTwJL4uWrOZsSPOdISgu1uosslw8EVNlR999jyDVSzfO6GB84P86nSeVzRo-2mYJospKLsBVP2ZOvWOkM0cAQK79SiWcu4OaWj_UlxEzkfD7QUyL-tGc08od28ObCqk1n0-cFgHAJZMD67kR9n7SV1ScTXh9T25SqP5bppPJpiZW22KF79bNkkYRIR1burTrbKoptdxI0pN_wQKK4SgomDILs-VSpUQimMP8lM45OKhCTciTAqrgBDsXnQGZtV4wjsUI77na8_hlpPM9gKxWHwacnKT4bzhMCUClnlSB_QKVKYJBjNBXH2Da9lU1axcnzhS3RQ9oVhWp7Dl556SQmu5mxOen9Zm6xsObZUrwhju33tdnGlbkWr1K6usaEtPn4zllS3Wg7BSDruyLN5NKSCuYwnWKVb2dFY8UfmYbyU5JVjrMXmUKQBM4yle2zKtCbECtSfeDSaVzNbILq7bQcU0UqNCm_DYWvNYwxW6eIGIFms0LgJUSprw74_PjkW7WYBUTkQXMy8pwtpW_FSgsvmkzrY26DEHAJG6k6jtRqCu7D5NI78LPU3krofTj8tnTWp-MwanNGCyZCDxJBP9Jb8mYaKXdTF5_m5-GU2ZSg79hX8sqjlGQ8g1INBQsqqKLgwczs0_1CWIoaKN2Jvunlp8Ksfsh16-IXQjHn2DdsqxKdRzoh-GCDrpIqCSoTb-hPeYSrhjQUzMK464mA-08mFV3C0srkFZhRrtShnLQCone7VYsNKfNbYKotN53DoJdu7Io_MeuMYmd7Y7E38f2-PFC_HUqo_lgLeMFZVCRySkvbN1-AQd3b25uCgkncgcssrMvOG4fIPFolV59NvDi4aT9FrO-KLknVtBmH2NNNhY7eeJFIj6jfa_OOLyj0DOv2aKg6c6ffs5MFWlKPGqilhI-N8068YAs29UDboOIv2v9706jzy2ACkGl-s8AecCiRZBHH1m3qdgCAypQGUfkNOW8dNVPHr_yJVAS19VOKw3IIWxqxiI56QTaW72Vc1_ydcHVkJsbPe2Nalh3Y5epReg0h3arMVQ-Nuds6Xze_66odoFhhFkvBHAhxPxOspm8GxYN4YWeA_oK8U1kWTELjhw4EgWxVnIPIK_MsIwDLySg066Qee00sJ8FTgZKrEmRsE43FgHmkAUOMQzoJI2g-NJxz5XQjSpL2iznN-N41_qyin60_CZlwy2ObkP_HJdOP8wwQnhBQDo0Wo56hkPyDMZdHnOU9X1FuVs5EYF9DFUfbNaP9RSxdwxWPuk3gnEtxHjqZepjvhTf6DLtVy2kjMknrV-vJy3tpt9HOqGjUepqOEd3CmdZsmY6taoMy_1JBO9stFZHSZjQ8SS5dLp7Fuq_YxeW7kU2SjtqoN5gMFTUQZYU4xEJcWD9LV7ZbaMuEDJd2DMKAW_p3JJasSKskuTKApzypDH0NLu9kTy9liYh4s5iHZTFy5l830X_1Ibvo_s3TnI_EOuawelgofSyEQJ8hSgqpaYArLJacmSxmT44HvpEk-CukWQqH8T7JUNlOH4QJ6Kq0XS8FA6Njlnvl9lGCPoLAuf_kX9RH2wyMHjVs_tOZdjgVRY9BBsYIlek1oso044_nyF3dehJJ7DJEM8l133oygddJuwrjjz7PbxlCH8GqXMm8LfzHVCt_Dl9ttN89JyvKC9xv5FRfq_KZApflTL33iTZXbLDhBSekNqyt70CI0ViNTCfuCD6x41ZM1OTnHbheq6cPiv1W1y6iJvgFe7Nt9OD5O3EvbBc_4skyx7y6432cdJ2o2ZbK7wmturKXr93LJtVi70fRBA_i0KQXZ927CieKtCiABzaA5Fby7Y1eJH773Gkl7Cuk_KNVZFV3ftabFKJsNuSymN61N6SY0Sqsf4qb0HuPmFx9AWq4y0BQoDsNqOwClNL8-r60s56mICadI8hZWSCSvTXKWhV-sKoL64lqFCks5iBoJxBEoHswyTlYmXkGy3Jtj8vl_wcZr2jtIOY0VhPHD_o7jhYytntkN4gjfMx8C1eCmgFtHFOPB9FhV9GFPSA_HtVRSPfIUzlphEu2V7Ajugt6-w9WY4QZvT0Rc6nASGhvNiWtx8-QwuaiKR__raVvdN3_U9lMFilxm9BgiNseQLIf5htLjf-9EeH1-8A9H-itI6VEznyklDfjXm0MiCTovgZ9Ij08KrQdpBj9VsMkcOCHZ1Jqn85iaQfUC3Qo5sLkX9IfjTU_TO5Rh4D6o7u8XqIzxYOEGZliWY8Y_cIfT1ZALP7lmtn5Igqv8lTnqpVDhCEFvMZPI8XQpPpONrxZDQsbQaLN3rbhu09guP_Bg1ncVdFXyYDHrR0vg6QStMxfjLnnw5KbpV00omdBy2NNeZAo5zY8jiwTZF1Mz4KhN5lzf7svSJVKnxFBlOHnCmgEtGtkgXln-fsL30-bqkVFo4_DR8AaOUJ2kKdWNzTF9OMjbejjJJF1zUMidh0fqzJZtXezoMz_8ezaCf1in8X1oJ84tra010PHURVtmQTwbVyDcmmWwRzZ6Bu9oJ3AkQvF8143eNKFJfAHcUuNJ9C_c5-ipf0meXDExKck5gDROkI6h_nU1AdHC5XH76GyyxAU4arsOBhbq7mYIE7twUs1ZXwe_1BUY1eeU6Ve9536Z33iAG2yrH-D19ASEeFOfrB95ySpdvOALPptqKGqoscofglPHKNdTruN8_hMxpkwPPtaHCSiizoAIqjFzIcEqUlYHgF_Wd9Kv5ENdaenLY_HsUOWJlhPuIMLxbTeRFtYo3_EGq33bC3KZwRSVDsY_IpmbOY4YNHpa4o8V95T7YFil_Lz9fHdI9MPAp0pBLUunZHDSNpypCKOumb2oG5Dra67QxviA9H5nIHMn6urirZ3KbWGV7Rx4IIsCh2QravQxYypkr5_hGZpHmAXRZObw_pjTtQd3bs4l5uvA8vBpr5RsBt6VBDEZrw6vB4UMVHOFpnKHI02tWIERaM-HDbmFHCRmacHP6ycyeA84t9KmFgRg7oEEkbGgbl0kGZU9ghLJJv0JE1U375IjrFh2RArFvHTQQKQlEZen8zMYiPK_8j8MVuCrB1h_9AWncaIg00FGoc-PSpNERbPl2rLgMMoP9-7i9SGhE5FujVc0plRFowStE1MhtLay8YlDJrk6ec5TpAzqfGmZE&cid=CAQSTgAvHhf_8-6RriRSJ1SKtlVRaLAV-68gmwmy6fT5UT55NGqMCnGu-T0wXxu5HLkvb8nNzdMGYKVXtY2JV5QvvWPWOX06iKSxXPPPVIOkGBgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fsecretmsg.xyz%2F&ds=l&xdt=1&iif=1&cor=2312400365814632400&adk=2124396031&idt=30&cac=0&dtd=24

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

023f84271e4c8150e734f534f67baa2a8189a5c57d0d3d6e060da9477ca6d328

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13446
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 041F 41 KB
14 KB 220ms
30ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ASp4QCIvvnhkfwMy995RZMZbf2QksJUxOgFRkiAEndqDoJTjBYcAficO-PX0OldZGrqfdPv7WshXNYnoN6rZJH4swx_oZauM8Z6PniK94gvopElaJlgjZmPExZMZuErVc6I_UJz1FS-hvCWyFyrDL9MdCg5VOrovKiil0TU8T6RDxbeO-UckMKQxLhlueV0rHGNl-hn8wx540fj69QQuuLsNjgQMtpzQ9ssK0SF5eTxQTUz64&cry=1&dbm_d=AKAmf-Aw7IqGCtxOapUl3Rdu5gmi6sEq27wx8ZVO6c60nwJHSqDnbOasOF-grFl_SX6c1HyTo4jIxXD3rm7vipQldKF7w_BtvFAuEtM7LtGU1mVkT7f0xYc5SH45qk5eN_Lm9nFzznWVhbLC29AmsdjVSmkA3KAKaSe87S1sqDJWwyJP7jRxJWSAKMJoTdsJIz7IS_anf_XYrt4LbRYokVzywGWk9WEqPwMQeETPp5va_Zpf_MGmAb1ptDHrOwtZoA7LAvlXzw_t8YjfPMrgoN2JFv1pf-Ljn5cRN4qmE9zXzdgjY8FuAJr9510DNslDAXBPuHn7hlrI6toFIn7htasveS-WPa6L13NPsGJnO_8G8O02Y_OKsqivnQLMYXy0WMfOnosYIs_O560ogiwaMcZtix45yn2vIgVMEf3_FRAy4oFzi3cwoIep3q2Tg3DGvcf1ONreWBKRsL72sz62PICluAURAGrr7S2FVHFhPGDMWPw2uUGS2EN2aM45rBp_imoBca9jWSgR2VwU9j2aNMhzKvI3me05ZeQsBlFFFMQ415fQCipGEMkrM7fYzRDL3-iTAZVDVnQj4dRuyycNm9XwhhhOiwCr-5kCLfxh1C8GX-TcQMtd26aTTQB1BdGxeeXr6OesN6bMGI6p0ceoi0d90Ozvj_9TsclxBVJkI_ZruPphLxrEP69r7kLI7rOZJ7_5bbBBbFZsPTyEvcQncp5-KDNoCTwJL4uWrOZsSPOdISgu1uosslw8EVNlR999jyDVSzfO6GB84P86nSeVzRo-2mYJospKLsBVP2ZOvWOkM0cAQK79SiWcu4OaWj_UlxEzkfD7QUyL-tGc08od28ObCqk1n0-cFgHAJZMD67kR9n7SV1ScTXh9T25SqP5bppPJpiZW22KF79bNkkYRIR1burTrbKoptdxI0pN_wQKK4SgomDILs-VSpUQimMP8lM45OKhCTciTAqrgBDsXnQGZtV4wjsUI77na8_hlpPM9gKxWHwacnKT4bzhMCUClnlSB_QKVKYJBjNBXH2Da9lU1axcnzhS3RQ9oVhWp7Dl556SQmu5mxOen9Zm6xsObZUrwhju33tdnGlbkWr1K6usaEtPn4zllS3Wg7BSDruyLN5NKSCuYwnWKVb2dFY8UfmYbyU5JVjrMXmUKQBM4yle2zKtCbECtSfeDSaVzNbILq7bQcU0UqNCm_DYWvNYwxW6eIGIFms0LgJUSprw74_PjkW7WYBUTkQXMy8pwtpW_FSgsvmkzrY26DEHAJG6k6jtRqCu7D5NI78LPU3krofTj8tnTWp-MwanNGCyZCDxJBP9Jb8mYaKXdTF5_m5-GU2ZSg79hX8sqjlGQ8g1INBQsqqKLgwczs0_1CWIoaKN2Jvunlp8Ksfsh16-IXQjHn2DdsqxKdRzoh-GCDrpIqCSoTb-hPeYSrhjQUzMK464mA-08mFV3C0srkFZhRrtShnLQCone7VYsNKfNbYKotN53DoJdu7Io_MeuMYmd7Y7E38f2-PFC_HUqo_lgLeMFZVCRySkvbN1-AQd3b25uCgkncgcssrMvOG4fIPFolV59NvDi4aT9FrO-KLknVtBmH2NNNhY7eeJFIj6jfa_OOLyj0DOv2aKg6c6ffs5MFWlKPGqilhI-N8068YAs29UDboOIv2v9706jzy2ACkGl-s8AecCiRZBHH1m3qdgCAypQGUfkNOW8dNVPHr_yJVAS19VOKw3IIWxqxiI56QTaW72Vc1_ydcHVkJsbPe2Nalh3Y5epReg0h3arMVQ-Nuds6Xze_66odoFhhFkvBHAhxPxOspm8GxYN4YWeA_oK8U1kWTELjhw4EgWxVnIPIK_MsIwDLySg066Qee00sJ8FTgZKrEmRsE43FgHmkAUOMQzoJI2g-NJxz5XQjSpL2iznN-N41_qyin60_CZlwy2ObkP_HJdOP8wwQnhBQDo0Wo56hkPyDMZdHnOU9X1FuVs5EYF9DFUfbNaP9RSxdwxWPuk3gnEtxHjqZepjvhTf6DLtVy2kjMknrV-vJy3tpt9HOqGjUepqOEd3CmdZsmY6taoMy_1JBO9stFZHSZjQ8SS5dLp7Fuq_YxeW7kU2SjtqoN5gMFTUQZYU4xEJcWD9LV7ZbaMuEDJd2DMKAW_p3JJasSKskuTKApzypDH0NLu9kTy9liYh4s5iHZTFy5l830X_1Ibvo_s3TnI_EOuawelgofSyEQJ8hSgqpaYArLJacmSxmT44HvpEk-CukWQqH8T7JUNlOH4QJ6Kq0XS8FA6Njlnvl9lGCPoLAuf_kX9RH2wyMHjVs_tOZdjgVRY9BBsYIlek1oso044_nyF3dehJJ7DJEM8l133oygddJuwrjjz7PbxlCH8GqXMm8LfzHVCt_Dl9ttN89JyvKC9xv5FRfq_KZApflTL33iTZXbLDhBSekNqyt70CI0ViNTCfuCD6x41ZM1OTnHbheq6cPiv1W1y6iJvgFe7Nt9OD5O3EvbBc_4skyx7y6432cdJ2o2ZbK7wmturKXr93LJtVi70fRBA_i0KQXZ927CieKtCiABzaA5Fby7Y1eJH773Gkl7Cuk_KNVZFV3ftabFKJsNuSymN61N6SY0Sqsf4qb0HuPmFx9AWq4y0BQoDsNqOwClNL8-r60s56mICadI8hZWSCSvTXKWhV-sKoL64lqFCks5iBoJxBEoHswyTlYmXkGy3Jtj8vl_wcZr2jtIOY0VhPHD_o7jhYytntkN4gjfMx8C1eCmgFtHFOPB9FhV9GFPSA_HtVRSPfIUzlphEu2V7Ajugt6-w9WY4QZvT0Rc6nASGhvNiWtx8-QwuaiKR__raVvdN3_U9lMFilxm9BgiNseQLIf5htLjf-9EeH1-8A9H-itI6VEznyklDfjXm0MiCTovgZ9Ij08KrQdpBj9VsMkcOCHZ1Jqn85iaQfUC3Qo5sLkX9IfjTU_TO5Rh4D6o7u8XqIzxYOEGZliWY8Y_cIfT1ZALP7lmtn5Igqv8lTnqpVDhCEFvMZPI8XQpPpONrxZDQsbQaLN3rbhu09guP_Bg1ncVdFXyYDHrR0vg6QStMxfjLnnw5KbpV00omdBy2NNeZAo5zY8jiwTZF1Mz4KhN5lzf7svSJVKnxFBlOHnCmgEtGtkgXln-fsL30-bqkVFo4_DR8AaOUJ2kKdWNzTF9OMjbejjJJF1zUMidh0fqzJZtXezoMz_8ezaCf1in8X1oJ84tra010PHURVtmQTwbVyDcmmWwRzZ6Bu9oJ3AkQvF8143eNKFJfAHcUuNJ9C_c5-ipf0meXDExKck5gDROkI6h_nU1AdHC5XH76GyyxAU4arsOBhbq7mYIE7twUs1ZXwe_1BUY1eeU6Ve9536Z33iAG2yrH-D19ASEeFOfrB95ySpdvOALPptqKGqoscofglPHKNdTruN8_hMxpkwPPtaHCSiizoAIqjFzIcEqUlYHgF_Wd9Kv5ENdaenLY_HsUOWJlhPuIMLxbTeRFtYo3_EGq33bC3KZwRSVDsY_IpmbOY4YNHpa4o8V95T7YFil_Lz9fHdI9MPAp0pBLUunZHDSNpypCKOumb2oG5Dra67QxviA9H5nIHMn6urirZ3KbWGV7Rx4IIsCh2QravQxYypkr5_hGZpHmAXRZObw_pjTtQd3bs4l5uvA8vBpr5RsBt6VBDEZrw6vB4UMVHOFpnKHI02tWIERaM-HDbmFHCRmacHP6ycyeA84t9KmFgRg7oEEkbGgbl0kGZU9ghLJJv0JE1U375IjrFh2RArFvHTQQKQlEZen8zMYiPK_8j8MVuCrB1h_9AWncaIg00FGoc-PSpNERbPl2rLgMMoP9-7i9SGhE5FujVc0plRFowStE1MhtLay8YlDJrk6ec5TpAzqfGmZE&cid=CAQSTgAvHhf_8-6RriRSJ1SKtlVRaLAV-68gmwmy6fT5UT55NGqMCnGu-T0wXxu5HLkvb8nNzdMGYKVXtY2JV5QvvWPWOX06iKSxXPPPVIOkGBgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fsecretmsg.xyz%2F&ds=l&xdt=1&iif=1&cor=2312400365814632400&adk=2124396031&idt=30&cac=0&dtd=24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 16:38:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 89028
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Feb 2025 16:38:57 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwNzU4NTc2NTI4OTUxNgogIHNlcnZlcl9pcDogMTYxMzAyMDY3CiAgcHJvY2Vzc19pZDogMTY2MTcwNjQzMgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxNDE1ODc4...
ad.doubleclick.net/ddm/activity/ Frame 041F 0
596 B 70ms
69ms Image
image/png 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwNzU4NTc2NTI4OTUxNgogIHNlcnZlcl9pcDogMTYxMzAyMDY3CiAgcHJvY2Vzc19pZDogMTY2MTcwNjQzMgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxNDE1ODc4MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vZGVsaXZlcm9vLmNvbS5zZyIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxNTk1MDg3Njg5OTgwNjEwMDcxMQpkZWJ1Z19rZXk6IDU1ODkwNDc2NDYzNjUzMzY4MTcKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDI0LTAyLTEwIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTQxNTg3ODMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzODY4Njg5OTUKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDE1OTcyOTA2NzIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMjA5NjI0MzA4NTAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA1NDk4ODMzNDAKICB9Cn0KYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVsaXZlcm9vLmNvbS5zZyIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNAo

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:45 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0xe8069ab73fac53160000000000000000","13":"0xd1d7b687f38f17ba0000000000000000","14":"0x558d68d33d547cc50000000000000000","15":"0x38af7c5ed87372370000000000000000"},"debug_key":"5589047646365336817","debug_reporting":true,"destination":"https://deliveroo.com.sg","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["14158783"]},"priority":"0","source_event_id":"15950876899806100711"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK web.js Show response
ads.celtra.com/57370bbf/ Frame 041F 17 KB
6 KB 1212ms
272ms Script
application/javascript 52.87.40.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.celtra.com/57370bbf/web.js?&accountId=afa4a86e&clickUrl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCbHs35LDHZd_0Mevk3LUPjsW5gA6t4fPAdZb1uY6qEsrAw7OVQhABIM3_h3xgvwXIAQmoAwHIA5sEqgTsAU_QEBzuQXHUi9N0CKVtHIlJd_nZX8YhllbbY6UuHFpAuYVVE2KkSvwVPCo6x36XufmDs4qY50jPzfKbpHV65nI4T5eS9nxEEuJI5Cfaca_rD4dHLCl0X_fmlTvQ33dBTzJ43u6me7Jc0eSFMKpLV7Xue3wG-FApxZtVpt982jQAL_Szy9NKG1vCgMNvcUk8FS0Zuf3huS_YGVa290aZbogMTc6uduq_5yOjDyhz5W426P0fKb2M1Mq0jLVdyBfHvXg-UiOQo0JUgn5tCXXQicfAZyqsaKU_1pvFRBUGdfdwwwkins8HWinNpBCUwAT8re2M0wTgBAOIBYKf1YtOkAYBoAZNgAefvqjCBagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCQIgGEQARgfMgKKAjoJgECAwICAgIAISL39wTpYmtG916ShhAOACgGYCwHICwGADAGqDQJTR7ATi9i2FtATANgTCtgUAdAVAfgWAYAXAegXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_8-6RriRSJ1SKtlVRaLAV-68gmwmy6fT5UT55NGqMCnGu-T0wXxu5HLkvb8nNzdMGYKVXtY2JV5QvvWPWOX06iKSxXPPPVIOkGBgB%26sig%3DAOD64_1eUlrDmJPKvzW7REFkdPA1FQNEFQ%26client%3Dca-pub-2462751652998210%26dbm_c%3DAKAmf-DtAN6MzG5dftNeSnd1DvpzlAK4JZiLYcNxJkf5TLlQzxA874JF_MAw3TkwoWDCkeRsY7z39USJOIKTBd4mQVitEkRWA-dAdXPT3ziGBaBI8pkj0ReMKNJxZ9rdlxol5O4MZsFZeRUqLWqRSE00HOc9XMYRTy183K8uUklmrKPhmAM5Ob9cR3SAb4qj11i0gtMJvb2BUDl5kv7VNAac_WlvSEcPajFyG1wmvlN728UBr8h5QzQ%26cry%3D1%26dbm_d%3DAKAmf-ASxWnO1dD787UWdUgw2krmly2KMXOoOQKZZqHQIEzkPUYhv-4g6uTadm4tatGZ-trxJG6wZk5Ia_-Vg6ing6prgNm-8SD5N0GKCNQY3rXZmfoEkQgjPNq6jkoha3JZP8nrlSn6nLTaUDAtEZpAGZmMDDK5ruM2lZ5yyJInb4jU855RgqgS77xBl8p_ytrva6XQg84Aljpa2-Y3vlnNwRil98emle6MCyKmkZsoNnPA2K1nixcWFk-T11OczA0KnsawECWsT2MFdFolitj4WQjpvrDsf9TQKukRbtyaWlRFLPYl4RTFdaWukooOV7loTPMkfRtpK8JZTYgxgeQqPIOcihEchSBuqyYTcJHfAV0qqPKfNJaN6pCPyQtV8WgUT6Kc3YHhvKTy8Q-lqbyHhNeunfr94pUlpW3i_U25uA21Peg5nckxqFgBO3EeWX_w4C6CPJ5VX8xeQCxRgaf9CEwM4WvpbyDf4RxTl2ghaTl5BdkTL7RHgJDzYOOuutTdqgH-taMt-S8l7ZicVvkPcUkCZ2D8E36t7ATjBxuepHukJyg18cE2YRTmnfe11vJP4rH0sptPZNLNXgygJpIT_wefRnkY1vtkn-lQtH1MVdTpJ88bX3g%26adurl%3D&expandDirection=undefined&preferredClickThroughWindow=new&clickEvent=advertiser&externalAdServer=GoogleDV360&tagVersion=html-standard-7&eas.JHtDUkVBVElWRV9JRH0%253D=549883340&eas.JHtEQ19EQk1fVE9LRU59=AD1EzRQAAABpCmEKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhQIgp_Vi06oArDx0vkFsAKD1KLkA0AB0gIqGAAiEwjf9r3XpKGEAxVrMrcAHY5iDuAoATABOJb1uY6qEkACSAFYiIEgEMybmoYCjK8J1EZ4PYVhpXLpFq76CQ&externalCreativeId=549883340&externalSiteId=1945009568623&externalSiteName=https%3A%2F%2Fsecretmsg.xyz%2F&externalSupplierId=1&externalCampaignId=20962430850&externalSessionId=ABAjH0gdeyisoyGPiJDwHSE-A89v&externalBundleId=&dbmExchangeID=1&externalAudienceIds=&dbmPixelIdComma=&externalLineItemId=20962430850&scriptId=celtra-script-1&clientTimestamp=1707585765.314&clientTimeZoneOffsetInMinutes=-480&hostPageLoadId=6830623653723356
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.87.40.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-87-40-170.compute-1.amazonaws.com
Software: /
Resource Hash: e978598a151f80a7bf99bd35fe13a93e912e8f92a51d229c1cdce4361003eccd

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 10 Feb 2024 17:22:45 GMT
content-encoding: gzip
Content-Type: application/javascript; charset=utf-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 6185
Expires: 0

GET
H2 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/ 165 KB
56 KB 30ms
30ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/reactive_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

077b991540dfdba89593d2342953c7e93d8bb77f27843894920b96f1dfdd519b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57067
x-xss-protection: 0
server: cafe
etag: 8275147547615481593
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:22:45 GMT

GET
H2 200 ca-pub-2462751652998210 Show response
fundingchoicesmessages.google.com/i/ 182 KB
61 KB 393ms
49ms Script
application/javascript 74.125.200.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-2462751652998210?ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cdc41d2bc8b97ff0f84d10aa59ef15bff7e11dd49662f7cec778880e493fe6b2

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-958Y2iuXrUcjULAqbu4aNg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:45 GMT
content-security-policy: script-src 'report-sample' 'nonce-958Y2iuXrUcjULAqbu4aNg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjWsKoxSXF4KohxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyBm_POCiROI3315ycTx9SWTBBCrAfE7yVdM34B4h48Hy5vw6axsEdNZ4-qms-YAMd-66aya66ezbjkznXUPEMc8n86aAsSLWWewrgbiKYEzWOcAsVP6DNYAIP6cOYP1NxD71M9gjQJiIR6Opw_nrWMTaOh88ZcJACZCSos"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 slotcar_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/ 91 KB
32 KB 26ms
26ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/slotcar_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2462751652998210

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93262beedec488f841ce57c0ab0026399b54aa011dff6df319b384185f739de1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32313
x-xss-protection: 0
server: cafe
etag: 5101356170360908357
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:22:45 GMT

GET
DATA 200
OK truncated
/ Frame 041F 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3bba4070a10e88e060608898b69866c4a4a8c37a9011bf49853cf4a19895df2e

Request headers

accept-language: zh-SG,zh;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 36BA 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4cfaa2c12cc543c016c8355627dd664a391ecdf475ece5e61327ef9b00a88f5c

Request headers

accept-language: zh-SG,zh;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 65ms
64ms Fetch
text/html 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2462751652998210
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.118.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sl-in-f157.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://secretmsg.xyz/
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 36BA 0
0 68ms
67ms Fetch
image/gif 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvv8HnEJ1VTjZXrWYIX-NEbYzuPIGyzJ_I2ZXcxEnjcw-LkFJpSxT5diWzEE9zq85TleHyT4tfWg79wlPbPCOPCL-rK_yqHPtWNKIg98IaFSnSAvEjMoMg-UhlKT_R9UOg6sCh6AXmJwPvIoNgIpq3XwEKSN9dLkTV0TyyaPMKgGLL0Qhbot_y0ms8mE03jAw78wXqGX1J7N2Q2_ownlbcRuPxU9_L76iXoWg2CUVcksrCgtqbVwc0AjsD_JZR5Kd-fam6hshO-b7herS8HL-hJxeTvCrIKf1A6uqqY5k-9pGxqDA_lu19ODsMtngbnUjZBNfOi0t9MpTNNM-jMt9_OQg4nk2CJP1f5YSUd-pGEQNL7tLPggCKPpMPj3HKQrp1YKUrZsJeeDyk4tcz-DrXlghZRXtBl6luZa2AiOCbAYEFO-vOWkN7j0pCM9oZEVvFsXuhoCkejz_4dBDYb3C_44IOQyjvbQh-CelGn5FWcPQFA_luxsFQSATTERWcnJ1A3qTJ_m9QbSpbGpT50c9TKPIhcoBP2C143OFUAM63fou3oYKWcJ_MZ21EpII5uI8SmebnYiXMfAYb2TpGSLL19p341LpsaqNKKA1Md6Zp_9tIPOGEx-jdB0NPYi4P1Bhg1eKR9tYnW1DjnRam5cBY5UajIY2fSydkudRqiQ6TNtFR8-kCF6Xk46lSN1xWImwSdf1Drs5FbGEHDthESc9TaLrid3-sFTLkzTarQdpuG3zwg9GAX0LKfE3s3mYzPy8ltrvzcXbT-Qme7N39tTAfB4T7pphOgRgTaayoRcZsY1Bl6LtL3B2hYEKl2qR3rVfHDolfFmKNcT--w858yGuu_2KAiImMJ8xHkRZu91Rb7VTPj9uQ3ujGfIAXESJVOPJIvV9gO1aIstpclePL0t216wT4iDi9EkRvs5ojCFNbDooFmn7K7Vzms6r1Hg90VYVsXbWcozFfLsOirUKH5BjgtUQp3-F6eUUmNvSlGYTIsZfIdZvpzeGghtJh8NOkzTznh3fW7CLvZMMbGvNDeSIDU41s6r9EbSOpstHPcDC8znE2cLx_F3-UXlpKVRkBYCFQbfU7FTQv5u1yFXX7ot_AKIvaX4LkfK0LWi9K9ZbzU6JSOUGda5YInpdWqqzqLxV8zzWMNKulzZe4s7wBl1WqGtGRCIiDcOHrZg5ib8guoREy1jfBmMkq0nTkivy7D4F8g_cnsdJEtCK8EQKO3_RiZ7yCsrY2ovHeTEY_WKWt9gQ1El0W9oeA9R0uzqbWZ2V_2GgY-5ylNtXlaglUGQlxe8ZlztzFmHSrhkkiJsa5iyhdZM-_qfw&sai=AMfl-YSYR5P_SYNRMabjQ--OApa3eeIjrQRJgx0Lz00m4OLA767PVH1MtcRPn8XbtKnQs7Ia1oYxBgKRS_XpCtGg6MRvjoaQ8F83tDPcINjXP3xnDLk5xScf5f_aQkNEXjnZzsFzvBvPn3E7OeA-0DUrkdl2qu8yHlqa9P5UwG3qA8BaKw8oTga55PIe-W2zwjm99s8SdebyU3PUMYUgbTtWiz_-2BL7Gwmn7uaR-yFn17wK5a77Kiw3wLmCQ4KA5VsZ-vCfLqhIWC66m9BbBjzY10x7nJlKccPwEDqZG5wZyvu1AAaIHZ-T8CQaJ7yz2y5jS6MCR-ox-m0eM-9DRHqJahc7M5KLzLVrdj-HtB4JqXq78Ttvee_4kkEGOpTiu8UmRK4pmztarDvqZldKTVezkOHwvMHW0u5kZ-wANQk01_p4uyupgPG4rmAzRIAZ01Llod5v39Ue7Ac5IZyiyeZoF516vVCg3ATgkPyAMdA2cpHV_VKsPvToiP_XyoJdjMVJmusUOUi1b2P-CQ&sig=Cg0ArKJSzPqdyt5X8cfkEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9zaG9waWZ5LmNvbQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=446&vt=11&dtpt=444&dett=2&cstd=0&cisv=r20240207.96695&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 10 Feb 2024 17:22:45 GMT

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 3304 38 KB
13 KB 18ms
17ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

accept-ranges: bytes
age: 89028
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 16:38:57 GMT
expires: Sat, 08 Feb 2025 16:38:57 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 13AC 38 KB
13 KB 17ms
17ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

accept-ranges: bytes
age: 89028
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 16:38:57 GMT
expires: Sat, 08 Feb 2025 16:38:57 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame 3304 39 KB
15 KB 22ms
22ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 22:09:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 155623
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 22:09:02 GMT

GET
H2 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame 13AC 39 KB
15 KB 22ms
22ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 22:09:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 155623
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 22:09:02 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/ Frame B135 9 KB
4 KB 16ms
15ms Document
text/html 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

age: 16737
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Feb 2024 12:43:48 GMT
etag: 3890843268177463596
expires: Sat, 24 Feb 2024 12:43:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/ Frame DB80 9 KB
4 KB 18ms
18ms Document
text/html 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

age: 16737
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Feb 2024 12:43:48 GMT
etag: 3890843268177463596
expires: Sat, 24 Feb 2024 12:43:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/ Frame 23BF 9 KB
4 KB 23ms
23ms Document
text/html 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

age: 16737
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Feb 2024 12:43:48 GMT
etag: 3890843268177463596
expires: Sat, 24 Feb 2024 12:43:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/ Frame EF0F 9 KB
4 KB 21ms
20ms Document
text/html 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

age: 16737
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Feb 2024 12:43:48 GMT
etag: 3890843268177463596
expires: Sat, 24 Feb 2024 12:43:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 AGSKWxW4Mq8WCuv6B3ap_kTyHEH2Bs-AH6BpXwd7quwZa1KA3rLCRX5R8DSLyd9EPmu_gKZbVZXJKEJ_y5eNQyf9X-xGLuq0uTPHNt5Stvs0HkABjAaJo_SCum6qkENOJu5ZdEww8Fb_ Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 43ms
43ms Script
application/javascript 74.125.200.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxW4Mq8WCuv6B3ap_kTyHEH2Bs-AH6BpXwd7quwZa1KA3rLCRX5R8DSLyd9EPmu_gKZbVZXJKEJ_y5eNQyf9X-xGLuq0uTPHNt5Stvs0HkABjAaJo_SCum6qkENOJu5ZdEww8Fb_?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA3NTg1NzY1LDk0MjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9zZWNyZXRtc2cueHl6LyIsbnVsbCxbWzgsIk0wWmdkYW1PTk5zIl0sWzksInpoLUNOIl0sWzE4LCJbW1swXV1dIl0sWzIwLCJbbnVsbCxudWxsLFs5NTMyMjg5OV0sMTUsMTVdIl0sWzE5LCIyIl0sWzE3LCJbMF0iXV1d

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.zh_CN.M0ZgdamONNs.es5.O/am=wA/d=1/rs=AJlcJMycxabdkP99pF5FTVOVn0LzHKVt-w/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2ba93599a22184bf0c8b102c3cffa2bd6c097742d92d07958fe51349a2b088b9

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-ZUmM39dU6gwGHTYj2R3nYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:45 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-ZUmM39dU6gwGHTYj2R3nYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjWsKoxSXFEKghxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyBm_POCiROI3315ycTx9SWTBBCrAfE7yVdM34B4h48Hy5vw6axsEdNZ4-qms-YAMd-66aya66ezbjkznXUPEMc8n86aAsSLWWewrgbiKYEzWOcAsVP6DNYAIP6cOYP1NxD71M9gjQJiIR6Opw_nrWMTuPH1ykVmADE_Sxw"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame B135 5 KB
1 KB 358ms
19ms Stylesheet
text/css 142.251.175.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.175.95 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

sh-in-f95.1e100.net

Software

ESF /

Resource Hash

47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 10 Feb 2024 17:22:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 10 Feb 2024 17:00:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Feb 2024 17:22:46 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/ Frame B135 16 KB
7 KB 17ms
17ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1984c4bb2ce10d00cb478c4ab216301e04502e25f2025b30dbeeb019172beb0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 14:16:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11194
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6823
x-xss-protection: 0
server: cafe
etag: 14359709190881042667
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 14:16:12 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/ Frame B135 22 KB
9 KB 16ms
16ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c6f8aad2c2e01e81032eb3ce744f73450e33b1718dd95ee9cb968e76b8512f59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 16:27:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3341
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9451
x-xss-protection: 0
server: cafe
etag: 11136001603933606047
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 16:27:05 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6C0F 624 B
391 B 30ms
30ms Document
text/html 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYq8vVkAEwAQ&v=APEucNWSn4xVgvr7b4F5ywt07JbBsGeWHUd-szmiL-Fcc8qGkTyr37dzv_yV2CDqYIbt2cFI5FE9u_0F61SzHLZjKP4hfxP5sw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Feb 2024 17:22:46 GMT
expires: Sat, 10 Feb 2024 17:22:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/ Frame DB80 23 KB
9 KB 16ms
16ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/abg_lite_fy2021.js

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 22:24:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68324
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 3610546441309021303
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 22:24:02 GMT

GET
H2 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/ Frame DB80 8 KB
3 KB 17ms
17ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 22:03:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69554
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 22:03:32 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame DB80 41 KB
14 KB 21ms
20ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 16:38:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 89029
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Feb 2025 16:38:57 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame DB80 3 KB
1 KB 22ms
21ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 16:41:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2469
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 16:41:37 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame DB80 20 KB
8 KB 20ms
19ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 14:45:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9437
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 14:45:29 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DB80 42 B
107 B 74ms
73ms Image
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cr6kDpshqJHozHSAegX7uzMV5-CojKF0f8Dqd_u_gGPCwvldy8G_-x652k6YnKLm8n7p7yShuCtVvoGK-isfFLUdcTMvbHobfAWnYQiU-WBJEuT4M

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame DB80 203 KB
61 KB 22ms
21ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

23d11567502488b4905a85c8ce6a03d6ce539620fa559b8f24a2a95b292a2c6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 16:26:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3372
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62553
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:26:34 GMT

GET
H2 200 6625947106331917376
s0.2mdn.net/simgad/ Frame DB80 116 KB
116 KB 34ms
34ms Image
image/png 142.251.175.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/6625947106331917376

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.175.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87cd6e6a4b850e003067360330c94372487eaff95fe51590f7a4e6c32e9913bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Sat, 08 Feb 2025 17:47:59 GMT
date: Fri, 09 Feb 2024 17:47:59 GMT
x-content-type-options: nosniff
age: 84887
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 119090
x-xss-protection: 0
last-modified: Mon, 21 Feb 2022 02:18:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 067D 624 B
368 B 39ms
37ms Document
text/html 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYq8vVkAEwAQ&v=APEucNWM_S88OX8D_BMlRV_Y4Ect1apO0VqTELevK6BsOngI_o88Sqop6z1Xi2l0T6aTQ0PbnxpkERRFtADeAwt9J5mZnl5iMw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Feb 2024 17:22:46 GMT
expires: Sat, 10 Feb 2024 17:22:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/ Frame EF0F 23 KB
9 KB 30ms
29ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/abg_lite_fy2021.js

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 22:24:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68324
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 3610546441309021303
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 22:24:02 GMT

GET
H2 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/ Frame EF0F 8 KB
3 KB 40ms
39ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 22:03:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69554
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 22:03:32 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame EF0F 0
0 77ms
75ms Fetch
image/gif 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsupU-XBHFz5Ac6kyxNnXEwArfG96hRO6np2emLk_xHGRFXGFPs7COn-JfS-_1iA7jmylQkXoe_ryW2jzoc8I405Z39KRy_u_mc2D-Hy8NygEk5BmQxYKqA9X6KeuJ2wI-izcKLAbFNbcYApNzsmz8UxQF3RVZ87g3qBMKmktdBE_9g42VhYlMuXI7NoiCyvrvNWYz0Ht0_m-QGxLBrxaD8Cvijh_tKjd3rRakv9E-2gfFOQfjuTtlg_q7ZRkNQHL54FgmQoEZkRwSJAiDDwb18nkRAey1QiF1VdKYMJbuZOzs3eVv5hiR7s-_7bMjTYH_euHHe47hh_2bSJwfiMyZzf6Ig9uzzY7z_aiz_irOH2RYN7eDn0rRmHxa9oQa-DvpVkY12FkY5XLKWvliZcFpCuuEDI5ZSKyJEgvsuUFP9laHFyDxqMy0n4CMq-J1bFfy8-DDtURQoTW3ahF0EYYWEsaOgI-zgXZ2N1TtgMG-vgSX9Tnmtv6IFYJSRRf1efasIJy0cmuwUNMOrvz1xKNJgdsczsV3m1gad9ZUkCPfvPfFogrDEfhwrgUo_c7C3viBJvxqJHBJPVf8CDYUy_ww_DRCYhHLHuIlrbi7S9MqD8e_pc65n2uU_88nejDTftBsUwaUttTYpN76IsWEqISZcOb4TDGjs3oRFdvyY1c1AEtNyNWC_l3NDxsCpm8HM6b7cpwQG3yD5WHiAxWBK6DAYAOObwWRTUspj9vJWt0BaSCrWedol6MDnjysyuqQNaX5hcplStYTApc5VJrE39AsYe2JrafF5rGqV06qokHRIrXoEhYEGl4nmHhTuBRo9cHWh7CsclzUs2Bi2EYnVznwPw1mFNoOCqsFLG19qtHZmLRthTbRAesiyVjANPUQer4jzTLuTNNg0bIP9pdT7rUbEwJd8p_Yo545zjqa1TI19i7-LFoW82UzaLYK-9sn2HnKnNM_ml9MInUBkWQfaD--w5JjDwSgjb__hfzTr8plC6vhDQwgqp0O5YEEteZiXAIYYKufk6q9xLjeypVn9F2z9o99HErh_WBqPIp7AcgJtzEsUB9z5x0llLRMH9HjXCk4PnQSwT3WDq9pzEppA1X8paf-8ij2MLY0vg0LP0LQid-MBHuOIr6lacP0Iqww9hUd6wGLli1NNaZVTDjiQ7LqEhw5jLRLvwbG5XLrHtWHnwrISSSUXVD9QBzt2ptUlvuVgXF5sbCt6ABRuO89PnD17HKzTsukCrLLbWrUX-WVylNqyszEAhnONOQ9roi6WT923NPIgUYRqXnJlsCliB0nvvEOScWF1jlilFP2Tr9vIyqIAipw2I829cfXfTMFs&sai=AMfl-YQRDA2PtDRejV9c_bOAwccy4GztRPum3d0i1z8JKWbCCrIpfeeMimMq8ZDUecKE1ZLsEHWxvNDyVSTKwaRoLl3C86c8JhcL94PHVJzXwmI5BvpD2vUX_ikPWMdBco7i7dF-SoaMNHarozS74fi1nbRoyCwzWQP-Tk2u34XZPZXvv8IOE3SxBmEMwkfGtj3tWBWam-wu1gxrPJYOoNL_2y1wp5vEsFzbrjpicCxxv5f0OSXGSZaB3fhQMtFzX6tOB3zTbLTLEprbf7mtEF_0ES97SWEbdGnrAkny6vCDCyVjVM42_jSZ33LiLgKB5ji8wL38EtCTGEYDY_VhbbVvC5A066zcXZcIED9-qXd6pdaRSwwSCk_OJHJvO4j5nRZkOBAEuWb_6-waeKjfI7-LNsxFF6X2PdpV0qufZFoVbnSR_XjV08ShyZFXBItyDLHnGjjdqYzMRAaa4jQ4dW1ydIycHtSztsHxZksBseM9p5W3TUEiYvEsljEHNKxT1WOvIzMVsH0&sig=Cg0ArKJSzIajnJWr3G_cEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9zaG9waWZ5LmNvbQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=1&cisv=r20240207.82571&arae=0&ftch=1&adurl=

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:22:46 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame EF0F 41 KB
14 KB 30ms
27ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 16:38:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 89029
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Feb 2025 16:38:57 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame EF0F 3 KB
1 KB 30ms
28ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 16:41:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2469
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 16:41:37 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame EF0F 20 KB
8 KB 28ms
26ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 14:45:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9437
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 14:45:29 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame EF0F 42 B
107 B 62ms
60ms Image
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DqIyJl9OyfNKObsuxTRh9nDPA1u7KC7EiTVhYSb5Hund1ajsHm2SJj2DjWNkecX8ajA8y_yZ30MO5FrqJWAEZAq6No97par7k7IyaUUUeO_S38Cj8

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame EF0F 203 KB
61 KB 23ms
21ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

23d11567502488b4905a85c8ce6a03d6ce539620fa559b8f24a2a95b292a2c6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 16:26:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3372
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62553
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:26:34 GMT

GET
H2 200 4694744141539715030
s0.2mdn.net/simgad/ Frame EF0F 11 KB
11 KB 18ms
16ms Image
image/png 142.251.175.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/4694744141539715030

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.175.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9fead687e96a462be4f9eacd84617fae956ed781cb77e891a253db50d3a5d950

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Sat, 08 Feb 2025 22:49:11 GMT
date: Fri, 09 Feb 2024 22:49:11 GMT
x-content-type-options: nosniff
age: 66815
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11283
x-xss-protection: 0
last-modified: Mon, 26 Sep 2022 06:30:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9612 624 B
285 B 38ms
37ms Document
text/html 64.233.170.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYq8vVkAEwAQ&v=APEucNXbVqNDAp5bFdCxosUb7q4sxDMOoEH5G-v5LQE2YIJ1WEtaV7FamPfntKPF1RYUXJQxtxLoqkDLwBus9tNZWjBjpY_VLg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Feb 2024 17:22:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 6625947106331917376
s0.2mdn.net/simgad/ Frame 23BF 116 KB
116 KB 19ms
18ms Image
image/png 142.251.175.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/6625947106331917376

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.175.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87cd6e6a4b850e003067360330c94372487eaff95fe51590f7a4e6c32e9913bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Sat, 08 Feb 2025 17:47:59 GMT
date: Fri, 09 Feb 2024 17:47:59 GMT
x-content-type-options: nosniff
age: 84887
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 119090
x-xss-protection: 0
last-modified: Mon, 21 Feb 2022 02:18:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/ Frame 23BF 23 KB
9 KB 20ms
18ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/abg_lite_fy2021.js

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 22:24:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68324
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 3610546441309021303
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 22:24:02 GMT

GET
H2 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/ Frame 23BF 8 KB
3 KB 35ms
35ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 22:03:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69554
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 22:03:32 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 23BF 41 KB
14 KB 52ms
17ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 16:38:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 89029
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Feb 2025 16:38:57 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 23BF 3 KB
1 KB 51ms
16ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 16:41:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2469
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 16:41:37 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 23BF 20 KB
8 KB 49ms
14ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 14:45:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9437
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 14:45:29 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 23BF 42 B
107 B 74ms
47ms Image
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Bj8ZBPMrQG7JO8zM4XvsY6cXzQygCIcF5B_DkLWkwHHEzbalsWAkJkIdRY-2ahH2AWhRuZBKvlZTCBsiHuIOEK2Dj3Pi2KNjxqcK-vZB1M28hQs-g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 23BF 203 KB
61 KB 29ms
3ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

23d11567502488b4905a85c8ce6a03d6ce539620fa559b8f24a2a95b292a2c6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 16:26:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3372
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62553
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:26:34 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3304 0
56 B 98ms
70ms Image
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bh52W5LDHZYWcNZ-f7OsP1Ja5mAwAAAAAOAHgBAI&bg=!NDelN3jNAAaxkZ3akZE7ADQBe5WfODwYcGb6NCjVhhy6Vo3C3Rku4f4ZkZOkzW308m2weGyh-hfP3a7HiQ9bgvSi01SJAgAAAPZSAAAABGgBB5kC1hBPKRT_B413IVpGILZXTTR7kDokHch-orCxAykHwmITGoAbp5R0VqgjKbDEEveqD5X1HYL5tKUxzK6C3Rez0kZcGSWDEForopw7KaF8w9ObKXAQnMf18EMlhaftIVdfyYmnqw8psvwKlMo1C-6OCphIrcQYx2sujL3NHmT7IrfhQWil4BciGniBkrHrYgIUnJCEK_-ixwmczewJ-HMeKRafbWrvL_dsb2h_l3Rg8gsrN5dpk08M7UYOXvUV8OtXdTAHmrTQ42ldc0nl3YnSXJG2965UJrV-c7zydoit3eWIRSjpUGAYaql7wtC0B9F2DfCJlBXvQxOl-vrcfHzWwZFwM5hEzeRsPrH-owXVVXR442sFdGHTEuSZcy2wMabdj1jqPl9zVRUPumgzgzHNXmb08FNJKadZOfd7Mx1zidmCcRZo8GlULaN7kSVdEop51yJ0Co2pMzXRjI-FfoZHUmrH0FbgGnk5smiJ9dKo_7YGLSsgJWqXogHHGWmpaj4u8NKcRFvmUOMWu1KOJbvSBZMtfxKvIhKkKFdDIK77kyZoJcBwk70zzNIyyPpofzvS6pThyMOGeyYm6WMU9x2bDpagYyn876MhRAK4ga8qErtsxtySp8ciTa-J13d8htEK1EG-jx1BRsv3YmE7LGnxEbKlbgvl-YboeaCM8f04PkRAVbOSuGgwXLkb0pyKfhwGSAtLLPUka6Jsr-f4kbHH6aV6mrNRIs5H8ROL5jN5P83NADVU0_P5T7rjdhrtCyoceYY7jghKx3exSbfixu5t8p6sggjP1UYUPxuAUvW9v1ZK9ych4Tt-dRpSQiOXWHTylPNo4eXBVm3AdX2XvuzdiqqaAc3Q1gFK5PNkXMC9bzY2PKwPN4lSr6nLOiiJ9-ocdWdmBz1j9xW05BV4nsMOXaxKYTkxJ2GXTi7x7nQbSiSNalhVIKpgih5_enXDppsGlYR8oTzhpw

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 13AC 0
56 B 95ms
67ms Image
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BNvN35bDHZezVEbOM9fwPwMGumAYAAAAAOAHgBAI&bg=!kJOlk9zNAAaxkZ3akZE7ADQBe5WfOGIQcsrovHvXJMjo_RdBA3fSoSiiYrASabVjgY3C8dlJxNCaKUgd8hv-klRIjLuZAgAAAOpSAAAABGgBB5kDFQXp-2GayyLG1wD2vVgVICCW8R5IGvGgVYzSXSxQ5s8Wd2GgjVgrVMjfwrM-kw_TYwcMvwCaZ3w2esr45-NpB5xNcX8wZ5d89bjL9cHbp2LvOgQpWXL3fSHQvP7MLPf8n_dLFNVlyUPmfSD0go1YhJJmUSDuYxYAjTLwE7fFWsOIYTzFstavRDeAjNTufgEdrQwWdgFqljarrRpMbl2tv_-rhAsPu8pU6_n2wdbeWnGIHB2_dDeIgxELDFxDot9ApOpLu-NG-h4fkk2nhvjHv7MJw9YXKc50w7BNyqYDSy-wZpqJRDXL_LjnGQY_cEOYVsMJcoZEGx09XI-Tj8vGbs0zpLDisktMOwu-UHiBRdcemFyhgZVFqjw4sswaZenDpOFRIVbTczqUHTmuu27hFTT9fAmDllyoDn8NUBA4dMsE0lsyhpqjifSmLewBy7mUp2NFGg9qz-ya_stolpnUWZKnxZD1Lgl0J8CeANhyVdWZTk4bZNFuQWoo6fi8p91Uwgr6_wfRbFuKsMBY5ch_fGUt0YfZ6b1l28ruXH1amVsD6u3S38Rowq58XJCUh6ZiXmb2eQdZU2EvebZiubRp3qdUJMOjTtyp3R23A7-rLkQbhtn-cpQZOLtseJs4Yq9BR6BmVQw1ighF8ZFTsHzcLmfJOo-Fp9OJRgaXyBwWNOOURI6FwcZvoTM8AjNNU1xn7JebSulou9EpL1DtLjC4_VW8HcDdaTgbhEdCStUyvPII7C7x3UqBkWlttsp76jK4YcP2WTHstK_jr59iE_girL9RxpdpAIpujTHRA-WrO76pcgAamOhZVy7cczwwiVdWM9tlfUNZ8pJRwjZk6hzSbZLRg7efO1gOUuiezScWknhzuuf9M-8ksP77pLyyRVXu2ejInKypJmu5zyOMkBzKZSBglkPKoZSbNLCK77bu3gGZFpP3ld_RGYgbgkr_VAVH-I83YHSAgF4C-I4sCRDX4zCDs99_sOEBi2AjjxU_wGir_8mACjJ31rCc0Fbin5VEq91jOSjsiBaZkVEHc6jjANX3bwyINg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6C0F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1

43 B
734 B

39ms
38ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYq8vVkAEwAQ&v=APEucNWSn4xVgvr7b4F5ywt07JbBsGeWHUd-szmiL-Fcc8qGkTyr37dzv_yV2CDqYIbt2cFI5FE9u_0F61SzHLZjKP4hfxP5sw
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qRNbzwexJrIPKKvkV8H0IBHBcPabvNTZsAwH1HHF3SnaXVAwtwwtbct1bUQQd%2FxecKrNj62dXQL43vJTTS8Xj9bupay3uLi0uBXWYR8X6%2BGhF%2FfpZ56rAS%2BXB4RnEbQccYUwd8JpHnCFHA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8536093e7c17019b-SIN
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6C0F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zcew5YsFVgMAADEqAAuQAAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1

43 B
734 B

35ms
34ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYq8vVkAEwAQ&v=APEucNWSn4xVgvr7b4F5ywt07JbBsGeWHUd-szmiL-Fcc8qGkTyr37dzv_yV2CDqYIbt2cFI5FE9u_0F61SzHLZjKP4hfxP5sw
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6yh7L5mtrCR6%2Fh7IiqDh29Z8DxtAEpm5%2Bi9Zp%2BCJdSRxqhQvamnQohDnJHBX3J5soaXgz2m5bhHYkj%2BxpwnmoO9PEMsr1gISLVm1%2FI0KQzLUlEHqT3VMp7NbBonvKMaqO6Q7leQqNQsXiA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8536093ebc34019b-SIN
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 6C0F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEE_bwCFMj8KLzWr-MDVHwDU&google_cver=1

43 B
1 KB

26ms
22ms

Image
image/gif

103.43.90.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEE_bwCFMj8KLzWr-MDVHwDU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYq8vVkAEwAQ&v=APEucNWSn4xVgvr7b4F5ywt07JbBsGeWHUd-szmiL-Fcc8qGkTyr37dzv_yV2CDqYIbt2cFI5FE9u_0F61SzHLZjKP4hfxP5sw

Protocol

Server

103.43.90.117 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
an-x-request-uuid: 06594c79-54b3-41cd-967e-8ab0c845b6dd
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 222.164.167.113; 222.164.167.113; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEE_bwCFMj8KLzWr-MDVHwDU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6C0F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D

170 B
188 B

20ms
20ms

Image
image/png

142.251.175.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D

Requested by

Protocol

Server

142.251.175.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
an-x-request-uuid: 4b61fec0-d4bf-4634-9e9e-a9b5b0acc56a
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D
x-proxy-origin: 222.164.167.113; 222.164.167.113; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame EF0F 0
0 82ms
65ms Fetch
image/gif 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsupU-XBHFz5Ac6kyxNnXEwArfG96hRO6np2emLk_xHGRFXGFPs7COn-JfS-_1iA7jmylQkXoe_ryW2jzoc8I405Z39KRy_u_mc2D-Hy8NygEk5BmQxYKqA9X6KeuJ2wI-izcKLAbFNbcYApNzsmz8UxQF3RVZ87g3qBMKmktdBE_9g42VhYlMuXI7NoiCyvrvNWYz0Ht0_m-QGxLBrxaD8Cvijh_tKjd3rRakv9E-2gfFOQfjuTtlg_q7ZRkNQHL54FgmQoEZkRwSJAiDDwb18nkRAey1QiF1VdKYMJbuZOzs3eVv5hiR7s-_7bMjTYH_euHHe47hh_2bSJwfiMyZzf6Ig9uzzY7z_aiz_irOH2RYN7eDn0rRmHxa9oQa-DvpVkY12FkY5XLKWvliZcFpCuuEDI5ZSKyJEgvsuUFP9laHFyDxqMy0n4CMq-J1bFfy8-DDtURQoTW3ahF0EYYWEsaOgI-zgXZ2N1TtgMG-vgSX9Tnmtv6IFYJSRRf1efasIJy0cmuwUNMOrvz1xKNJgdsczsV3m1gad9ZUkCPfvPfFogrDEfhwrgUo_c7C3viBJvxqJHBJPVf8CDYUy_ww_DRCYhHLHuIlrbi7S9MqD8e_pc65n2uU_88nejDTftBsUwaUttTYpN76IsWEqISZcOb4TDGjs3oRFdvyY1c1AEtNyNWC_l3NDxsCpm8HM6b7cpwQG3yD5WHiAxWBK6DAYAOObwWRTUspj9vJWt0BaSCrWedol6MDnjysyuqQNaX5hcplStYTApc5VJrE39AsYe2JrafF5rGqV06qokHRIrXoEhYEGl4nmHhTuBRo9cHWh7CsclzUs2Bi2EYnVznwPw1mFNoOCqsFLG19qtHZmLRthTbRAesiyVjANPUQer4jzTLuTNNg0bIP9pdT7rUbEwJd8p_Yo545zjqa1TI19i7-LFoW82UzaLYK-9sn2HnKnNM_ml9MInUBkWQfaD--w5JjDwSgjb__hfzTr8plC6vhDQwgqp0O5YEEteZiXAIYYKufk6q9xLjeypVn9F2z9o99HErh_WBqPIp7AcgJtzEsUB9z5x0llLRMH9HjXCk4PnQSwT3WDq9pzEppA1X8paf-8ij2MLY0vg0LP0LQid-MBHuOIr6lacP0Iqww9hUd6wGLli1NNaZVTDjiQ7LqEhw5jLRLvwbG5XLrHtWHnwrISSSUXVD9QBzt2ptUlvuVgXF5sbCt6ABRuO89PnD17HKzTsukCrLLbWrUX-WVylNqyszEAhnONOQ9roi6WT923NPIgUYRqXnJlsCliB0nvvEOScWF1jlilFP2Tr9vIyqIAipw2I829cfXfTMFs&sai=AMfl-YQRDA2PtDRejV9c_bOAwccy4GztRPum3d0i1z8JKWbCCrIpfeeMimMq8ZDUecKE1ZLsEHWxvNDyVSTKwaRoLl3C86c8JhcL94PHVJzXwmI5BvpD2vUX_ikPWMdBco7i7dF-SoaMNHarozS74fi1nbRoyCwzWQP-Tk2u34XZPZXvv8IOE3SxBmEMwkfGtj3tWBWam-wu1gxrPJYOoNL_2y1wp5vEsFzbrjpicCxxv5f0OSXGSZaB3fhQMtFzX6tOB3zTbLTLEprbf7mtEF_0ES97SWEbdGnrAkny6vCDCyVjVM42_jSZ33LiLgKB5ji8wL38EtCTGEYDY_VhbbVvC5A066zcXZcIED9-qXd6pdaRSwwSCk_OJHJvO4j5nRZkOBAEuWb_6-waeKjfI7-LNsxFF6X2PdpV0qufZFoVbnSR_XjV08ShyZFXBItyDLHnGjjdqYzMRAaa4jQ4dW1ydIycHtSztsHxZksBseM9p5W3TUEiYvEsljEHNKxT1WOvIzMVsH0&sig=Cg0ArKJSzIajnJWr3G_cEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9zaG9waWZ5LmNvbQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=38&vt=11&dtpt=36&dett=2&cstd=1&cisv=r20240207.82571&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 10 Feb 2024 17:22:46 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 067D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1

43 B
734 B

39ms
37ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYq8vVkAEwAQ&v=APEucNWM_S88OX8D_BMlRV_Y4Ect1apO0VqTELevK6BsOngI_o88Sqop6z1Xi2l0T6aTQ0PbnxpkERRFtADeAwt9J5mZnl5iMw
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=omo6egm16gpXo0NVO0%2FcpQlGGU1wR2O6tGCyOJswncWScTdgLXWo43pS%2FbhGGDowxl09f0Zg7%2F6bJGHMSewlELPOJ17UbvxdvXzwqTZoAoFxaVjA1nBWU3WCTEhYpq%2B1R9HN%2FqNMdVSB4g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8536093e7c18019b-SIN
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 067D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zcew5YsFVgMAADEqAAuQAAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1

43 B
728 B

36ms
35ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYq8vVkAEwAQ&v=APEucNWM_S88OX8D_BMlRV_Y4Ect1apO0VqTELevK6BsOngI_o88Sqop6z1Xi2l0T6aTQ0PbnxpkERRFtADeAwt9J5mZnl5iMw
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aIdD4xhVVt07t8vCYnQNkVD%2BXL4inJvdilGxYBA5WJis1sWpFArtnj36IFF8F8J1VzTmg9Td6GQBp9YkI788pOEvmRxI6nzHyrwc8ey6456sAOPes7zmClPERmRoedzeBEPr7mmMPwueow%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8536093ebc33019b-SIN
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 067D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEE_bwCFMj8KLzWr-MDVHwDU&google_cver=1

43 B
1 KB

19ms
16ms

Image
image/gif

103.43.90.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEE_bwCFMj8KLzWr-MDVHwDU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYq8vVkAEwAQ&v=APEucNWM_S88OX8D_BMlRV_Y4Ect1apO0VqTELevK6BsOngI_o88Sqop6z1Xi2l0T6aTQ0PbnxpkERRFtADeAwt9J5mZnl5iMw

Protocol

Server

103.43.90.117 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
an-x-request-uuid: 95171190-f2f4-4316-9d51-47de9b2774ff
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 222.164.167.113; 222.164.167.113; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEE_bwCFMj8KLzWr-MDVHwDU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 067D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D

170 B
188 B

28ms
26ms

Image
image/png

142.251.175.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D

Requested by

Protocol

Server

142.251.175.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
an-x-request-uuid: 5412959e-c3b1-433f-b697-1ce0b007aeac
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D
x-proxy-origin: 222.164.167.113; 222.164.167.113; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 AGSKWxX_7fAezVrOGp2MRSQfGcJUII0chnRW4WvFHNk-rl-ownFBUCkl0474_Ah_DULjVgONyxu9l3D8WGFXj3dS0P5Xbq3xfL99gl9jEg4PJxdVmVG6DIQO0nl9S4m_I7bmvkei4yZH Show response
fundingchoicesmessages.google.com/f/ 10 KB
5 KB 60ms
57ms Script
application/javascript 74.125.200.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX_7fAezVrOGp2MRSQfGcJUII0chnRW4WvFHNk-rl-ownFBUCkl0474_Ah_DULjVgONyxu9l3D8WGFXj3dS0P5Xbq3xfL99gl9jEg4PJxdVmVG6DIQO0nl9S4m_I7bmvkei4yZH?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA3NTg1NzY2LDEwNDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vc2VjcmV0bXNnLnh5ei8iLG51bGwsW1s4LCJNMFpnZGFtT05OcyJdLFs5LCJ6aC1DTiJdLFsxOCwiW1tbMF1dXSJdLFsyMCwiW251bGwsbnVsbCxbOTUzMjI4OTldLDE1LDE1XSJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c4f38a5817259c9a8512068b377bc9efbc0f48c5d3073a2d065c8b196a066268

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-yBeJTCR8qQhnTJnHYHtjdA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:46 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-yBeJTCR8qQhnTJnHYHtjdA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjWsKoxSXF4KUhxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyBm_POCiROI3315ycTx9SWTBBCrAfE7yVdM34B4h48Hy5vw6axsEdNZ4-qms-YAMd-66aya66ezbjkznXUPEMc8n86aAsSLWWewrgbiKYEzWOcAsVP6DNYAIP6cOYP1NxD71M9gjQJiIW6OZw_nrWMTOPD4sRcA4FhKcA"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 9612
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1

43 B
737 B

39ms
38ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYq8vVkAEwAQ&v=APEucNXbVqNDAp5bFdCxosUb7q4sxDMOoEH5G-v5LQE2YIJ1WEtaV7FamPfntKPF1RYUXJQxtxLoqkDLwBus9tNZWjBjpY_VLg
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FlvIgSME3%2B9jmE5n6ZjWh00GkdDMwtqi6KqmDg%2FA%2BRAoS%2BDZeMDVacrEyHL6Lz7jURvxXoQRXWoEW7eZvQzSuxwvj%2FUTgjs1TQ2WNdnRYnT9bXBF0oJErihSM1byqA37awbgJmHqH5sLTg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8536093e7c19019b-SIN
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 9612
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zcew5YsFVgMAADEqAAuQAAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1

43 B
730 B

43ms
42ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYq8vVkAEwAQ&v=APEucNXbVqNDAp5bFdCxosUb7q4sxDMOoEH5G-v5LQE2YIJ1WEtaV7FamPfntKPF1RYUXJQxtxLoqkDLwBus9tNZWjBjpY_VLg
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aEm6bHQTlqmp4uqSKhBBjJmtsPBEsVwDb8zw04jWAWQuC85Oo5LTRUT3ubHpaIFdjGcpFx7zQOQeLHMjf6ugKZyCcL5mxZmAQowyWClaZ4XdMpOVMoM5RfxPClQykX0hiD4R1%2BX75DBxng%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8536093ebc31019b-SIN
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPY8SmFhUXb846CRmNbPGfk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 9612
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEE_bwCFMj8KLzWr-MDVHwDU&google_cver=1

43 B
1 KB

14ms
14ms

Image
image/gif

103.43.90.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEE_bwCFMj8KLzWr-MDVHwDU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfwggIQq7Cd4QEYq8vVkAEwAQ&v=APEucNXbVqNDAp5bFdCxosUb7q4sxDMOoEH5G-v5LQE2YIJ1WEtaV7FamPfntKPF1RYUXJQxtxLoqkDLwBus9tNZWjBjpY_VLg

Protocol

Server

103.43.90.117 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
an-x-request-uuid: 186503e5-6304-40c7-93d7-3b1d38953aeb
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 222.164.167.113; 222.164.167.113; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEE_bwCFMj8KLzWr-MDVHwDU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9612
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D

170 B
188 B

23ms
22ms

Image
image/png

142.251.175.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D

Requested by

Protocol

Server

142.251.175.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
an-x-request-uuid: 50a645ab-4013-44df-87cb-66c74b38c402
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA5MDk2NDc2NDgyOTk2OTM0MQ%3D%3D
x-proxy-origin: 222.164.167.113; 222.164.167.113; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 6C76 38 KB
13 KB 20ms
19ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

accept-ranges: bytes
age: 89029
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 16:38:57 GMT
expires: Sat, 08 Feb 2025 16:38:57 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame EF0F 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c6481615e16b6450f1087d543ae82c136ddbed7b726e9fc89e0a448423b66945

Request headers

accept-language: zh-SG,zh;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame CE36 38 KB
13 KB 18ms
18ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

accept-ranges: bytes
age: 89029
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 16:38:57 GMT
expires: Sat, 08 Feb 2025 16:38:57 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame A7D8 38 KB
13 KB 19ms
19ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

accept-ranges: bytes
age: 89029
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 16:38:57 GMT
expires: Sat, 08 Feb 2025 16:38:57 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame DB80 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bbda044a46259be20dd36211ca9fdf2d60a682c5521dc1ff4eba06171c69c496

Request headers

accept-language: zh-SG,zh;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame 6C76 39 KB
15 KB 15ms
14ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 22:09:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 155624
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 22:09:02 GMT

GET
H2 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame CE36 39 KB
15 KB 18ms
18ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 22:09:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 155624
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 22:09:02 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame DB80 0
0 72ms
71ms Fetch
image/gif 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuggOwgLrynsqx1Svr3hF7swo3oxSyU_rCkEPK7_opW6ct5nWmgVgu_eMdsPTuPhqdi2-au8UcEhAaYLb7doSmaHTrj7c9OxRzL1hCzLxlmNRsFu8guAJDSEkbeu_5ieGlYJG16f1NbZppkpJT-mHs6wKePvzKMIl40AdJylVWIiMl_y0PPTFc-QifAAijQVxMRQS01TV6-yjUCzGm4Yt9S9EAfEi-RbpAU_2HbyrGJsfGCklirpwcKpeCMn-m6n-hIezTTYAci5tdr94dTKqEOd6MVpabMD3jy3JSIu7kvauj4f3hedJ5OJjaiY_Ryt1HtJPeDYv4yt0kcbYhGAvYYP0WDU-nj9K2Yx4K6-ijlv0yeFBwmV5-aaDYhCSncAdaH3L6CAhli0Ew909TeEkMUvE9cJKLhQ6TSNASdIuFE8L3K8SrEtzkc2zyBuqib66CX6kaxlLz1qJLtT36FudIkVM0CKy4vp4jZQ3vkyOyXbFwMgiPOhZQN0-6W8RrbTiRBsq1dGDRkJ5sDhYX-NVmv791d_zEwaOl_cYVgVWvysAZk5IE25ROtNa8MEkCn6IEycrE8zje_g7FlMR_UrlGWVNZzBX-sEqaooGx9tmFGaIArND3cEMM0w1w8QNmRj4GQ2vzzbnsxsRx_HRd2cJAgsUM4OxJtCUA0P_PwB4d3Gt-0vlSECW-wwHbfjBZG4G8LmW8E61fCBgndl2pyn0Se3VH2sSqBy-8JSTOXxyYs-hhyJiDflaK-q0cFE1_Hx07JbupJ4e9wiIJwRdrQzBmJGm2ofW1kRZ8W_E9-ktXJhCGxMlTRdWiRxL-kpcMQo_A9rSpF7qzZepUcOdrJywmk5b_1h5a3ZD8tAIU-Iw6EPehe0CzhiQPhO0kIq7NXJWD1piQStf3TckBfudsRzYk9NnLt6kGWITUpaQHiElgVMHvM2pwOvbK_Ay-_iVQm7uIXjIC-KsFaSjHK-vyn6xrr69RSNz-_4sicudJhKgdqAnSdcGamuxvc3_WowHw7b73p3oDfqHMMEnVY15C_kLoAXAb0KcpSAFTYEFJEkp4p6rBR3gZ52LrSKRgwqOZ6Q6d6r7rVCjrVjnWqkyQ47zN87EKdirCJ5o5UBP5uggCHd2nYgzEQO65nSj4jyV1f3cVkE73twGnrbhC9_Wyy_lvZLriq3fRwpcxMCPOloKLmQ6m7qQRO0lU94f901-fCdz4eku1pc5Jny6UHqQkiB4Xns_jKU9ePpUGROCapEqJGGGuv655OECQ1awrHFtpAM-AM0JPj4jyUukjp7ejOt7YFBT60YjZdlrMASQ7_DSXHtDmBk6HGs73JHu7V&sai=AMfl-YQLsNvegtxvg5Z5Nw1jEjejLU5tZWRsLfXuQAqf5O_dCGNbQSPhbse3d0sZnM407-s6cuZM5t_-OPpX1VBR2J2-jozKs25uV3lSL0kDfstUwA4IICES4UtW86uWjc72kddpP5ajYluicDuAwSSbh0vtrhBdYSp-c4XiU7hqFYnb8Y31F86FbV4I3G_qgydtksIrFdQpshhEb4P84zmlRv6Bnta1XRLegds-1BsOeCuwtZ3WNsKhjwZrONWHaN1WPPCufPTAUioHCU67fgTQB97W-wcwlouMH5DATV7ijGzzUnURiKGxz6DcE6P13Do4UHAih32BgHN176Ojd1muWY4WT1PpKM5EV9uWUW5oqmqsUnu3cUxAQ5jhVlS4nbAGWRSPW5-eysjxihx5aUj0XxBafeaqdOLoAhBtQEwUrPYZHa2Vf0Q7PkbqmHaS-qwZmYgCbEHlnWloB6bB3S_EV70wCOxb3j6pPsqgZs6x0D1zdSQyOMm1PvCY_0P7CLdRqBMNxxE&sig=Cg0ArKJSzIFAvm4YCtccEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9zaG9waWZ5LmNvbQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=253&cbvp=2&dett=2&cstd=0&cisv=r20240207.59128&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:22:46 GMT

GET
DATA 200
OK truncated
/ Frame 23BF 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a804d901268e9de546498e03426af45ae1fb53cf85413a6d1932877b50984f7f

Request headers

accept-language: zh-SG,zh;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame A7D8 39 KB
15 KB 18ms
18ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 22:09:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 155624
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 22:09:02 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 23BF 0
0 75ms
75ms Fetch
image/gif 74.125.24.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssk5slTjqNzPgwf8dDjPm48iQlFQQKQ-DHxMayd1L-uJM0ZJV_WgHao5ey_p71611uEmyfIKJSI7OaMr5e_SV8rrVl9erXSl-BeQLk16-7wyaCWfxGS_Ehne6MVJMUaMlkixPXxicHOX2kiaKA91RQ6zU-iahwJFkKg-MgBpGQeZ438JxZZnrh9U3OGNfQ8Rl-CJUTmSxcDy4LrnRodnuHWX0w8VvYzZspqucO4aPd4viB0aWVF7G_KY83YCKESrT9UAUVDcckaYBIc1XUaQ2XtVvrY_Fr1KeVn6iF2a_jEprIR_HZNDwjRhxWBCD2_bUf19qjvGt1_KYeK8YJzR-PvrcVONmdXuLgLpSUJli-43vGVOhItpHi8kg4FfYoeG-ntqse3SaJmRMo-qS44uoA5Mp2cBHUmwRGtVNHcHs1iUZ4VT5rLgpA-eZO5j1y4aCLFOM3nRy1Ve6pBY7Y9_NOXWOz9HrKtUwpnWmqMAeeaKHtgNGri0JR8PDLBEZ5qDFP-YeqjUPtEGm5NIP9PaRMWWE4FfwueitE4ZEWSzDinuYuC5QeQmiJmj2csKXrpxUtVED5VPt_iJkCdjyXKT4KVl9LSRwyWDfdaiJUkr0Wy_0VFj2pwUDyhk_7A13AYleZGsVY_lh3hSOqU1_M43QrSn5SBw1wp2wUMlQr7PQGh2m0wHjG2bK1F41OGRBcbJtBU8D3safbAp0aYNPFsBpyHDzLdjQ1TSbHn8OnFfOJGKd7ID-CBYHwS3BKmKKXFsUXzwDiPtT4yKBUJFAU7TVCwuB_T3Q6jhaarOmp9SPRfvmaUDOengVABPGMnqMp60GfC6wscCeAHxzLqCAlOnlBnuFr6LoHYov2WfqK1Nc2e78UUbmlRNn8nor4LqQoAU0fXcCFn9N7jIMrwvmiFXNK3d_sJkcLoL0RFPGwRMsFouZ8h0aCi4kdpUvJogTDZs8yxwXTx1qijjTzic_CWWs71mr5d8W2tumtegsVUFLG_RHks8fe-pmyV7iWO23DMSObke_LYFVA5x3i1z7v-JTnH1Z4Nw3biUO3BdkDt2sQEHH865GCHnvu4RM5e8QG6zCugEAOb9gCfhENVbhwXje1YWKO4JCtgmqLN9HUPJNKp_p7su43-YqYdA5SEu6Fy728Yn_E9eut3ymlnTtFsPOqZoOhcAfkOylm2iO6N6M6LF18okYjqAT9aulZCCTmEMhS6KpurSgK7dPksTzZgDkrP9T4ObiLSYlXN1P24ICrLmmuzj-6fxRCMohriPJO7VwNcze0b_ktT3j7Lk5D7WQ4bPZlkw0j3OxenC4MseStJlEiGvJJBndbTspT_jjE&sai=AMfl-YQTDE_o5Rh87OKgk2oqTQkRB3qs3mJykH8Lg29aeGCCeIDUSmpOOwzyfON1NBzamZMMhGQOq6fZM0_MnUV4yKjhR-df9SEH84oI3aVadjib_zVHbhfeZ-SXKeOB6QgCuke2c-rVVg5EXJ3ii-t5TKx78x1-ruumWp6gL3E0IKAAMHC8saMMkdVIK0Y6RhurOlm-D4E0MnkrGfp2PhCCpmB-f2v8Foyec4Ya0E230P6dnkz3jN6fjpmITkofNON6LTXs0gEEzBsVbe02NVrEY_vlFql53Arhpaty-k1qAR5llGfBljQFzHqk8iE6Qs2PU6mWVeecn1p8F3_h7HPOJp2Xe3pNfwu53ua8fjtNC7sViILLq8vOUr6Vvj1nJO_hdAps18MqhIOSh77kTyxE8w6fIWM2lv9iBcN4GwPAwOgxjuJna7sVjjWiCAZudJHHpb6ulYoGoLdJOEiQFPIrUVyzKrf7f-3F_X_ct9NCatfir4ml4RgZvwQoeT66j2yl6Y7japI&sig=Cg0ArKJSzHFzTgWX0eyCEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9zaG9waWZ5LmNvbQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=272&cbvp=2&dett=2&cstd=0&cisv=r20240207.03993&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:22:46 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/ Frame 5E8B 23 KB
9 KB 19ms
17ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 16:41:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2481
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 3610546441309021303
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 16:41:25 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 5E8B 9 KB
846 B 20ms
19ms Stylesheet
text/css 142.251.175.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.175.95 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

sh-in-f95.1e100.net

Software

ESF /

Resource Hash

d3f4104957e76483acba4180738253208fd8d4d81c64931244860514af502b82

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 10 Feb 2024 17:22:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 10 Feb 2024 15:54:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Feb 2024 17:22:46 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/ Frame 5E8B 15 KB
3 KB 392ms
44ms Stylesheet
text/css 142.251.10.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.css

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.95 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f95.1e100.net

Software

sffe /

Resource Hash

425f9ca7029ca2c95d204079575a3e5f737ef4d322614225344c5aeadd51bfb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 09:30:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28321
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2939
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 02:36:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 09 Feb 2025 09:30:45 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/ Frame 5E8B 378 KB
132 KB 380ms
32ms Script
text/javascript 142.251.10.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.95 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f95.1e100.net

Software

sffe /

Resource Hash

325f25191af82345cc615c820126c663f55ee865ccb8c6f033e11ee57085617a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 09:30:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28335
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 134582
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 02:36:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 09 Feb 2025 09:30:31 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 5E8B 20 KB
8 KB 17ms
16ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 14:45:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9437
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 14:45:29 GMT

GET
H2 200 web.js Show response
cache-ssl.celtra.com/api/creatives/0c701435/compiled/ Frame 041F 408 KB
102 KB 70ms
15ms Script
application/javascript 108.157.254.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cache-ssl.celtra.com/api/creatives/0c701435/compiled/web.js?v=13-c8f4c26f2a&secure=1&cachedVariantChoices=W10-&isPurposePreview=0&eventMetadataExperiment=newMeta&inmobi=0
Requested by: Host: ads.celtra.com
URL: https://ads.celtra.com/57370bbf/web.js?&accountId=afa4a86e&clickUrl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCbHs35LDHZd_0Mevk3LUPjsW5gA6t4fPAdZb1uY6qEsrAw7OVQhABIM3_h3xgvwXIAQmoAwHIA5sEqgTsAU_QEBzuQXHUi9N0CKVtHIlJd_nZX8YhllbbY6UuHFpAuYVVE2KkSvwVPCo6x36XufmDs4qY50jPzfKbpHV65nI4T5eS9nxEEuJI5Cfaca_rD4dHLCl0X_fmlTvQ33dBTzJ43u6me7Jc0eSFMKpLV7Xue3wG-FApxZtVpt982jQAL_Szy9NKG1vCgMNvcUk8FS0Zuf3huS_YGVa290aZbogMTc6uduq_5yOjDyhz5W426P0fKb2M1Mq0jLVdyBfHvXg-UiOQo0JUgn5tCXXQicfAZyqsaKU_1pvFRBUGdfdwwwkins8HWinNpBCUwAT8re2M0wTgBAOIBYKf1YtOkAYBoAZNgAefvqjCBagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCQIgGEQARgfMgKKAjoJgECAwICAgIAISL39wTpYmtG916ShhAOACgGYCwHICwGADAGqDQJTR7ATi9i2FtATANgTCtgUAdAVAfgWAYAXAegXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_8-6RriRSJ1SKtlVRaLAV-68gmwmy6fT5UT55NGqMCnGu-T0wXxu5HLkvb8nNzdMGYKVXtY2JV5QvvWPWOX06iKSxXPPPVIOkGBgB%26sig%3DAOD64_1eUlrDmJPKvzW7REFkdPA1FQNEFQ%26client%3Dca-pub-2462751652998210%26dbm_c%3DAKAmf-DtAN6MzG5dftNeSnd1DvpzlAK4JZiLYcNxJkf5TLlQzxA874JF_MAw3TkwoWDCkeRsY7z39USJOIKTBd4mQVitEkRWA-dAdXPT3ziGBaBI8pkj0ReMKNJxZ9rdlxol5O4MZsFZeRUqLWqRSE00HOc9XMYRTy183K8uUklmrKPhmAM5Ob9cR3SAb4qj11i0gtMJvb2BUDl5kv7VNAac_WlvSEcPajFyG1wmvlN728UBr8h5QzQ%26cry%3D1%26dbm_d%3DAKAmf-ASxWnO1dD787UWdUgw2krmly2KMXOoOQKZZqHQIEzkPUYhv-4g6uTadm4tatGZ-trxJG6wZk5Ia_-Vg6ing6prgNm-8SD5N0GKCNQY3rXZmfoEkQgjPNq6jkoha3JZP8nrlSn6nLTaUDAtEZpAGZmMDDK5ruM2lZ5yyJInb4jU855RgqgS77xBl8p_ytrva6XQg84Aljpa2-Y3vlnNwRil98emle6MCyKmkZsoNnPA2K1nixcWFk-T11OczA0KnsawECWsT2MFdFolitj4WQjpvrDsf9TQKukRbtyaWlRFLPYl4RTFdaWukooOV7loTPMkfRtpK8JZTYgxgeQqPIOcihEchSBuqyYTcJHfAV0qqPKfNJaN6pCPyQtV8WgUT6Kc3YHhvKTy8Q-lqbyHhNeunfr94pUlpW3i_U25uA21Peg5nckxqFgBO3EeWX_w4C6CPJ5VX8xeQCxRgaf9CEwM4WvpbyDf4RxTl2ghaTl5BdkTL7RHgJDzYOOuutTdqgH-taMt-S8l7ZicVvkPcUkCZ2D8E36t7ATjBxuepHukJyg18cE2YRTmnfe11vJP4rH0sptPZNLNXgygJpIT_wefRnkY1vtkn-lQtH1MVdTpJ88bX3g%26adurl%3D&expandDirection=undefined&preferredClickThroughWindow=new&clickEvent=advertiser&externalAdServer=GoogleDV360&tagVersion=html-standard-7&eas.JHtDUkVBVElWRV9JRH0%253D=549883340&eas.JHtEQ19EQk1fVE9LRU59=AD1EzRQAAABpCmEKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhQIgp_Vi06oArDx0vkFsAKD1KLkA0AB0gIqGAAiEwjf9r3XpKGEAxVrMrcAHY5iDuAoATABOJb1uY6qEkACSAFYiIEgEMybmoYCjK8J1EZ4PYVhpXLpFq76CQ&externalCreativeId=549883340&externalSiteId=1945009568623&externalSiteName=https%3A%2F%2Fsecretmsg.xyz%2F&externalSupplierId=1&externalCampaignId=20962430850&externalSessionId=ABAjH0gdeyisoyGPiJDwHSE-A89v&externalBundleId=&dbmExchangeID=1&externalAudienceIds=&dbmPixelIdComma=&externalLineItemId=20962430850&scriptId=celtra-script-1&clientTimestamp=1707585765.314&clientTimeZoneOffsetInMinutes=-480&hostPageLoadId=6830623653723356
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.254.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-254-115.sin2.r.cloudfront.net
Software: Apache /
Resource Hash: 69094d54b689ffb2ed610fc5ae40dadcd2b48709a502843cfbbc43802c67feb6

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 07:17:18 GMT
content-encoding: gzip
via: 1.1 9683b5745ef5870755379e861e3a7520.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN2-P3
age: 295527
x-cache: Hit from cloudfront
content-length: 104086
server: Apache
etag: "f2c62f5c8a1715b1fb38aac7c7a16e40e8a66ded1722c0c0caecb9e33f1ff266"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
x-amz-cf-id: LOqY96SxFX5NJgSYOfnTsqMvVCgIZflmGb4mOKdNl7l-TnRPYDoZ3Q==

GET
DATA 200
OK truncated
/ Frame 041F 167 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d26432e661658ef9d3d538b1f71b1478193f6c141f1cd7dfed03e5b677d178c2

Request headers

accept-language: zh-SG,zh;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type: image/png

GET
BLOB 200
OK 3f15a90e-9405-4d0f-8f3f-ca67a335588d
https://googleads.g.doubleclick.net/ Frame 041F 167 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://googleads.g.doubleclick.net/3f15a90e-9405-4d0f-8f3f-ca67a335588d
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d26432e661658ef9d3d538b1f71b1478193f6c141f1cd7dfed03e5b677d178c2

Request headers

accept-language: zh-SG,zh;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Length: 167
Content-Type: image/png

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 041F 42 B
119 B 72ms
72ms Fetch
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstA57XL4O_h6wLpM1Io8lNg0Z5gZAuryh29i6auVwDQq-dFH81YtMo-umOOp7jYpJSwa9Ao3H0xbdCxvPVmbGZr17sdvYuVUgBD2o3KLB8vcXi24LK7yEvm_WilgfAfvG5O7VbleMWl2MLBDLWq1g&sai=AMfl-YSkk4-3HlIfN6iH11-B3aW5EsTK0ejzusmkGmftYPRliYCxym2xN3sFu50jb8llHRd2MR7R9yBPNTQEv_c_1kTVLj1px3GT5kn0ERWsK5ge2eBhHyrCpnlAYJ2m7K1yLY443QiAk8ZvK1qZg1v9&sig=Cg0ArKJSzGclvW6uB9PBEAE&cid=CAQSTgAvHhf_8-6RriRSJ1SKtlVRaLAV-68gmwmy6fT5UT55NGqMCnGu-T0wXxu5HLkvb8nNzdMGYKVXtY2JV5QvvWPWOX06iKSxXPPPVIOkGBgB&id=lidar2&mcvt=1015&p=0,0,250,300&mtos=1015,1015,1015,1015,1015&tos=1015,0,0,0,0&v=20240208&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=4288464822&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=351856500&rst=1707585765197&rpt=379&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 36BA 42 B
108 B 71ms
71ms Fetch
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvlRS24oCjh2afoQS8Bj6x1r3dWGhLyQD8lpnTKW6_QvZOVhKjJKUWUGkD85HtmqCWJ3zK4haOgbU6BAO3IzrZMkijYpVsgJNNx4YxPe1vQs6Q6sWKuHSI8y__tjyKKXgxcrpt3-_gA6AWBPZSk4i8Cs-Iu82znzuY&sai=AMfl-YQDWKyD_8CHSRuqq2JuBCBdoZSm48Pq0ZS6bm3_FatJrXvfNSVUmoE2qrV6uX1v67Y67ZDoLUZo-apFNd9MSDDTORkKcqPWhqIURKqwxJABmHnHsJwfvOWGM9MU9r_P3T1lYaQ3otDrWgpxQp0ySQ&sig=Cg0ArKJSzG3IIY5pUQIlEAE&cid=CAQSTwAvHhf_Z2cU-cUhGMlH6SeiNhz8S1mhbicV4-z3TY5CB6VxEok2fOd89xploa4gSlbB3wF-2zF8svh8gfXlUMDlojzSp9LoFfsFHgWJ3GkYAQ&id=lidar2&mcvt=1018&p=0,0,50,320&mtos=1018,1018,1018,1018,1018&tos=1018,0,0,0,0&v=20240208&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1492855027&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=351856500&rst=1707585764808&rpt=799&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6C76 0
56 B 64ms
63ms Image
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BMjvs5LDHZZL4MreC5t0P74mx6A8AAAAAOAHgBAI&bg=!MzClMH_NAAaxkZ3akZE7ADQBe5WfODpjZt4so6hQAVriv0Tyjq9K2aVlrkSixBgWyssaE0hKAs0IYBfQgo0HhfDwpvvZAgAAAQ5SAAAABGgBB5kC7MewrEmJtlKFaAXb8EW1kswJfj45x89HDxHwznMIfyZcLarwkv95ZXJiA-2L9nWdP4lvmdSQWWF8h-Qy0HOWl1L_E3J_grMSIIy-hFoSAdR64IJfTXqz6X0Z8WQ5qlPDqpR_u4CqzY7445VzQRqqL7U-iwg9OkJXzmnDsJ15uBdLbpj-zds1PujqFhZGeBSpeG_CuJ6R3vrEugVHbYWCEzKsEg-tPQVJDGsqHc8934PLfL-LbhJcjpXsOtyelOuZsU17lQt0RzH2J1X2LNUgGHRI3BAkRDpZX1Xli1Hmof1LmKfc9FjRq5yRss4t29dhg-thNn-CqaKmSW3IgqCUErEz8S8qr-GofMUp0leh0aueH2NkZLf6WodXGSOqgXceBDT6Lih8JiyYOHST5X3fW7LYgvH1aderrkD1zknj4gIXHg1mMjyoQN3FniBJmvwWQnJlU1gUHwsb_zhRYM_jWLN2qyDJSO8ysM00H2SyYFhQEQrXZWT5L2jt0tR_UctfH98PM0bYBcXs6xPusRtEeExU4kGQmRBYz2SPuhWAJ2CtYcsfPJI_WT1jUZuQkWLJwkJ79d2krDDbHACdSWbISl_52oIqU6-ofI6Zdd7dr95ZGHSA1WqwJlkD-NRJq0VBk0q1ixboiWr6op_b4aZIQBF8oM2bE_B0OKHg3jRpBB2l0b0CFe0BZjYRRaFomp-qkMKFNySwXjGwFgG07d2W8kYTLBGdS3SBgZwxiFG61TgtpG09Fjo7aFnkxpHS-V9pGDnDlZU9QCYOFZDmc9Q6K5s4ddvA-GCdkR4KxmLweOk1acAfNxOOQ6z9yLDQM1OdR3s01PY8Mfx97__aNd5EUUVByL1HP-sWrQ_gTaWUhaoX68Lmzy6I0P1-mMU-F_kAKlkyaXu109xzq9M25QXJ4YAH-Kcnoem5K2IV3NosqDCNM4lU1twyBIWyJswK8gRF0qEFHddYraAaCcUTk2nqU6ZEunMrc92D-xYkY9k

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CE36 0
56 B 61ms
61ms Image
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BQCpG5LDHZZT4MreC5t0P74mx6A8AAAAAOAHgBAI&bg=!PzylPHPNAAaxkZ3akZE7ADQBe5WfOB-1TBe2OojpYNlFXocWYUrxocdXiqy3QlTEn0YEQDZ3o_szFEyOqO8cUBQM6Z9rAgAAAStSAAAABWgBB5kC0FyLi4z5JkV7aPYOE65_Xul2TszBaRymTsHj8pPn8rtfSV7T7LPOR4qoSknIQdynwqxCAKWZXeKlQyjDq-PDw-LCj0_Li1YK9NY6j3uUzhcyDP8dWjw1MM8muISJToOKJCJocPIHGJdVbKeNskoI2FLGIIEUClyzMLNbkQ5l5ZuVy_H3VkNQP2lFtcUJDiCOIWXWnHBGf5DBSFJzWj1tYhuZqyl0CpoWo98nLzz_jJobsT3HyeJ5tX1CyCe6qcbLadAosO9BgiAAdwjDmGsYpFJugBRw0-KtidKAGuHx_wMLOFNJl_zT6FRStDzi_vq8UbU8-9OSo_bav8E3AmmSPWe-L9mz42YXATOTOLeqWjfA_Mr7_1YRkdrQh69LbU5OHr2LIYXFML7DiNlMWqmy61Ya6zuZwhnH_NbZdHthe5WYosQK-95XRFPNz4bvoY1UOYOpSr4fgjhCgl3lgZSG3Yj9y-ylMb0VCPRTd4VWTuVzwTqOzHpc6_RZkdZgABrfLoUouMtDFOIL_roFp2bzUwc0GmoMFl6J5oFt-RqzPO2i3n6226BtImUMx6QSgIh-W7K073YxzLFxzO6WUWRq7_oWIbkZIW6YK9rwCrvIt0nyLoC9miUZlGmhfi1G7g4LFBEAY7BGHxCs1ItS3hR2xlNe4LxhgHbVEPKQKU7-LDj-U3OVOmZpfF0LG2cSzkdPvdMivyJ6yjbSHA5YXvRu463XnFtlPwIpqUmFRa0xbzrBw8bzRtMrydt5dxJDcvGpIlXnjBGcSlGk6IbFSIYTPXkvNUHE-liALd44wpWcd-oxwXXLX6z4Zv6KgLvCO0x4K_G8SqlQDrf155VJI7iKywiicgiR58EZR6R7LQ9YOqJOV1keP6ds7zq-Xl54N8kIajJ9wCtQ0-XMeahOOc8BffFdbJSfSor8-tJLuOMnHUmAe2weuhoKBqSw6F2QoA5qEA

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A7D8 0
56 B 63ms
63ms Image
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B_-2T5LDHZZP4MreC5t0P74mx6A8AAAAAOAHgBAI&bg=!_v2l_bLNAAaxkZ3akZE7ADQBe5WfOPVg_V60VEqg-OEy1BDeGL-t6RBCyQg-uO1tfpMsnUV-FHzRR1Lx9wyi7WnW76SqAgAAAQNSAAAAA2gBBwoAjIOWXdXH5rVLVTKbi2C2krRs4kwkD5M-wnGxmtnq8TrEH8IgUS8dj2t5advqUvos77rpsbG7rqLiZQFJU1VcuHLwH4cOROcbc0vYIH-JClfCqKaqoPJTv5umVCIMy4dNtSItKuDK-WzbTfnDzg6aIBz69TaTel57AGXSxuVr_NU9yJaEbtCWvajNrthrmQLf3t3Plh569a2Z1xxVYT7QPSfqkkyA3dCc1WNakodgp-Fa_wqPGcBJxaZAAXpS3WEcocn0_Tp55HyxN1gY8JLqIZixlkqAUfhbwzWsY5Q8niBS9O8ajdwqBH1b3DF7_lLlzyO4NIwFE2fwY91aGa-a1DY1gjQVhR4PH6EzaOo2Z_-4AGvvVwN1UMBxEpRojd_nkpBxcwmO3_VwSq0PzhXdMifEG8eZtzGR3cPIq2gTwI_ugAwY_CKWYxoN074fJgQ8dVM3fSQbRr3ZGvEKfaBw1p6F0E5nhw5_WGkD51k-sxWRLyZ50hsUova9jokcOk64JSUXR66_8c2I5OtyTto9O302yaVASdp3rw4v-U4SzU75r4STFfLu8xghguIuxCMZr-odIiKshElYFdD7fVXnZBbx8U92QGRkQr21Ahh_TCuU6MfhZQ-IC-jlQO5mJYWtJImMeNpSvh2EKfddYTi-N4XGRuY0WVBOporfatRvJ3YEAXJ2xmaTKJL4hggeGBqf2w346oeqEQ1n6t_vl8qMUj-BoZof8cujyEbNYOoTp63tskMmRaUoGcjewL-Td4UfDDCU8BY-que83ZVuDH1DmMhN1BZc2BbTQ_7FHNykxTH33F-ZglUtq-QRQxZ8QRPH0AN03Te3C7NOzOoZ-uF_bESk0OPJ8YZjTHXYjmW7crvAZVqCRmNor5O-flJfU01aK_MMilksb9rGAez8RMi6V5GS3aDQf0ZB15odeLcu6xZPHXHqYk-fa6d9Pu-28hlJSEgoX2eC_3EUpRwPZvCHrGcP6GvTz7tL4bhO8zK-j6s_M1xtYPkmmiYTw1aTFmCjdyTVsnHyUQzBFvNwhU3JhuPw-TIGTMFovPHWfrwcAMl_tiWx6ttSruCMZe5fyp-UEhX550JcdV0cK4acinIGJZK4DTnU5JCEHhVCJ_peoxdPr7wjSg8-RRa7Jht9GLit0_16Rc3g2f__sDi8tm_L

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNzA3NTg1NzY2eDNmMDdmNTc1MDNiNDQ1eDAzMTgyMDgzIiwiYWNjb3VudElkIjoiYWZhNGE4NmUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI3MTIzOTAzMDQyMDY2MjUxIiwiaW5kZXgiO...
track.celtra.com/json/ Frame 041F 35 B
242 B 1244ms
300ms Image
image/gif 54.208.141.233
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNzA3NTg1NzY2eDNmMDdmNTc1MDNiNDQ1eDAzMTgyMDgzIiwiYWNjb3VudElkIjoiYWZhNGE4NmUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI3MTIzOTAzMDQyMDY2MjUxIiwiaW5kZXgiOjAsImNsaWVudFRpbWVzdGFtcCI6MTcwNzU4NTc2Ni43NTksIm5hbWUiOiJ1c2VyRXJyb3IiLCJ1c2VyRXJyb3JJZCI6Im5vbkZyaWVuZGx5SUZyYW1lIn1dfQ==?crc32c=1412187987
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.208.141.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-208-141-233.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Date: Sat, 10 Feb 2024 17:22:47 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif

POST
H2 204 csi
csi.gstatic.com/ Frame 5E8B 0
234 B 1771ms
724ms Ping
image/gif 142.250.187.99

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~lsgch68r&c=8260020958297&slotId=4130010479148.5&qqid=CJD6vtekoYQDFTeBuQUd70QM_Q&fb=outstream-lima&sei=44752538%2C75259414%2C420706098&nsei=44714510%2C44729911%2C44730425%2C44730426%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.187.99 , United States, ASN (),
Reverse DNS: sof02s44-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:48 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5E8B 0
56 B 68ms
67ms Image
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CyVPR5LDHZZD4MreC5t0P74mx6A_NqNizddmnkse4Es3V-LGDRBABIM3_h3xgvwXIAQWoAwHIA5sEqgTuAU_QY7xkg5HZk6_uHPpWVX16mYBhw2z1dhjGn1vlCjj3VgaqP163HkPLR_59zAJtQP2GzK38ShzCvYBP0vTDD2CJtCEY5OI3L4ldRJm50T-J1klMwrFbsp4KDhK5-yTy3PNCJa2SbTE01udsC3NEoIJBK51psZPLdiNsA5syN4uCt4uwod7C_qI_rbKl7OM6Ketxet1Xl58wLNzq0Hio_DBp2qU_jdX-1x4QYKTJk36YCsG4CLaTNVMThj_VnEz3XcgOMs6583ChMwHA4UU8e9Kg0mBhthKRSqQu6GcWGJfJHVxE03yWH3cKBSjFgzXABMSA6aTSBOAEA4gFn7aYiU6QBgGgBnaAB4aGn8YCqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIJAiAYRABGB8yAooCOgmAQIDAgICAgAhIvf3BOliVkr3XpKGEA4AKAcgLAeALAYAMAaoNAlNHsBPPuLcW2BMKiBQC2BQB0BUB-BYBgBcB6BcB&eventType=clickstring&clientTime=1707585766883&ai=CyVPR5LDHZZD4MreC5t0P74mx6A_NqNizddmnkse4Es3V-LGDRBABIM3_h3xgvwXIAQWoAwHIA5sEqgTuAU_QY7xkg5HZk6_uHPpWVX16mYBhw2z1dhjGn1vlCjj3VgaqP163HkPLR_59zAJtQP2GzK38ShzCvYBP0vTDD2CJtCEY5OI3L4ldRJm50T-J1klMwrFbsp4KDhK5-yTy3PNCJa2SbTE01udsC3NEoIJBK51psZPLdiNsA5syN4uCt4uwod7C_qI_rbKl7OM6Ketxet1Xl58wLNzq0Hio_DBp2qU_jdX-1x4QYKTJk36YCsG4CLaTNVMThj_VnEz3XcgOMs6583ChMwHA4UU8e9Kg0mBhthKRSqQu6GcWGJfJHVxE03yWH3cKBSjFgzXABMSA6aTSBOAEA4gFn7aYiU6QBgGgBnaAB4aGn8YCqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIJAiAYRABGB8yAooCOgmAQIDAgICAgAhIvf3BOliVkr3XpKGEA4AKAcgLAeALAYAMAaoNAlNHsBPPuLcW2BMKiBQC2BQB0BUB-BYBgBcB6BcB

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 5E8B 0
54 B 1760ms
724ms Ping
image/gif 142.250.187.99

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~lsgch691&c=8260020958297&slotId=4130010479148.5&qqid=CJD6vtekoYQDFTeBuQUd70QM_Q&fb=outstream-lima&ulv=1&cll=0&met.4=arp_a_s.1mo&vast_v=4.0&icc=1&icrh=0&icri=0&icrs=1&icru=0&icp=GoogleWhyThisAd&icdi=18x18&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.187.99 , United States, ASN (),
Reverse DNS: sof02s44-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:48 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 5E8B 30 KB
18 KB 108ms
66ms XHR
text/xml 74.125.24.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-CSyFG2_psKLAjZRGDpMCwvregEvFlGnJPfPzNZX8JuGurvzBWRsR7lvo7dZIWW5tQvCF98qvKPolStVdGfXHeToAVTQg&cry=1&dbm_d=AKAmf-Ar0tAGN9B_9TcVvQm-x0ETczlUUuAJYAs1P0IgTDGHTdT3irC3Lehp1ayW7X69i2pb-dfxGcCrjKjUlcvh7qQr4dK-IGJxNoSoCePMiN-OLIqqOU80MKFvAbTc56vzdRPQYYAD9eWi37EeH334JuX9ngT8ZMct0OOAgOHD9w6rYyrRD5Z0JvpYrVxsJHT_aWQjX0ikqQBzpzQFZW-moMn7xFp38Sf6MzB5aXBPXPM0FYQKju95hl5UgaLtx-fabby_FqoMAPX1vCE_Wt5tSyf-ej5CbUiMPJLpbGG3A54hmW1kUiMZIUm3zkv4udqGGMTpn-PwblJHGGvO3B8_T13ErDUw_KmcpN3WzCi9i2-qa8Vwuu3c1bUqioSn69B07ykAATe-tGPmxi1XXaGh8xvYa2OY9XwipFR3dOPCODu6bYA0p7mM2Iz_68oUi2LeGpLweihLKfEMx30sJALmTBxnJ0rSHZAAS9UaBbZ5IcYMHmr7yMr-FZlxXto5Yh2G_yaEu6G_mK2u_5BThip2wBNQ-zV_mMOUHO0wxve7uQInMR2i91SPiym8DIIMzLyAKwilKEdKWaFRGSil7WyTZ79zXXjadiWEHa3L--AHCo_3ftFScllrfFOQ5wv_9o2LQMohWviagg4h_HAp0XBFOGpfvBuajYxrODsQiJGu857qo9ugAlgGX35o7-hetp2G7nxrq7HMMkY0sXLJUCQgtikUF8jVEmuE_Tk44EkSkrHILgOBSWcv4ZJOujJ6RD29dohjNf3CDv091cw5O2YTvLiUGlk8SaNeamvobcP5wiqYwpDNO--UpYJ9tMDSCifVjZRrk_862xB9QA-V3K4w0dycxvhpSINgUIgsUcMKVhvpeBSXVCXSO1LHtl2T4mUIAmQkmPd8k39iPjunt9TbQHfVT7Y_BLB3jwEVFdTknnohc7m1YqhjkCYMgmQnnjsvaPsIa_aXgUZblTg8JCSLCtY8U7Z4rAxDIbFFa-bJ_oLlTkCjeTGZiokVUM8GbZMco2MG7EQvMY0NAN2pGV-MWAl0276uQJfNzhV5arcRwYfO2dMJXZUs2wZfHORtWkgA1KT-8Gni8AoRc9mePpJ9d9KmKbHjOZHuaTRMfABqecuhRuc360bqoBhKbwuo96WEVZKKP_TaeEwvvZp4Kuv9-bLjZbqb8qPxi5hwfShS47eUHYFhJD2qIABXQi6EaoVyvVRogrLRUIxxPbmNIhSafgyseMlLCQAGbGkQ18XKhwLkW8EYZoVf2HNrI0QRPzcXQ-I6jmMINFyRaBvPQzqw-F-e3yEtEPJq936bNJRwtIWsAuy7I_8V4JEWZ-qpq7o-f6B0_744r6Ol_z23ugNLLWb278VqR0j48FZEKq5PRMQcAbUtd6LLvGFlK4-d92bIxOJM7C8BUKIQ6OKwhda2PDVXRwcrYChkjArrdZZzZ2AQnWy29dZT3kikFryXnWon-n6JUA_HECxy5jDlpKh80PvWoLK8i-JQnHrCijdJFtcABvlmoQzkvZEQ7ZWucGUE9jShgvAJthFN8o-QgIuL8l2Oev0Sf2AtK6GMsh7jtNJ875BCqFGOUTOm4xFqK4jFOsAZaqvY42Q6exqqD_XIND9Vjf5ep6rozHbTyXGYEtHpUZZSIYAeRkmOT6iCrRL9r9iWn9MRaRAdXjmv88X-f3mNRk1llQoZc3XquqfZATyZEy8kbRKC_Edwg6la7fMqOFF6MMj8QYoYMRfKKVOdbAVWlA-M91dV3-FSHr48GkA3NmpDYHtrKxB_gKo-IRphRgNaaRYPAEqW-eadiUInSp_ac_eHS1gd1mz3qGNol7OtEcBwqQOMs6pUQ2lO7pJfCyT5u7js6hHCzlF6S3r0NPtOf7RmRqjNeA56Uk4VAOa1KvBiZP0FCWfN8QZQaqhPmt_2vwBZRwCsD0l0BPypp-wZR-zP9MhXY98Rww7y0BhWcjSRXfebFMvwbD1RaFae3n2VBgq_K6yUOklE048vVj23ZPQir6n1KlA_mz-NvgM41xIpQOfak1Xvxby9xLEnb2aR6niCO2ZfsQsVXDDvcfyQCayLS_e6UO5anQ2wIDcI_flx2fqH8peDVizbXk6d_K1VrHfsnVCxcuh9P_0DlCauawX9DmiDSSyThsPny6zxrqldTDoASc6IBA7rm3Y1a6sFTpXXDGV1VizZdcOUFrLjNfJ5LpA3s2woj7UPZUccC3RGOuO2ZP6nQidabg2zyUFrRmxKuqDRhn2my6XpF3LW06luddmyUJDtwkwAkn124g4v3Kx61l3cDKVWyKdpBEq1_rwRbSj4ppf04E5gefBrKO4wuoFSPo8mEk5wuNyunD-7kkl-wPgRYnz1N7XsXKZL9rLJKd7uhI1NfJAn-LFTrzNWd4bMctdT6gbD24xqVTobI6WyCoRpTcZGqMENOy8Rfpoo_YV1oYWaVvLOevPyrD2XBbl0AFNOzupCf4ZZY0WNwTC4rD369ajEoHkBFTPuv9FHru-uEKxDye4esy3gaW_OWO6R7MLKZm8hmAhKZcWDpAGqM8c-iNq57BUlM8kjRRc-Ee0Kggb9Fw-qJpCoZc_ZKgEy_mm1JgvvWkrjYRVoPAyvxRVBbcnJliQG4Cii4bBixywOwZ5702djdJRM_GiNhlUTH27qGrNMgjS2NoX8hAMRhsbub6m7GCWxafgOo7Hgmm7aUK62kakMzw73wK7kPu0kGCgOGVeiJ0cITeJojh1EqvB2xf5fQQrBjJWxIuqJSkPm-dRc-mPDgV4pB6e16clXv5sHaLCxK6gMl-kg99DUAE8o5vYCX86m1eSbMoUDk638EYQQ11htCgr6Ow6BtVwWJ61XkgpJ46nbV8f-vCqZjv9A9zm0e-9moeV6Zw1hQafkuEyi9MAjVEEFyzQ4bbrMeDKfNYjCVl5_9gws_xvpbEOy77Y3-CfvPOxZSF99_G9weBLb8IoUt93kYWGCPBoaoCVa7G2eL4sZmoUsZ193hwEQ1ceCOCeSCe0pDVWSVfVKP-Nlf--vq75oAFSuOqoRrEJ9f_Q4PsmWGzUJw13ZgFCPg5vog-jUN4Y1Od_Ec2IanPtz6ko_sHR79ZjjDylFHB6GveKfeBM4RcoLuHUoPPmMPehiuYYTIqqixkAnUvFXZbvNNzTy5VM_uzdzEx8aHEWync_5ZEvqNlKRfi2Q3GtBImFrIntXen-b1V3gfjVyi_aNNa79oNjK3mIMfq6W-0sRTrBGd2_Yzmx1dRK8V8YzjLcaRf0lVeWMkbelKBodMMcRARJcI8Uf3-2AkKgaDLnqNpgr3-qa5rffnyQFNoIoR1OIUR1cO08DmdCJFr88W3Ldu7GVaLcBdWbpacEB0dQCYmWLQXXZFPlMlynAnfp246ZjcY_IQxj1JEChTBpWVnqZNXEqQoNOi5ikPNbUFa5dNpbKDBNBvVaF8vMFwCgi5R5pEIJZ4PKsrHm1KgCAzdVTS818yd3vOXSLFw&cid=CAQSTgAvHhf_AzgQRaEZMgDRfvTyqW5y0GjsiXFQJwegnnAOZl6kKSPki0D5aHHGhNqXVAyJ_4i1N-ZtTQlqc6kSDczW72LiDzB90A3ZfMoovBgB&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1&nel=0

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f157.1e100.net

Software

cafe /

Resource Hash

7fab5f1a97ddfb94492b26360f38d605a997b005edca1ae6da956cc3a160e003

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17864
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1.jpg
cache-ssl.celtra.com/api/blobs/2012e9c496ad99a7188f5b4e6347667be02b1fe5851ecc1bc3f2b50d51f46f49/ Frame 59B5 213 KB
214 KB 18ms
17ms Image
image/jpeg 108.157.254.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/2012e9c496ad99a7188f5b4e6347667be02b1fe5851ecc1bc3f2b50d51f46f49/1.jpg?transform=crush
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.254.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-254-115.sin2.r.cloudfront.net
Software: Apache /
Resource Hash: 503a0684d5b38534bfe05b789c87b1073fb98753cd1981703a132db6b29e6bff

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 29 Jan 2024 16:01:54 GMT
via: 1.1 9683b5745ef5870755379e861e3a7520.cloudfront.net (CloudFront)
server: Apache
x-amz-cf-pop: SIN2-P3
age: 1041652
etag: "503a0684d5b38534bfe05b789c87b1073fb98753cd1981703a132db6b29e6bff"
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-length: 217986
x-amz-cf-id: 25439qNKq2mITePuubeseFbtSTEV0BSmozND1-Su5tveurom27_ZqA==

GET
H2 200 1.jpg
cache-ssl.celtra.com/api/blobs/2012e9c496ad99a7188f5b4e6347667be02b1fe5851ecc1bc3f2b50d51f46f49/ Frame 59B5 213 KB
214 KB 25ms
25ms Image
image/jpeg 108.157.254.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/2012e9c496ad99a7188f5b4e6347667be02b1fe5851ecc1bc3f2b50d51f46f49/1.jpg?transform=crush
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.254.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-254-115.sin2.r.cloudfront.net
Software: Apache /
Resource Hash: 503a0684d5b38534bfe05b789c87b1073fb98753cd1981703a132db6b29e6bff

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 29 Jan 2024 16:01:54 GMT
via: 1.1 9683b5745ef5870755379e861e3a7520.cloudfront.net (CloudFront)
server: Apache
x-amz-cf-pop: SIN2-P3
age: 1041652
etag: "503a0684d5b38534bfe05b789c87b1073fb98753cd1981703a132db6b29e6bff"
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-length: 217986
x-amz-cf-id: gPp3gAw22CUzrLWA0tkX2jn5-GmA6iKLMbA-E87zKskmvg9Sc61hJA==

GET
H2 200 close-up.svg
cache-ssl.celtra.com/api/static/vc8f4c26f2a/runner/clazzes/CreativeUnit/ Frame 041F 1 KB
997 B 25ms
25ms Image
image/svg+xml 108.157.254.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/static/vc8f4c26f2a/runner/clazzes/CreativeUnit/close-up.svg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.254.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-254-115.sin2.r.cloudfront.net
Software: Apache /
Resource Hash: d350cd3c1e1805977e3c9cd865c588fb33f853d94e07e59530a5417bcbd2245b

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 07:17:13 GMT
content-encoding: br
via: 1.1 9683b5745ef5870755379e861e3a7520.cloudfront.net (CloudFront)
server: Apache
x-amz-cf-pop: SIN2-P3
age: 295534
etag: W/"d350cd3c1e1805977e3c9cd865c588fb33f853d94e07e59530a5417bcbd2245b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-id: s3-nrI8tOMICbyhuhuCB7l_10dflivB2EroI-HbtKO1rC6qVxfSipQ==

GET
H2 200 close-down.svg
cache-ssl.celtra.com/api/static/vc8f4c26f2a/runner/clazzes/CreativeUnit/ Frame 041F 1 KB
1 KB 26ms
25ms Image
image/svg+xml 108.157.254.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/static/vc8f4c26f2a/runner/clazzes/CreativeUnit/close-down.svg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.254.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-254-115.sin2.r.cloudfront.net
Software: Apache /
Resource Hash: 93810046cf5293dcb79678f9e2301587886e4944044b113f03429b5650ef02c0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 07:17:13 GMT
content-encoding: br
via: 1.1 9683b5745ef5870755379e861e3a7520.cloudfront.net (CloudFront)
server: Apache
x-amz-cf-pop: SIN2-P3
age: 295534
etag: W/"93810046cf5293dcb79678f9e2301587886e4944044b113f03429b5650ef02c0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-id: tJGFmSUKNU_4o6WWGCuVFmZKIIP9rob9E_xA5rFYtesOk_0q1D-b9A==

POST
H2 204 csi
csi.gstatic.com/ Frame 5E8B 0
54 B 1632ms
724ms Ping
image/gif 142.250.187.99

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=3~lsgch69c&c=8260020958297&slotId=4130010479148.5&qqid=CJD6vtekoYQDFTeBuQUd70QM_Q&fb=outstream-lima&vast_v=2.0&vmfc=11&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.187.99 , United States, ASN (),
Reverse DNS: sof02s44-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:48 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 5E8B 41 KB
15 KB 16ms
16ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 16:49:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88413
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Feb 2025 16:49:14 GMT

HEAD
H/1.1

200
OK

file.mp4
r4---sn-npoeens7.c.2mdn.net/videoplayback/id/b6fd46dac557d9c8/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1739121766/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 5E8B
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/b6fd46dac557d9c8/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1739121766/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
https://r4---sn-npoeens7.c.2mdn.net/videoplayback/id/b6fd46dac557d9c8/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1739121766/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

370ms
16ms

Fetch
video/mp4

209.85.228.9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-npoeens7.c.2mdn.net/videoplayback/id/b6fd46dac557d9c8/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1739121766/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/22B2F1E22D30D3697B07CE431DAE89B583895704.1B378B4B2F9A9235D8186C3982E251357645B8D1/key/cms1/cms_redirect/yes/mh/ZW/mip/222.164.167.113/mm/42/mn/sn-npoeens7/ms/onc/mt/1707585387/mv/m/mvi/4/pl/20/file/file.mp4

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

HTTP/1.1

Server

209.85.228.9 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sin11s30-in-f9.1e100.net

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Date: Sat, 10 Feb 2024 17:22:47 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 6145186
Last-Modified: Thu, 18 Jan 2024 04:01:31 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Sat, 10 Feb 2024 17:22:47 GMT

Redirect headers

date: Sat, 10 Feb 2024 17:22:47 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 645
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
location: https://r4---sn-npoeens7.c.2mdn.net/videoplayback/id/b6fd46dac557d9c8/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1739121766/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/22B2F1E22D30D3697B07CE431DAE89B583895704.1B378B4B2F9A9235D8186C3982E251357645B8D1/key/cms1/cms_redirect/yes/mh/ZW/mip/222.164.167.113/mm/42/mn/sn-npoeens7/ms/onc/mt/1707585387/mv/m/mvi/4/pl/20/file/file.mp4
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://googleads.g.doubleclick.net
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 help_outline_white_24dp_with_3px_trbl_padding.png
imasdk.googleapis.com/formats/wta/ Frame 5E8B 453 B
585 B 16ms
15ms Image
image/png 142.251.10.95
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imasdk.googleapis.com/formats/wta/help_outline_white_24dp_with_3px_trbl_padding.png?wp=ca-pub-2462751652998210

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.95 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f95.1e100.net

Software

sffe /

Resource Hash

e519cc4b7b8fdc64a7aaafc1b808cde266a234205aac0d6c55589c12446d565e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:47 GMT
x-content-type-options: nosniff
last-modified: Wed, 13 Oct 2021 14:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: image/png
cache-control: public, max-age=3000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 453
x-xss-protection: 0
expires: Sat, 10 Feb 2024 18:12:47 GMT

GET
H2 200 adsx_728._468_60. Show response
fundingchoicesmessages.google.com/f/AGSKWxUIL4jRE5ozXtkdcnLqNAFPz4vH1tqDOCdNdl4s6IAA12ta3OsInjuxwCwsljEckzAq1MNRt_AoXt2OndtqOA7kBkJOnQpRMPwqxjE258IO0Ls8hjCuURJDB3XjVse8_skJ5Cfjgjx-9sbyzPA0TS2aejLAR... 54 B
529 B 25ms
24ms Script
application/javascript 74.125.200.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUIL4jRE5ozXtkdcnLqNAFPz4vH1tqDOCdNdl4s6IAA12ta3OsInjuxwCwsljEckzAq1MNRt_AoXt2OndtqOA7kBkJOnQpRMPwqxjE258IO0Ls8hjCuURJDB3XjVse8_skJ5Cfjgjx-9sbyzPA0TS2aejLARZwxlfUbBarWnBEWZABsc98nuK-2gfg=/_/Adv150./cdn-ad-/adpanelcontent./adsx_728._468_60.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.zh_CN.M0ZgdamONNs.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMz3S4N9oM-wD_V8XevqnUZAot4NBQ/m=ad_blocking_detection_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ea262902953d44d10ce8f60777393ad94fe5ece1bd63182ee65004c438d43953

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-Nfl6J6_tiCCY09K4j7V6gg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:47 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-Nfl6J6_tiCCY09K4j7V6gg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjWsKoxSXFEKQhxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyBm_POCiROI3315ycTx9SWTBBCrAfE7yVdM34B4h48Hy5vw6axsEdNZ4-qms-YAMd-66aya66ezbjkznXUPEMc8n86aAsSLWWewrgbiKYEzWOcAsVP6DNYAIP6cOYP1NxD71M9gjQJiIW6O5w_nrWMTeDCtQxEA5IRJyA"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 google_top_exp.js Show response
pagead2.googlesyndication.com/pagead/js/ 47 B
146 B 17ms
17ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/google_top_exp.js?fcd=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 22:12:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69042
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
server: cafe
etag: 13036835877489095579
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 22:12:05 GMT

POST
H2 204 AGSKWxULnvPOdlfjMXbZtqMlGmHP_GucvbN2gXy1TEkTUFapr1Nhx2HkmGirzvh9ucmbetGzg4J35NTQyTimHl-45ujBjRt6zNY2SrbCd8omgjKgbq-2tt3FwCblDeVNOLflIvI0my6f Show response
fundingchoicesmessages.google.com/el/ 0
1 KB 670ms
25ms XHR
text/html 74.125.200.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxULnvPOdlfjMXbZtqMlGmHP_GucvbN2gXy1TEkTUFapr1Nhx2HkmGirzvh9ucmbetGzg4J35NTQyTimHl-45ujBjRt6zNY2SrbCd8omgjKgbq-2tt3FwCblDeVNOLflIvI0my6f

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-vgC8IpW0pn_aclD6_jGw7w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 10 Feb 2024 17:22:47 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-vgC8IpW0pn_aclD6_jGw7w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtHikmLw1JBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hy5TAGaxzgNgpfQZrEBAL8XA8fzhvHZvAhs9PrjIBAAYqGVQ"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://secretmsg.xyz
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNzA3NTg1NzY2eDNmMDdmNTc1MDNiNDQ1eDAzMTgyMDgzIiwiYWNjb3VudElkIjoiYWZhNGE4NmUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI3MTIzOTAzMDQyMDY2MjUxIiwiaW5kZXgiO...
track.celtra.com/json/ Frame 041F 35 B
242 B 1386ms
535ms Image
image/gif 54.208.141.233
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNzA3NTg1NzY2eDNmMDdmNTc1MDNiNDQ1eDAzMTgyMDgzIiwiYWNjb3VudElkIjoiYWZhNGE4NmUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI3MTIzOTAzMDQyMDY2MjUxIiwiaW5kZXgiOjEsImNsaWVudFRpbWVzdGFtcCI6MTcwNzU4NTc2Ni44MDYsInNjb3BlIjoiZ2xvYmFsIiwidXNlckFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMS4wLjYxNjcuMTYwIFNhZmFyaS81MzcuMzYiLCJvcmllbnRhdGlvbiI6MCwidG9wbW9zdFJlYWNoYWJsZVdpbmRvdyI6eyJ3aWR0aCI6MzAwLCJoZWlnaHQiOjI1MH0sImhvc3RXaW5kb3ciOnsid2lkdGgiOjMwMCwiaGVpZ2h0IjoyNTB9LCJuZXN0aW5nIjp7ImlmcmFtZSI6dHJ1ZSwiZnJpZW5kbHlJZnJhbWUiOmZhbHNlLCJpYWJGcmllbmRseUlmcmFtZSI6ZmFsc2UsImhvc3RpbGVJZnJhbWUiOnRydWUsImlmcmFtZURlcHRoIjowfSwicGFnZVZpc2liaWxpdHlBcGkiOnRydWUsInJlcXVlc3RBbmltYXRpb25GcmFtZSI6dHJ1ZSwidG9wV2luZG93TmF0aXZlUkFGU3VwcG9ydGVkIjp0cnVlLCJhbGxvd05vbk5hdGl2ZVJBRkZvclZpZXdhYmxlVGltZVVzZWQiOmZhbHNlLCJjbGllbnRUaW1lWm9uZU9mZnNldEluTWludXRlcyI6LTQ4MCwic3VwcG9ydHNDb250YWluZXJWaWV3YWJpbGl0eSI6ZmFsc2UsInN1cHBvcnRzQ29udGFpbmVySW5pdGlhbFZpZXdhYmlsaXR5IjpmYWxzZSwidGFnUGFyZW50V2lkdGgiOjAsInRhZ1BhcmVudEhlaWdodCI6MCwiYW1wRGV0ZWN0ZWQiOmZhbHNlLCJhbXBOZXN0aW5nTGV2ZWwiOiIiLCJzYWZlRnJhbWVEZXRlY3RlZCI6ZmFsc2UsImZldGNoU3VwcG9ydGVkIjp0cnVlLCJhc2FwRW5hYmxlZCI6bnVsbCwibmF0aXZlUHJvbWlzZXNTdXBwb3J0ZWQiOnRydWUsImJlYWNvblN1cHBvcnRlZCI6dHJ1ZSwiSW50ZXJzZWN0aW9uT2JzZXJ2ZXJTdXBwb3J0ZWQiOnRydWUsImlzTXV0YXRpb25PYnNlcnZlclN1cHBvcnRlZCI6dHJ1ZSwid2ViVmlldyI6bnVsbCwiaXNXaW5kb3dPcGVuTmF0aXZlIjp0cnVlLCJwcm90b0xvYWRpbmciOnsiZGF0YUxvYWRTdGF0dXMiOiJzdXBwb3J0ZWQiLCJibG9iTG9hZFN0YXR1cyI6InN1cHBvcnRlZCJ9LCJuYW1lIjoiZW52aXJvbm1lbnRJbmZvIn0seyJzZXNzaW9uSWQiOiJzMTcwNzU4NTc2NngzZjA3ZjU3NTAzYjQ0NXgwMzE4MjA4MyIsImFjY291bnRJZCI6ImFmYTRhODZlIiwic3RyZWFtIjoiYWRFdmVudHMiLCJpbnN0YW50aWF0aW9uIjoiNzEyMzkwMzA0MjA2NjI1MSIsImluZGV4IjoyLCJjbGllbnRUaW1lc3RhbXAiOjE3MDc1ODU3NjcuMDE5LCJuYW1lIjoiY3JlYXRpdmVMb2FkZWQiLCJ2aWV3YWJpbGl0eTAwTWVhc3VyYWJsZSI6ZmFsc2UsInZpZXdhYmlsaXR5NTAxTWVhc3VyYWJsZSI6ZmFsc2UsInZpZXdhYmxlVGltZU1lYXN1cmFibGUiOmZhbHNlLCJjZG5WYXJpYW50Ijoibm9uZSJ9XX0=?crc32c=3598589148
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.208.141.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-208-141-233.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Date: Sat, 10 Feb 2024 17:22:48 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNzA3NTg1NzY2eDNmMDdmNTc1MDNiNDQ1eDAzMTgyMDgzIiwiYWNjb3VudElkIjoiYWZhNGE4NmUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI3MTIzOTAzMDQyMDY2MjUxIiwiaW5kZXgiO...
track.celtra.com/json/ Frame 041F 35 B
242 B 1384ms
551ms Image
image/gif 54.208.141.233
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNzA3NTg1NzY2eDNmMDdmNTc1MDNiNDQ1eDAzMTgyMDgzIiwiYWNjb3VudElkIjoiYWZhNGE4NmUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI3MTIzOTAzMDQyMDY2MjUxIiwiaW5kZXgiOjMsImNsaWVudFRpbWVzdGFtcCI6MTcwNzU4NTc2Ny4wNTYsInVuaXROYW1lIjoiYmFubmVyIiwidW5pdFZhcmlhbnRMb2NhbElkIjoyLCJzY3JlZW5Mb2NhbElkIjpudWxsLCJzY3JlZW5UaXRsZSI6bnVsbCwic2NyZWVuSXNNYXN0ZXIiOm51bGwsIm9iamVjdExvY2FsSWQiOm51bGwsIm9iamVjdE5hbWUiOm51bGwsIm9iamVjdENsYXp6IjpudWxsLCJpbml0aWF0aW9uVGltZXN0YW1wIjoxNzA3NTg1NzY3LjA1NiwibmFtZSI6InZpZXdTaG93biIsInZpZXdOYW1lIjoiMzAwIHggMjUwIiwiY2xhenoiOiJDcmVhdGl2ZVVuaXRWYXJpYW50IiwiZGVzaWduU2l6ZSI6eyJ3aWR0aCI6MzAwLCJoZWlnaHQiOjI1MH0sImF2YWlsYWJsZVNpemUiOnsid2lkdGgiOjMwMCwiaGVpZ2h0IjoyNTB9fSx7InNlc3Npb25JZCI6InMxNzA3NTg1NzY2eDNmMDdmNTc1MDNiNDQ1eDAzMTgyMDgzIiwiYWNjb3VudElkIjoiYWZhNGE4NmUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI3MTIzOTAzMDQyMDY2MjUxIiwiaW5kZXgiOjQsImNsaWVudFRpbWVzdGFtcCI6MTcwNzU4NTc2Ny4wNjIsInVuaXROYW1lIjoiYmFubmVyIiwidW5pdFZhcmlhbnRMb2NhbElkIjoyLCJzY3JlZW5Mb2NhbElkIjo5Miwic2NyZWVuVGl0bGUiOiIwMSIsInNjcmVlbklzTWFzdGVyIjpmYWxzZSwib2JqZWN0TG9jYWxJZCI6bnVsbCwib2JqZWN0TmFtZSI6bnVsbCwib2JqZWN0Q2xhenoiOm51bGwsImluaXRpYXRpb25UaW1lc3RhbXAiOjE3MDc1ODU3NjcuMDYyLCJuYW1lIjoic2NyZWVuU2hvd24ifSx7InNlc3Npb25JZCI6InMxNzA3NTg1NzY2eDNmMDdmNTc1MDNiNDQ1eDAzMTgyMDgzIiwiYWNjb3VudElkIjoiYWZhNGE4NmUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI3MTIzOTAzMDQyMDY2MjUxIiwiaW5kZXgiOjUsImNsaWVudFRpbWVzdGFtcCI6MTcwNzU4NTc2Ny4wNjIsIm5hbWUiOiJjcmVhdGl2ZVJlbmRlcmVkIn1dfQ==?crc32c=2745503341
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.208.141.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-208-141-233.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Date: Sat, 10 Feb 2024 17:22:48 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif

GET
H2 200 2.jpg
cache-ssl.celtra.com/api/blobs/bdd5520029abedf41c6c8d2427158f4710202c2e7ccd89902eb2d52ddd76cbf7/ Frame 59B5 95 KB
95 KB 18ms
18ms Image
image/jpeg 108.157.254.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/bdd5520029abedf41c6c8d2427158f4710202c2e7ccd89902eb2d52ddd76cbf7/2.jpg?transform=crush&quality=85
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2462751652998210&output=html&h=280&slotname=6589769556&adk=4288464822&adf=1608047200&pi=t.ma~as.6589769556&w=400&fwrn=4&fwrnh=100&lmt=1707585764&rafmt=1&format=400x280&url=https%3A%2F%2Fsecretmsg.xyz%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707585764331&bpp=2&bdt=518&idt=457&shv=r20240207&mjsv=m202401310101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2334593397714&frm=20&pv=1&ga_vid=1960488337.1707585764&ga_sid=1707585765&ga_hid=1154613952&ga_fc=1&u_tz=480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=600&ady=492&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31080798%2C31080887%2C44809003%2C95324581%2C95320869%2C95324155%2C95324161%2C95324259&oid=2&pvsid=2605099857177552&tmod=1468593526&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=463
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.254.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-254-115.sin2.r.cloudfront.net
Software: Apache /
Resource Hash: 0e8af00ee5f338d8bb74d705d3c155367d45db9d38254c2ec63dce9dae42d576

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 29 Jan 2024 16:01:54 GMT
via: 1.1 9683b5745ef5870755379e861e3a7520.cloudfront.net (CloudFront)
server: Apache
x-amz-cf-pop: SIN2-P3
age: 1041652
etag: "0e8af00ee5f338d8bb74d705d3c155367d45db9d38254c2ec63dce9dae42d576"
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-length: 97114
x-amz-cf-id: cgZy9Sllbprce0aoKH6xE8pOXtQqhB2-3TkyA54h22v8OJrEWXAUNg==

GET
H2 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 8D98 23 KB
8 KB 18ms
17ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

accept-ranges: bytes
age: 88884
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 7799
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 16:41:23 GMT
expires: Sat, 08 Feb 2025 16:41:23 GMT
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 AGSKWxULnvPOdlfjMXbZtqMlGmHP_GucvbN2gXy1TEkTUFapr1Nhx2HkmGirzvh9ucmbetGzg4J35NTQyTimHl-45ujBjRt6zNY2SrbCd8omgjKgbq-2tt3FwCblDeVNOLflIvI0my6f Show response
fundingchoicesmessages.google.com/el/ 0
321 B 641ms
26ms XHR
text/html 74.125.200.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxULnvPOdlfjMXbZtqMlGmHP_GucvbN2gXy1TEkTUFapr1Nhx2HkmGirzvh9ucmbetGzg4J35NTQyTimHl-45ujBjRt6zNY2SrbCd8omgjKgbq-2tt3FwCblDeVNOLflIvI0my6f

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce--UBR3qVCbuU77q2p-wbR9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 10 Feb 2024 17:22:47 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce--UBR3qVCbuU77q2p-wbR9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtHikmLw05BiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hy5TAGaxzgNgpfQZrEBAL8XA8fzhvHZtAw7RN15gABGgYmw"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://secretmsg.xyz
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 AGSKWxULnvPOdlfjMXbZtqMlGmHP_GucvbN2gXy1TEkTUFapr1Nhx2HkmGirzvh9ucmbetGzg4J35NTQyTimHl-45ujBjRt6zNY2SrbCd8omgjKgbq-2tt3FwCblDeVNOLflIvI0my6f Show response
fundingchoicesmessages.google.com/el/ 0
322 B 643ms
31ms XHR
text/html 74.125.200.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxULnvPOdlfjMXbZtqMlGmHP_GucvbN2gXy1TEkTUFapr1Nhx2HkmGirzvh9ucmbetGzg4J35NTQyTimHl-45ujBjRt6zNY2SrbCd8omgjKgbq-2tt3FwCblDeVNOLflIvI0my6f

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-fFDPtNCeHk2ZY12_tLBa_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 10 Feb 2024 17:22:47 GMT
content-security-policy: script-src 'report-sample' 'nonce-fFDPtNCeHk2ZY12_tLBa_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtHikmLw05BiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hy5TAGaxzgNgpfQZrEBAL8XA8fzhvHZvAgsZX15kABV4Y3w"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://secretmsg.xyz
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 AGSKWxULnvPOdlfjMXbZtqMlGmHP_GucvbN2gXy1TEkTUFapr1Nhx2HkmGirzvh9ucmbetGzg4J35NTQyTimHl-45ujBjRt6zNY2SrbCd8omgjKgbq-2tt3FwCblDeVNOLflIvI0my6f Show response
fundingchoicesmessages.google.com/el/ 0
325 B 642ms
30ms XHR
text/html 74.125.200.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxULnvPOdlfjMXbZtqMlGmHP_GucvbN2gXy1TEkTUFapr1Nhx2HkmGirzvh9ucmbetGzg4J35NTQyTimHl-45ujBjRt6zNY2SrbCd8omgjKgbq-2tt3FwCblDeVNOLflIvI0my6f

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-pHgZHOECF-9r36wSYQ_K-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 10 Feb 2024 17:22:47 GMT
content-security-policy: script-src 'report-sample' 'nonce-pHgZHOECF-9r36wSYQ_K-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjstDikmII0pBiWMy_i6mW4RlTKxAz_nnBxAnE7yRfMX0D4h0-HixTAmewzgFip_QZrEFALMTD8fzhvHVsAhsWn7_OBABjmBps"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://secretmsg.xyz
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 AGSKWxUbD5Fyheh5M23_rDIgMTjAvAd233H46uHIzMa61q9gil9HU9J36eotZKQFW8WHVVwKBe382MvORXeusArjj7KrspxtmMJVBjIPF3h1lBViPbi6k9A_xItzaELdCbgGoNOXRo2- Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 40ms
39ms Script
application/javascript 74.125.200.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUbD5Fyheh5M23_rDIgMTjAvAd233H46uHIzMa61q9gil9HU9J36eotZKQFW8WHVVwKBe382MvORXeusArjj7KrspxtmMJVBjIPF3h1lBViPbi6k9A_xItzaELdCbgGoNOXRo2-?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA3NTg1NzY3LDg5MDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbNyw5LDZdLG51bGwsMixudWxsLCJlbiIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLDFdLCJodHRwczovL3NlY3JldG1zZy54eXovIixudWxsLFtbOCwiTTBaZ2RhbU9OTnMiXSxbOSwiemgtQ04iXSxbMTgsIltbWzBdXV0iXSxbMjAsIltudWxsLG51bGwsWzk1MzIyODk5XSwxNSwxNV0iXSxbMTksIjIiXSxbMTcsIlswXSJdXV0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0d04cf9e374a38cbb1a13e78569024c12fc93b501abd441d451f306509bc8d9f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ed9IR89zRHIs8QfYnvRWTw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:47 GMT
content-security-policy: script-src 'report-sample' 'nonce-ed9IR89zRHIs8QfYnvRWTw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjWsKoxSXF4KwhxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyBm_POCiROI3315ycTx9SWTBBCrAfE7yVdM34B4h48Hy5vw6axsEdNZ4-qms-YAMd-66aya66ezbjkznXUPEMc8n86aAsSLWWewrgbiKYEzWOcAsVP6DNYAIP6cOYP1NxD71M9gjQJiIW6O5w_nrWMT6NhwxhIA2e9J1w"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lNhlv5sea-oDTsdMVC1Eb9NbJKPPeymnKy6ovSZ5Mj0.js Show response
pagead2.googlesyndication.com/bg/ Frame 8D98 51 KB
20 KB 15ms
15ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lNhlv5sea-oDTsdMVC1Eb9NbJKPPeymnKy6ovSZ5Mj0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94d865bf9b1e6bea034ec74c542d446fd35b24a3cf7b29a72b2ea8bd2679323d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 22:04:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 155920
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19987
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 22:04:07 GMT

POST
H2 204 AGSKWxX89mtV9Dn5x6IsWUTlvV3nQBkAj1LWs-ip_-y-nOYR4RDvSGJsG4pEKkqsVMj3_IReTd3LBhSC9cILtblnt5e21vyN3FsPk1UyiWKsMOk1Lz0uJ0RKH4MheNfsAs0dRfn-Q1L9 Show response
fundingchoicesmessages.google.com/el/ 0
323 B 588ms
27ms XHR
text/html 74.125.200.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX89mtV9Dn5x6IsWUTlvV3nQBkAj1LWs-ip_-y-nOYR4RDvSGJsG4pEKkqsVMj3_IReTd3LBhSC9cILtblnt5e21vyN3FsPk1UyiWKsMOk1Lz0uJ0RKH4MheNfsAs0dRfn-Q1L9

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-mTbygwnbyh_iWYepRMrIlQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 10 Feb 2024 17:22:47 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-mTbygwnbyh_iWYepRMrIlQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtHikmJw05BiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hy5TAGaxzgNgpfQZrEBAL8XA8fzhvHZvAjCvvrjEBAAScGSU"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://secretmsg.xyz
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 AGSKWxULnvPOdlfjMXbZtqMlGmHP_GucvbN2gXy1TEkTUFapr1Nhx2HkmGirzvh9ucmbetGzg4J35NTQyTimHl-45ujBjRt6zNY2SrbCd8omgjKgbq-2tt3FwCblDeVNOLflIvI0my6f Show response
fundingchoicesmessages.google.com/el/ 0
323 B 588ms
27ms XHR
text/html 74.125.200.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxULnvPOdlfjMXbZtqMlGmHP_GucvbN2gXy1TEkTUFapr1Nhx2HkmGirzvh9ucmbetGzg4J35NTQyTimHl-45ujBjRt6zNY2SrbCd8omgjKgbq-2tt3FwCblDeVNOLflIvI0my6f

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-RNirOXN3hwGtudFopl9DTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 10 Feb 2024 17:22:47 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-RNirOXN3hwGtudFopl9DTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtHikmJw1JBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hy5TAGaxzgNgpfQZrEBAL8XA8fzhvHZvAjV_frjEBAAVWGY4"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://secretmsg.xyz
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8D98 0
56 B 60ms
59ms Image
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=B6mVr5rDHZdrnOuOk9fwPk-Wh4A0AAAAAOAHgBAI&bg=!WVqlWhXNAAY9UbWqHVE7ADQBe5WfOIaPB2HNDQJfRYO9O4uPORrpwQtc4s8g5arfPSAtuwqmZyXfMYwI-lpsLCAv1EBmAgAAAF1SAAAABmgBB5kDC7lODG-suFEATOkvlrNT3S_YJTou4ViVsPbvP7FQCXiy_RBp8cJ5DN193T6xyR5A7_21uRKHFp-yoOYvOXbuCk8DKe6j7AuUQmkAEj7qSJhdGrfyPezVg39zYfG9aKSFaXgeAmpCwR_VY2USM7Lk6M-ZPpPiW8lHVoFRzGMshqpzB5PTglfqgpxW4Gsg9ez9u218NsZVfT8Lsr1NtdnqurJs7Exf35BqcHO7x9M66p4CO6Y7xPqeKVltnWPcAz_k-wSSctCuk5wHNjaKlm4sA06Rb-xG-hcou2NM-7IkecC0H75NU85oxUn2nG5vABk2NSOl1N0SLEv-7EqxgiIOI4tTCy8sJA7DoYknBxCwnUN2rxKsCfXtmLwKq-GxgMAB233wJkUqmhjw8AU5Y82MgmdB8oncP9Zgvv66szBunnvHdseEYH8-4uTW2kv2zaImSefLW6P4dOOIoNvQH1VWc6mhMnT0ezhAv9QOXr2OGNCCcovXWNM6SmraD1cLCzh0N0QU9QqE9CSX4I5Sb1iKk-oRaMSBOBVOziqDHUnS-LVlN7VZ4i7J22iYZt37ipXcbVgQ7oEdKAa2ia5z0K_4EEpfHCSxKERzmKBFERQmvAS5I_HNRzQX2zUcaTpw46LQbUGWPp2nuoWJ1X5TpR0sgxTbBQrEjiS8e8GwbSduTr-hEioF4q50gfucdKqWkQbTMuTJVBfZXk6dQViTGdUdAQoyigzCIncq8k638p9XXohIpQHn0_9lACYXHqeFRiYaJ8FUCbba2YYmA84oeZBKU2ZvN9048nV-oXXN9-J69erOrlgq7Nqf3zlATu4Sl5LLVbhpGyPLnFluH075P_eQEmGn9Ni8y7LFtQhOSZWcMr0c64jgC3DpTYI2K6rPeYwTFRiWvR0MLwbPNvhRMwqQniFIGYUxyWfAsdFUlmL0EfvnskNJXj45NrKZsz5g2HtyPYYCtuZw75E3vsynDSa_2c8aU81F-hx9yN3VBEi5XmPtweYTjDixnrqJxzbXvZQkKISHHyz62WduPpD0

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EF0F 42 B
108 B 63ms
62ms Fetch
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstJlSb4wyAIKvb3alRDo9M0NZfcMyy1CIrtWcI6ZyZfVLaSZP4j8Aqp73P9UmHnsKY61sf6pIqccDWFxeS96TnYRRiCO3kyl3JcCpGtEFvvW9-VdDkTYgnmoqLe6rMN5FzGylJDyPTE91aPTZF-lIDEMIWj_-jtsX4&sai=AMfl-YTkPzy_oEEZxsCjSf7frpRDI7n97G885Kc3D39A47upaMEp9J5Sg6pqAHP76u4tfE33YdEt60RCl1fEj2Ubtej2ETYuYusOd8vI3EJ5lADCzRtJITzKplqbVF7aQhQILcV61xibs5mydEAe7Qry&sig=Cg0ArKJSzJef68Gpsop5EAE&cid=CAQSTgAvHhf_AzgQRaEZMgDRfvTyqW5y0GjsiXFQJwegnnAOZl6kKSPki0D5aHHGhNqXVAyJ_4i1N-ZtTQlqc6kSDczW72LiDzB90A3ZfMoovBgB&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=354,841,1000,1000,1000&tos=354,487,159,0,0&v=20240208&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=351856600&rst=1707585765930&rpt=336&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DB80 42 B
108 B 63ms
63ms Fetch
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst78NBnWH6CMWPf0IRW4WwbWyLJdKaL7Trd1SaOCLTiLbO_jcJk5zBC3opNUOV1ZYBHzgYn5k4roPuCByG-fDiA97PXnjAxNcp1udjC95mS43JwmCa7OArmMvZyDBD3qRdRhsFVRn86xR6TyxtMbvYAv1k8UCBmXzk&sai=AMfl-YQRL875vT4hxirwbHy7Ohnzy7vo14Sf-DPCgOpIGSD5QdEw99zWlgW0Z-a4pI5EMo9Uek37-sbGWyqdva6vP_EC826Z215jkPrXOZpIMQv34FzaHwFlDObnZv620JIV3UPAg_FqooPSbFAnEwOA&sig=Cg0ArKJSzMZpU2O7QNqSEAE&cid=CAQSTgAvHhf_AzgQRaEZMgDRfvTyqW5y0GjsiXFQJwegnnAOZl6kKSPki0D5aHHGhNqXVAyJ_4i1N-ZtTQlqc6kSDczW72LiDzB90A3ZfMoovBgB&id=lidar2&mcvt=1000&p=0,0,600,160&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240208&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271803&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=351856600&rst=1707585765925&rpt=337&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 23BF 42 B
108 B 71ms
71ms Fetch
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu8XC1xgEN-u8HYeZ-_sfYvpX2MNcXFLnjNY2RSOpXfnRSImM4jvG1xK9J5PTcoRtB3LG6C0mAm8GX-yRPbizqorYAMGm0BS2YDzB6CO9xF7Iu4KboiXQ3i5bueTGuNfSrjF_pMy6zNlBP5aj_-CQOHTxd6eXmkd_Y&sai=AMfl-YQcifNjkIMKLfxrnPLubCxYFSdo6XMSTys8CuTIllXiCvVRobN3x8u1PMLpkzYsQ8UBPoPYv-jJ-WaND9nFZUUTZhjatHNc0EBge4kyL-idg4BYiAISQN2XLuFfbPXqvJ3vF4-PJNPMKML9ZppR&sig=Cg0ArKJSzKHoZTGqH_YkEAE&cid=CAQSTgAvHhf_AzgQRaEZMgDRfvTyqW5y0GjsiXFQJwegnnAOZl6kKSPki0D5aHHGhNqXVAyJ_4i1N-ZtTQlqc6kSDczW72LiDzB90A3ZfMoovBgB&id=lidar2&mcvt=1000&p=0,0,600,160&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240208&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=351856600&rst=1707585765928&rpt=342&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 206
Partial Content file.mp4
r4---sn-npoeens7.c.2mdn.net/videoplayback/id/b6fd46dac557d9c8/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1739121766/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 5E8B 454 KB
0 332ms
30ms Media
video/mp4 209.85.228.9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: secretmsg.xyz
URL: https://secretmsg.xyz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

209.85.228.9 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sin11s30-in-f9.1e100.net

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Range: bytes=0-

Response headers

Date: Sat, 10 Feb 2024 17:22:48 GMT
X-Content-Type-Options: nosniff
Content-Range: bytes 0-6145185/6145186
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 6145186
Last-Modified: Thu, 18 Jan 2024 04:01:31 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: https://googleads.g.doubleclick.net
Expires: Sat, 10 Feb 2024 17:22:48 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 5E8B 0
54 B 630ms
630ms Ping
image/gif 142.250.187.99

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=4~lsgch6cw&c=8260020958297&slotId=4130010479148.5&qqid=CJD6vtekoYQDFTeBuQUd70QM_Q&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=Infinity&br=3153&mt=video%2Fmp4&vs=1024x1024&msm=1&aits=0%2C18%2C22%2C692%2C59%2C342%2C343%2C344%2C345%2C346%2C347&webm=0&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=347&vsrc=web_video_ads&hcn=0&met.4=arp_a_e.1qf~atrd.1qj&ua_e=1&ape=1&ple=0&umsem=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.187.99 , United States, ASN (),
Reverse DNS: sof02s44-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Feb 2024 17:22:48 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 256ms
255ms XHR
application/json 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20240207&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7071169c21648e305ea0fd1e69a4edcd04ef8812f66407402ed795e804664b41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12265
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 19ms
19ms Script
text/javascript 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202401310101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 10 Feb 2024 17:22:48 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame E71D 13 KB
5 KB 21ms
20ms Document
text/html 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secretmsg.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

accept-ranges: bytes
age: 89734
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 16:27:14 GMT
expires: Sat, 08 Feb 2025 16:27:14 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 70D0 829 B
1 KB 368ms
25ms Document
text/html 74.125.200.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.103 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sa-in-f103.1e100.net

Software

GSE /

Resource Hash

aa922d5bc2836511c99302194206554a675a8a24200c51b3215e76601ffa63ed

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ijs6rgAsUol2TPi6qOHk5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secretmsg.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-ijs6rgAsUol2TPi6qOHk5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 10 Feb 2024 17:22:49 GMT
expires: Sat, 10 Feb 2024 17:22:49 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame E71D 39 KB
15 KB 19ms
19ms Script
text/javascript 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 22:09:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 155626
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 22:09:02 GMT

GET
H2 204 generate_204
tpc.googlesyndication.com/ Frame E71D 0
40 B 24ms
23ms Image
text/plain 74.125.24.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?-ueiUA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.24.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Sat, 10 Feb 2024 17:22:48 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 70D0 0
0 61ms
60ms Image
text/html 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20240207&jk=2605099857177552&rc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.118.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sl-in-f157.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 67ms
67ms Image
text/html 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20240207&jk=2605099857177552&bg=!19Sl1JvNAAaxkZ3akZE7ADQBe5WfOPm0vjIOuVg8xAm3zM-iqewoa6TyNMnEPrJJkzvBs48iFqYMGUFES7m9o0FCrkLFAgAAAFNSAAAABGgBBwoAPHz8wL5lqyorR2YVI6IWiRTmvvPT5Fgxw2lC5Ru0-JWralg8L6a1G1QBaMb8bIF1qrGHyDu4Xowc2PFpbZkCu1FxrLeUWejiW0clKJEWilqBE421jV5NHT7Ux4ssgxeybNnEDt4mpDi6vVDsNuLW6-aECwOcKHKRXpQhS7c0T0EEwTKYfeFmq8xEsnJuPVixCsUoUghM-a8rT1Fnt5yQDWfjeq4IXnvvInqz4ZEy3IdtH6IqBFUmK43o7hzt559fIGT0xkp9Agsfo88F3cV2WAjt0YStkg8Sgvo8g5Bb9blaTcwOyBtnRL3JvVOJWSoq9_mA1fvKIxzyeAOuC7Disy5Np0ogjDEhH7riGWo2-Cv0P-YdHjOq6zEARGX1IOsFB9XlbRSXPexi7i0IF9m76foqdFFDUHGgkO_TjSthMTPdqDIJhJN0k3piP14qbElpVwsOY95pEKgiHQ_yg7QD2J2WartQi0SIjjb99wgkqEqUyNK8TUTSpaY-ZjuopBUV7Oqq6pNWIlyZoix_g3IQggFd_UFvIcT0X0RrDRxafdNEjvM6TMY-X_00W1sySkkDUBCy01j1WzEipSIbpseI-4y9Ejz8q70gNmZFj15Utolv3ROD4NR6haFqxUtQTesa3T-pvqqcpaCEEIQ_x-X7ZZEgRQh6xQ6eH5GU_QLZP_13GUzvH3YFyZaAygfmCfTZxlDt-p8ZMu1OWDgnX2RJuJuX7ieXL75w5nOpULuIwJXx5d0wTpmuWpuMUYMo-Z9x8XzZpBB-PmXqv1h6xe-0n4Gja841gv77l-EraKya_t8HHsoM5gQ7nt4liO_dGa5r-R0WJXIB3pA4adjsFpkjEvH0IT2GoXqjcZJ-9gbczKtxFCUeWuPtQhQyAUTxJwPhQrwIHmLVVgZozW1c1IBKnI7rYOEqdYsoOBGG7hf3HGclfTe-E0D9-33EFziWTyYYCpQatEsI96ESl8CGUiemNY1So0vhu4a6rzvMS_Xfo2HAmTwrwlFIO-k7ig
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.118.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sl-in-f157.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://secretmsg.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 041F 0
58 B 60ms
59ms Ping
image/gif 172.253.118.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=2515545185943&version=m202401290101&ct=77&x=1&cor=2312400365814632400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS