Submitted URL: http://ncmhcso.org/
Effective URL: https://ncmhcso.org/
Submission: On June 18 via manual from JP

Summary

This website contacted 35 IPs in 8 countries across 53 domains to perform 433 HTTP transactions. The main IP is 2606:4700:3030::6815:233f, located in United States and belongs to CLOUDFLARENET, US. The main domain is ncmhcso.org.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 21st 2020. Valid for: a year.
This is the only time ncmhcso.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 81 2606:4700:303... 13335 (CLOUDFLAR...)
1 143.198.248.63 14061 (DIGITALOC...)
1 2600:9000:21f... 16509 (AMAZON-02)
2 2600:9000:206... 16509 (AMAZON-02)
1 205.185.216.42 20446 (HIGHWINDS3)
3 2606:4700::68... 13335 (CLOUDFLAR...)
31 2a00:1450:400... 15169 (GOOGLE)
9 2a00:1450:400... 15169 (GOOGLE)
13 151.101.65.195 54113 (FASTLY)
6 30 2a02:6b8::1:119 13238 (YANDEX)
19 2a00:1450:400... 15169 (GOOGLE)
12 2a00:1450:400... 15169 (GOOGLE)
2 213.174.135.25 39572 (ADVANCEDH...)
1 18.196.233.38 16509 (AMAZON-02)
34 216.58.212.162 15169 (GOOGLE)
1 198.54.121.248 22612 (NAMECHEAP...)
27 2a00:1450:400... 15169 (GOOGLE)
53 2a00:1450:400... 15169 (GOOGLE)
16 2a00:1450:400... 15169 (GOOGLE)
2 172.217.23.98 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
6 62 142.250.186.66 15169 (GOOGLE)
2 4 23.218.208.246 16625 (AKAMAI-AS)
2 3 37.252.172.38 29990 (ASN-APPNEX)
2 3 2a00:1450:400... 15169 (GOOGLE)
1 144.76.120.254 24940 (HETZNER-AS)
8 2a00:1450:400... 15169 (GOOGLE)
1 2a02:fa8:8806... 41041 (VCLK-EU-SE)
3 3 185.29.132.68 30419 (MEDIAMATH...)
3 3 85.114.159.118 24961 (MYLOC-AS ...)
5 5 35.158.9.168 16509 (AMAZON-02)
5 5 69.173.144.138 26667 (RUBICONPR...)
3 3 185.86.138.131 201081 (SMARTADSE...)
3 6 2001:678:cb4:... 56396 (TURN)
4 4 18.193.131.224 16509 (AMAZON-02)
4 4 72.251.244.142 29791 (VOXEL-DOT...)
4 4 35.227.252.103 15169 (GOOGLE)
6 12 2a00:1450:400... 15169 (GOOGLE)
1 1 99.80.199.35 16509 (AMAZON-02)
2 6 2606:4700::68... 13335 (CLOUDFLAR...)
2 2 151.101.14.49 54113 (FASTLY)
4 4 216.52.2.30 30282 (AS-INAPCD...)
3 3 35.186.193.173 15169 (GOOGLE)
6 6 3.126.56.137 16509 (AMAZON-02)
3 76.223.111.131 16509 (AMAZON-02)
1 2 2620:116:800d... 16509 (AMAZON-02)
2 66.155.71.149 13768 (COGECO-PEER1)
1 1 193.0.160.129 54312 (ROCKETFUEL)
2 2 2a00:1288:110... 34010 (YAHOO-IRD)
4 4 18.159.175.104 16509 (AMAZON-02)
2 2 99.86.242.104 16509 (AMAZON-02)
3 3 18.197.47.23 16509 (AMAZON-02)
2 2 185.64.189.115 62713 (AS-PUBMATIC)
4 4 37.157.3.29 198622 (ADFORM)
1 1 213.19.147.44 26120 (RHYTHMONE)
1 1 213.19.147.45 3356 (LEVEL3)
433 35
Apex Domain
Subdomains
Transfer
126 doubleclick.net
googleads.g.doubleclick.net
securepubads.g.doubleclick.net
googleads4.g.doubleclick.net
cm.g.doubleclick.net
474 KB
84 googlesyndication.com
pagead2.googlesyndication.com
cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
tpc.googlesyndication.com
606 KB
81 ncmhcso.org
ncmhcso.org
2 MB
27 gstatic.com
fonts.gstatic.com
www.gstatic.com
511 KB
25 yandex.ru
mc.yandex.ru
72 KB
23 googletagservices.com
www.googletagservices.com
831 KB
17 google.com
adservice.google.com
www.google.com
2 KB
10 jampartizan.com
bk.jampartizan.com
12 KB
9 googleapis.com
fonts.googleapis.com
6 KB
8 yahoo.com
ups.analytics.yahoo.com
pr-bh.ybp.yahoo.com
7 KB
6 tribalfusion.com
a.tribalfusion.com
s.tribalfusion.com
4 KB
6 turn.com
ad.turn.com
r.turn.com
3 KB
5 rubiconproject.com
pixel.rubiconproject.com
2 KB
5 bidswitch.net
x.bidswitch.net
3 KB
5 yandex.com
mc.yandex.com
2 KB
4 adform.net
c1.adform.net
2 KB
4 3lift.com
eb2.3lift.com
2 KB
4 lijit.com
ap.lijit.com
3 KB
4 openx.net
rtb.openx.net
1 KB
4 m6r.eu
tracking.m6r.eu
3 KB
4 w55c.net
pm.w55c.net
4 KB
4 casalemedia.com
dsum-sec.casalemedia.com
4 KB
4 2mdn.net
s0.2mdn.net
42 KB
3 advertising.com
pixel.advertising.com
1 KB
3 adsrvr.org
match.adsrvr.org
793 B
3 ctnsnet.com
gcm.ctnsnet.com
1 KB
3 everesttech.net
pixel.everesttech.net
sync-tm.everesttech.net
1 KB
3 smartadserver.com
ssbsync.smartadserver.com
1 KB
3 adition.com
dsp.adfarm1.adition.com
2 KB
3 mathtag.com
sync.mathtag.com
2 KB
3 adnxs.com
ib.adnxs.com
3 KB
3 zx-adnet.com
cdn.zx-adnet.com
20 KB
3 jsdelivr.net
cdn.jsdelivr.net
9 KB
3 optad360.io
cmp.optad360.io
get.optad360.io
452 KB
2 pubmatic.com
image6.pubmatic.com
1 KB
2 smaato.net
s.ad.smaato.net
857 B
2 sitescout.com
pixel-sync.sitescout.com
382 B
2 quantserve.com
cms.quantserve.com
798 B
2 google.fr
adservice.google.fr
1018 B
1 unrulymedia.com
sync.targeting.unrulymedia.com
626 B
1 1rx.io
sync.1rx.io
741 B
1 rfihub.com
p.rfihub.com
777 B
1 dotomi.com
dclk-match.dotomi.com
104 B
1 stat-rock.com
serving.stat-rock.com
95 KB
1 wpushsdk.com
js.wpushsdk.com
3 KB
1 allthebestsofts.com
allthebestsofts.com
53 KB
1 consensu.org
stat.optad360.mgr.consensu.org
286 B
1 nawpush.com
na.nawpush.com
363 B
1 cstwpush.com
cst.cstwpush.com
60 KB
1 ro3.biz
ro3.biz
20 KB
0 netmng.com Failed
google2waycm.netmng.com Failed
0 wbtrk.net Failed
um.wbtrk.net Failed
0 impdesk.com Failed
pix.impdesk.com Failed
433 53
Domain Requested by
81 ncmhcso.org 1 redirects ncmhcso.org
62 cm.g.doubleclick.net 6 redirects googleads.g.doubleclick.net
51 tpc.googlesyndication.com ncmhcso.org
cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
tpc.googlesyndication.com
securepubads.g.doubleclick.net
googleads.g.doubleclick.net
34 securepubads.g.doubleclick.net get.optad360.io
securepubads.g.doubleclick.net
cdn.zx-adnet.com
ncmhcso.org
www.googletagservices.com
31 pagead2.googlesyndication.com ncmhcso.org
cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
tpc.googlesyndication.com
securepubads.g.doubleclick.net
www.googletagservices.com
googleads.g.doubleclick.net
28 googleads.g.doubleclick.net pagead2.googlesyndication.com
cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
bk.jampartizan.com
googleads.g.doubleclick.net
25 mc.yandex.ru 4 redirects ncmhcso.org
23 www.googletagservices.com securepubads.g.doubleclick.net
cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
cdn.zx-adnet.com
googleads.g.doubleclick.net
19 fonts.gstatic.com fonts.googleapis.com
15 www.google.com 8 redirects tpc.googlesyndication.com
googleads.g.doubleclick.net
10 bk.jampartizan.com ncmhcso.org
9 fonts.googleapis.com ncmhcso.org
googleads.g.doubleclick.net
8 www.gstatic.com googleads.g.doubleclick.net
6 ups.analytics.yahoo.com 6 redirects
5 pixel.rubiconproject.com 5 redirects
5 x.bidswitch.net 5 redirects
5 mc.yandex.com 2 redirects ncmhcso.org
4 c1.adform.net 4 redirects
4 eb2.3lift.com 4 redirects
4 ap.lijit.com 4 redirects
4 a.tribalfusion.com 2 redirects googleads.g.doubleclick.net
4 rtb.openx.net 4 redirects
4 tracking.m6r.eu 4 redirects
4 pm.w55c.net 4 redirects
4 dsum-sec.casalemedia.com 2 redirects googleads.g.doubleclick.net
4 s0.2mdn.net cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
googleads.g.doubleclick.net
3 pixel.advertising.com 3 redirects
3 match.adsrvr.org googleads.g.doubleclick.net
3 gcm.ctnsnet.com 3 redirects
3 r.turn.com
3 ad.turn.com 3 redirects
3 ssbsync.smartadserver.com 3 redirects
3 dsp.adfarm1.adition.com 3 redirects
3 sync.mathtag.com 3 redirects
3 ib.adnxs.com 2 redirects googleads.g.doubleclick.net
3 cdn.zx-adnet.com ncmhcso.org
cdn.zx-adnet.com
3 cdn.jsdelivr.net ncmhcso.org
get.optad360.io
2 image6.pubmatic.com 2 redirects
2 s.ad.smaato.net 2 redirects
2 pr-bh.ybp.yahoo.com 2 redirects
2 pixel-sync.sitescout.com googleads.g.doubleclick.net
2 cms.quantserve.com 1 redirects googleads.g.doubleclick.net
2 sync-tm.everesttech.net 2 redirects
2 s.tribalfusion.com
2 googleads4.g.doubleclick.net ncmhcso.org
2 cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com securepubads.g.doubleclick.net
2 adservice.google.com securepubads.g.doubleclick.net
2 adservice.google.fr securepubads.g.doubleclick.net
2 get.optad360.io ncmhcso.org
get.optad360.io
1 sync.targeting.unrulymedia.com 1 redirects
1 sync.1rx.io 1 redirects
1 p.rfihub.com 1 redirects
1 pixel.everesttech.net 1 redirects
1 dclk-match.dotomi.com googleads.g.doubleclick.net
1 serving.stat-rock.com get.optad360.io
1 js.wpushsdk.com cst.cstwpush.com
1 allthebestsofts.com ncmhcso.org
1 stat.optad360.mgr.consensu.org get.optad360.io
1 na.nawpush.com cst.cstwpush.com
1 cst.cstwpush.com ncmhcso.org
1 cmp.optad360.io ncmhcso.org
1 ro3.biz ncmhcso.org
0 google2waycm.netmng.com Failed googleads.g.doubleclick.net
0 um.wbtrk.net Failed googleads.g.doubleclick.net
0 pix.impdesk.com Failed googleads.g.doubleclick.net
433 65

This site contains links to these domains. Also see Links.

Domain
www.cookiesandyou.com
az.ncmhcso.org
be.ncmhcso.org
bn.ncmhcso.org
ca.ncmhcso.org
cs.ncmhcso.org
da.ncmhcso.org
el.ncmhcso.org
es.ncmhcso.org
et.ncmhcso.org
ga.ncmhcso.org
fa.ncmhcso.org
fi.ncmhcso.org
fr.ncmhcso.org
hi.ncmhcso.org
hr.ncmhcso.org
hu.ncmhcso.org
hy.ncmhcso.org
id.ncmhcso.org
is.ncmhcso.org
it.ncmhcso.org
iw.ncmhcso.org
ja.ncmhcso.org
ka.ncmhcso.org
ko.ncmhcso.org
kk.ncmhcso.org
ky.ncmhcso.org
lb.ncmhcso.org
lo.ncmhcso.org
lt.ncmhcso.org
lv.ncmhcso.org
ms.ncmhcso.org
mr.ncmhcso.org
nl.ncmhcso.org
no.ncmhcso.org
pl.ncmhcso.org
pt.ncmhcso.org
ro.ncmhcso.org
ru.ncmhcso.org
sk.ncmhcso.org
sl.ncmhcso.org
sq.ncmhcso.org
sr.ncmhcso.org
sv.ncmhcso.org
te.ncmhcso.org
tg.ncmhcso.org
th.ncmhcso.org
tl.ncmhcso.org
tr.ncmhcso.org
uk.ncmhcso.org
ur.ncmhcso.org
uz.ncmhcso.org
vi.ncmhcso.org
zh.ncmhcso.org
af.ncmhcso.org
am.ncmhcso.org
bs.ncmhcso.org
ceb.ncmhcso.org
co.ncmhcso.org
cy.ncmhcso.org
eo.ncmhcso.org
eu.ncmhcso.org
fy.ncmhcso.org
gd.ncmhcso.org
gl.ncmhcso.org
gu.ncmhcso.org
ha.ncmhcso.org
haw.ncmhcso.org
hmn.ncmhcso.org
ht.ncmhcso.org
ig.ncmhcso.org
jw.ncmhcso.org
km.ncmhcso.org
kn.ncmhcso.org
ku.ncmhcso.org
la.ncmhcso.org
mg.ncmhcso.org
mi.ncmhcso.org
mk.ncmhcso.org
ml.ncmhcso.org
mn.ncmhcso.org
mt.ncmhcso.org
my.ncmhcso.org
ne.ncmhcso.org
ny.ncmhcso.org
pa.ncmhcso.org
ps.ncmhcso.org
sd.ncmhcso.org
si.ncmhcso.org
sm.ncmhcso.org
sn.ncmhcso.org
so.ncmhcso.org
st.ncmhcso.org
su.ncmhcso.org
sw.ncmhcso.org
xh.ncmhcso.org
yi.ncmhcso.org
yo.ncmhcso.org
zu.ncmhcso.org
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-10-21 -
2021-10-20
a year crt.sh
ro1.biz
R3
2021-05-11 -
2021-08-09
3 months crt.sh
*.optad360.io
Amazon
2020-12-17 -
2022-01-15
a year crt.sh
cstwpush.com
R3
2021-05-22 -
2021-08-20
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2021-05-17 -
2021-08-09
3 months crt.sh
upload.video.google.com
GTS CA 1O1
2021-05-17 -
2021-08-09
3 months crt.sh
covid19-dashboard.ivod.at
GTS CA 1D4
2021-05-17 -
2021-08-15
3 months crt.sh
mc.yandex.ru
Yandex CA
2021-02-27 -
2021-08-09
5 months crt.sh
*.gstatic.com
GTS CA 1C3
2021-05-24 -
2021-08-16
3 months crt.sh
na.nawpush.com
R3
2021-04-20 -
2021-07-19
3 months crt.sh
stat.optad360.mgr.consensu.org
R3
2021-05-24 -
2021-08-22
3 months crt.sh
allthebestsofts.com
Sectigo RSA Domain Validation Secure Server CA
2020-12-02 -
2022-01-02
a year crt.sh
js.wpushsdk.com
R3
2021-05-07 -
2021-08-05
3 months crt.sh
*.google.fr
GTS CA 1C3
2021-05-17 -
2021-08-09
3 months crt.sh
*.google.com
GTS CA 1C3
2021-05-17 -
2021-08-09
3 months crt.sh
*.doubleclick.net
GTS CA 1C3
2021-05-17 -
2021-08-09
3 months crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2021-02-05 -
2022-02-09
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2021-03-05 -
2022-02-19
a year crt.sh
www.google.com
GTS CA 1C3
2021-05-24 -
2021-08-16
3 months crt.sh
app.shoplister.club
GTS CA 1D2
2021-04-20 -
2021-07-19
3 months crt.sh
serving.stat-rock.com
R3
2021-04-18 -
2021-07-17
3 months crt.sh
*.dotomi.com
GlobalSign RSA OV SSL CA 2018
2019-06-19 -
2021-08-31
2 years crt.sh
*.turn.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1
2021-03-31 -
2022-03-31
a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2021-03-18 -
2022-04-19
a year crt.sh
*.quantserve.com
DigiCert SHA2 High Assurance Server CA
2020-10-02 -
2021-10-07
a year crt.sh
*.sitescout.com
RapidSSL RSA CA 2018
2020-01-15 -
2022-02-02
2 years crt.sh

This page contains 54 frames:

Primary Page: https://ncmhcso.org/
Frame ID: FACED317B3B8FF238B2ACB0A60A06843
Requests: 149 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210616/r20190131/zrt_lookup.html
Frame ID: 0155112B06F194513155EA83FC7A8EF6
Requests: 1 HTTP requests in this frame

Frame: https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: AA5CBA0426B1098FF14A279674D99FA3
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKrcqwIQu4SQjgIY4ZC4pQEwAQ&v=APEucNV7rYtWj_shoEW05mvkTZ--zQZfBmcMceiyABQAHHEHU612EVAEB32BK6FhJmbJYatzQ4n69IVrqSa3ASwg5UjOP7y637QN4c1Atm5ZvlDnHrPSj-2nbrskbkZDfu6VZCLjG0IQ64XVbw1ILS-0R790hbnnMFr6cdKmA9SaF6P_o_b9qLmXfxesOmRhvR05OIL6dZ1z4UXjd5q4jnrdeiZp5XkAvA
Frame ID: 9FA2E84498C967CBB731480CDCDD9AC9
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: E37F27CA00152070B6F3491115F83D52
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html
Frame ID: 1A7389E07B04D554DE86D6D564D23D1D
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 8B3E14C9101451CDEB0582C363048FD0
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu4M-cnH5MutdUXtRnrxXAI4X3z6sDYRBA_vXsZtmNGaT4Q0CbRxSwmtxhthqSm-ocHMD5ZQWnVq2kfKnjsxC9Yb5zTOSxXdANNleL8UcI5bHPnl-PtkBCIrfj6hQZt73GpnoPGO019vWOjY-s8o-I7iP4sHG1OcsZOqYsj0z5F8INeSDO6B39RbKhg7np70ygZbIR2snAAKGhWVzFCUchPOFNbn7oOfQHIDC8k58NGKeStuPU4iVXyzFn6KmmkIhP_2pTzO8fi6jp2DPLahOX2a_BR5i9rrg&sai=AMfl-YQP10noOyHHuRdoKa3fGiKK_fqqycgkCbsumsK0vsRcewMrqGyI9Yxhy8lkZh0UyZBjrA6S3VjrXETlwhrQGAs0hhoaGaBDY__8NkfNKF44qbBch-ku6rUeR_ZOOhVL&sig=Cg0ArKJSzPY3exK-2IGeEAE&urlfix=1&adurl=
Frame ID: 5AFB724AB82CC054DEC1D62ACFFBCA8E
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstGHt7ZFw3JKIgm5FS_vZb1_UvA08G7kcUKTIeJfj2MAscIsTsOK2_GksrtV1Bg8mmBnr1tOaHP2A0D1wfhJDC_kq20i7yCJuw2m812n8tgiLRN_RVd9pGr8uvzC7INKsadSNATVZTSVNk5ACXf_KxASWr1towMbORdMBDSMumYjTvAoz344xgQs_zngEd6syXdOUiAnbueC-n4HgwB2_eEp4acSDZEYS5mHeEd6gtaVvYyxYworp0JRCHvK8SimBOMGmUxXADfKXjSny0FY0Dvs_Y&sai=AMfl-YQfC2yHJRI9Wfok0KkxHp_r0dEXUtA0ZO7NrIrgPxFcnzuJy1ad7qKS810oTs_VSXDUP5BzJ1rD5ypB6snJekFXlJVN_vQJZMf_NU1RfffZ9HGB7JU1bHESMgX8PHfG&sig=Cg0ArKJSzKIXxX7LUOFwEAE&urlfix=1&adurl=
Frame ID: DBC2CE95D7D83D04DCCE4A888632D3D0
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstPHAueH3Az5EG3MO-Z-CIqpyEscReaBC1lMw3h0wrXL6VcwMHdeb_2QHIDB8GDtuPGIqTsa4jqfqSb_sholbdLGtUZnhf0jfWksZfdR_LgMutWEiWWI-S-YcMO_j2kE5KIBCi3niM8eAOHTtpfRu4BAFoJYLBJOle7TwN_CaCjow_12YpXP5AWuvcR_QCi9V8QrMU3DwFg_62JcQ_QpTCC8NOxguajegBvp54agfeaBk0o53Z14H4ROEB6lKOuwCMDs5_pHOPm-3PBLFVvPK5VGWI&sai=AMfl-YTDOhNxcghG9tpw0dnHI5RjzNbItdOSyRM7_3GXuwTBkUmrbnk7DLZE_qA3cMcM3u9tt_EG_StkEVeF3skTyqwxkaBpkh-8Zj3CS8tSDHlY2VD6G_CSO7IaSmKfPs1b&sig=Cg0ArKJSzIVnmuVmAdmFEAE&urlfix=1&adurl=
Frame ID: C1C42682FAA5D2AC0D639C9F95375997
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstAroan7ao849hDBJniweOYLnU8RhiHaL8Ph9qcs_wMi8mMqoPj64_xhiRW0IZpXdXsitSJxUyUbmur0BXiSoCT4NlbYEOWHDR7Dt2CVC8O6QoGQUDk9DXTBo4vAf8d62mpo7a1cP9ZjJ2uHhz-OwMhHlSqvjJ_HBRJS2zd0yBjz6xZWn9od9Vodbg7QF0ngTGESV-JQ5f6X5Jx4qwITTJxy-7YC1QgoXhMai6KhlP3-J9yS_M4cGT6J-S8IEHh_ksyrbL3py0EfjivZQ7L7lgNG1c&sai=AMfl-YTSbpr2yAIq_zI0WNP5_EsOUMtML1fHQhn02wKbe5S5bmCg4ARhmZKng1PqCZCpqSVBbHWlxfPjgNn1EUeNSQ9eK-Gg_f3GQhxlLR2RLf0rNUF7jif7MSIWrgG4mJg&sig=Cg0ArKJSzJVOfRpFewqGEAE&urlfix=1&adurl=
Frame ID: C0AD8B2011F96655C95FB3797AE776C5
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvwhWBEyZMBppVZoBMXOYDNNyseVTptXlTUmmS5gej7JiqK1dmnfVKakDUXMwZkh6Qs_pifQ9zdAEMCSyGMS7W1ONPYlGx7dYDBE0ePqG7yIekSXVEe6iMZE1iYwGPnkgyGQzV6A3LU2OO0QPS6Dxlfz2xc9Wau9fUuCHXotbMf11GBedTydKtWQfhKzFIM6ohOUb_AuLAyJrkX4HjaJclMSA2NnyZqFB_nYxr3YpqBk1hcKE7jEoxGxmosEfAxYqhBfR-qUPwVT_9L3kFBxjY2VnY&sai=AMfl-YQr5ordBOHCni3y5oaYpVORTNCuPV1XGZbK2n8Xf7BTr1Ns5hgzbVatmKTZjcHQN6dE3O0Tt5i9KOCalVO5EYUEtbZAPhWlfzQq1r0-ULvrVYN6SSfpl0E2X0Yzi0TS&sig=Cg0ArKJSzJEpBIT9KcCyEAE&urlfix=1&adurl=
Frame ID: 8A3BBB661BD9D87D92A64FDC1F78EE08
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuIqF1jh5dSzChyCIxaihHb8dKVpEhG8yyyP-teR1-IUGF5VxJZUTtPXrVTX1SuO6_R1zSIGEAF4DV5bCTHXGjZu8E4lc2MUicSXjcZtGws-Fhr7fYejdbHFSqgPDcrDTv1P63zXgmzhfFgtWg7GeQ7t24_hrb6jvlqjAosmj71eCqRiDWfjKzcwzBaPd0AKzRC9soc1VcLfJe0F-FVyuxOk8BUU8qxq91ofHTIPuZe7bvshgNpmY5ZDW3tMRufRmvmKyxhJIrC4qPMIoO12EaerFe8-FMypw&sai=AMfl-YQdphjtR_GVbmoKncUf0UF5tkRrmh1sVGqicGH5wt6DlWsUnc6K9uxDyC1p-U7kIc1yYNdZld_rA_lOy4yKfWJq42Qtv3E3azWRIurOt40fyrG2V9Ukv-52mpmJpJ8g&sig=Cg0ArKJSzA3EpY1IO0LLEAE&urlfix=1&adurl=
Frame ID: 9C24445CCDF205026E8B58175E9B4E79
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstdybuQBpWE9835TfVCZE0OesAxv0Jk4_ghvOxpB6k8FBcdDckW-Lc73AyKsz221wZiI9l9Th2z6TrAektV6bRextWdE4o8JWHp_Qym0ZI_XfsMGxev88YR_Sw506WtcUvSXspofrUELYHNfrCgpApLG33yKw2xGtB06MEC0mQf1CcNqfkaWjyhtJ0oMXHQzOJAZZDuIbwGhDoYyqzb_sAVcXEPDCVbhRUyg05WQaxxXyPcPTeIjTnEdcLSFW6UBZZqOI3Dyn_8seOLRb-dicxSFCU&sai=AMfl-YQtKg4OhFbLiay8MRHzkfXzFKzcNbJO81O6yTyJLH5p4zHKczy1pq2Z2VNmlJ1vEO_giLlCt4omJyA0CJJJryUYlLiQ_N5KyAn4xx0netf9yUOYd-y9r_IaD9i2uiA6&sig=Cg0ArKJSzBCG9fzJ3b3hEAE&urlfix=1&adurl=
Frame ID: DE15F3E7B60236CBE0CC38539A4E5AB4
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssafC8XR8gIsG84SPsEW0nyEGBEFvpNVwv9MDQupDpybJTlGo0HujNgKtR4sOBHMESlHj6eqf9p4-Vgl4oLLrIlaX0IEjQSG6fMn1zvhNDk97aYjsWRq1e9tWxJWwPG5cN7dwzAorWKo5xARGApJ_adpt2iAJnvyLROnjKLxlnvuMRrXIhdRLcOV1FVZpufOeyWx_EfvdnM-a0dQqJVDCnruknaCfvdZO9lrOiBu2-yiy2IX2wBss940rgGUAfY9e5WmxaSx_pnGnae7SQMvIzUrmU&sai=AMfl-YSXhU25bE18oeJHTK5ZgUbTvSzMcbf1tPi6bi6Bwxme75Kz0iO9c0jaKfD5Hu6Md7lOOLOeGhQwS0sJgyusIQiFwEg8IJ38wXJVJhZYplDLRMNPz_wylAUFxlJVrtQ&sig=Cg0ArKJSzAebb5FElrhqEAE&urlfix=1&adurl=
Frame ID: A0D979EE07D96DF56F827A3D58F71CD0
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssLz8VGTM2_zd5Qn581I9e9zUKOWxevsnUMDvQEYdGJOQ_8_0dWNi-ku49o9jOdITwnI4OA9oOXFtLnaZNPs3UEPp-FPdcd030V_OpFVapQszggkdls87mKHLxLo5zFpA5ASGEJ_iKgVm5F3sipA7HAJ94dWgFxzSh386nFL_Fqm7qR26wAVvX3z1DbHifigwj1CgTSoCtGp-txF2TGXvILPcjK47a0tZPLVHC19gcdXbPC1NRyxAihJzZS0IiBrSxYh0V2lBNl6d91mKfKn7FWnlVHDIhoIg&sai=AMfl-YQ_gOcNjsg4WndngvRP6fxnIhhcdtCE1CdXPs5-n9FSt5H_-_sqewW4RHiV_WrY_WLDWe_RKNUXTRexQ8m8B9zqpSyd731BfE6xLMVPt3WFxZjOlWzM5oJTLiAKdHc&sig=Cg0ArKJSzPx7zPD0XSnlEAE&urlfix=1&adurl=
Frame ID: 520FDF67380BA2AAE2D245318EA8EFB6
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJkwloId9UZk0C7vcoMUGP-6cXIm7Qk-Dg0fCcWTZ0NEMBxdCx_53i3y4CD-gyWFKFu0MEjSsD78z8-il6Gf71rxK8KxYp5Mk6bKeESCTT8Sq9RrRPFEWvp1JulrxSzWxKHttQUOZBLRDz7P3JM8HMTC612eFThnPE-jxdtT1vomh8hiDPlVohn5GBgODCRXVXVYK-zzCK1deagfWLOqlFVRZvl1O5TREmffmGwPsAFo-YfW-I7LTd_JVe10o4p321pp6N_Y7kTaXYWQMQ9EMQDGE&sai=AMfl-YQReANszU3Mj8IReji9QrcECIh-HGGV0-vmgOXrd7GDrGJgd0WHj6TaKMzyNa8i56mlQ0sshF5i26yJFSDNXcgLkjRU6mn30zrtEt2jK32bxQ33Pxa1X12LHWrK6Jl-&sig=Cg0ArKJSzNil4Hn6NxA3EAE&urlfix=1&adurl=
Frame ID: 4072A7EC5CB515B1A53DCB75116C109F
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Frame ID: 0621C94D477F71CDB4DE5A9071C64489
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Frame ID: E57AD8201DA2EBA0833098328EC8ED76
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Frame ID: 7F2C10DBB1734C48BAFE45C5A5E18806
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Frame ID: ABAF53A5E096394D47F0B24F32FF4F5E
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
Frame ID: 1794D6EDEAEBA4F8DA59BEA44DEC3B41
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Frame ID: 160A4D7C1FC9037B1FBF0AA21FCE8721
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Frame ID: DD6AE65A93D5F40B813239D00953BADE
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Frame ID: C9698DB8A0B0F0104B0F81ED6D6BD0AA
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Frame ID: 9D375E4796B03D09D4B2DAF85D324075
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Frame ID: 27FA01743BFF9D1805ECA8D8E8696C5A
Requests: 12 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: A894305AA8BCB4E0330CE49AD93D2742
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Frame ID: 8B0FF69094EBB572A3BFCE1FFE5D63D8
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 83D1DF36AAEE0B07386102E695354EDB
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Frame ID: 1035CF51A7ECAC282178369E6F940C31
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: BFAE0188E9D55EBB02E4C1CE389D01B1
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 509CE14DA1153615120CDA0DFD101468
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 426418967EC5A7776D6B79354E3B795D
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: C149F6A9FF7D4B052C0386FF15E27B5E
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: D31AF5F131611DCBA7732D6918874CB3
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: F0F30F0A25D2049DCFDE41B5FABF6397
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Frame ID: CC83F99623755D906F6C68168E53BCEF
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: A15331F140F66B9F6DC57FDD53BC6FDA
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: AF4518B031CFFF9414988E66BF88293E
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 20774A6D1CF8917BED1DB84F8684AB45
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 5E5E6DFB7A0AD0BAD22D2E2129C7A573
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 42C646E59B113B3A598CB89D4EC55586
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 515BCA8FD74261D6D6B96ED0F9F08DE6
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 7CC769A1D3951FBC248041E872C4B5EE
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: A77C97ADA5A95AACF8526EDAAF1F0FED
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: F6A003366C205CE4407DBCD742349BD2
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 4C39E72584F40EF763F88677FB624441
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Frame ID: EE1414C621118EDADCAEDAF3EF7FA013
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Frame ID: 92FB55CA14DFDA30A0AA12A14182679E
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Frame ID: A29DBCBD94080DB9870FDABEB2F5502A
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Frame ID: 875BACB53950163112077FA73C3A9485
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Frame ID: 59EE099CEA5D836993C655671831CA5E
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Frame ID: DE53A59B0A53D4977587635856E7A4E1
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://ncmhcso.org/ HTTP 301
    https://ncmhcso.org/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i

Page Statistics

433
Requests

98 %
HTTPS

38 %
IPv6

53
Domains

65
Subdomains

35
IPs

8
Countries

5249 kB
Transfer

10083 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://ncmhcso.org/ HTTP 301
    https://ncmhcso.org/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 97
  • https://mc.yandex.com/sync_cookie_image_check HTTP 302
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9308.c9VWNxU_8jnFfUeB9ZDQkqLptXuF2UG8qpscmunB9yDn7SA3bW0JVyp7c5ZD0wzp.pvy75vCegxafuUcLN2CSr-ndAB4%2C HTTP 302
  • https://mc.yandex.com/sync_cookie_image_decide?token=9308.EehRMYuS1cxGUjujJxZij_6o3OEuUVSper2DBITr9zGLGOPjEoHOgBVGQQebsuY5PiUbrVQWb0EeiTUszshplg%2C%2C.n7rIJha9Uxq8IgrvpJLe0jQCi20%2C
Request Chain 105
  • https://mc.yandex.com/watch/68669068?wmode=7&page-url=https%3A%2F%2Fncmhcso.org%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Alvg2sn1re62lx62l%3Afp%3A306%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A562%3Acn%3A1%3Adp%3A0%3Als%3A596760834038%3Ahid%3A422011575%3Az%3A120%3Ai%3A202106180101557%3Aet%3A1624004157%3Ac%3A1%3Arn%3A649063888%3Au%3A1624004157775488931%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1624004156526%3Ads%3A0%2C17%2C47%2C4%2C60%2C0%2C%2C%2C%2C%2C%2C%2C%3Adsn%3A0%2C18%2C47%2C3%2C60%2C0%2C%2C%2C%2C%2C%2C%2C%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1624004158%3At%3AMedizinische%20Informationen%2C%20Die%20Sie%20Vertrauen%20K%C3%B6nnen%20-%20ncmhcso HTTP 302
  • https://mc.yandex.com/watch/68669068/1?wmode=7&page-url=https%3A%2F%2Fncmhcso.org%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Alvg2sn1re62lx62l%3Afp%3A306%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A562%3Acn%3A1%3Adp%3A0%3Als%3A596760834038%3Ahid%3A422011575%3Az%3A120%3Ai%3A202106180101557%3Aet%3A1624004157%3Ac%3A1%3Arn%3A649063888%3Au%3A1624004157775488931%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1624004156526%3Ads%3A0%2C17%2C47%2C4%2C60%2C0%2C%2C%2C%2C%2C%2C%2C%3Adsn%3A0%2C18%2C47%2C3%2C60%2C0%2C%2C%2C%2C%2C%2C%2C%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1624004158%3At%3AMedizinische%20Informationen%2C%20Die%20Sie%20Vertrauen%20K%C3%B6nnen%20-%20ncmhcso
Request Chain 124
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB0Xw5OigJlwcy2OpKAzedE&google_cver=1
Request Chain 125
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMxWPhJ5PK0fl3gSP-5zlwAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB0Xw5OigJlwcy2OpKAzedE&google_cver=1
Request Chain 126
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEPTkLTO0ZK2ysrthepr4oro&google_cver=1
Request Chain 127
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkxOTA2MDA2MjIxMjQ1MDQ0Ng%3D%3D
Request Chain 141
  • https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.26325862960156354 HTTP 302
  • https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.26325862960156354
Request Chain 143
  • https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.6342927061272257 HTTP 302
  • https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.6342927061272257
Request Chain 145
  • https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.46656032025398697 HTTP 302
  • https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.46656032025398697
Request Chain 244
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESENwY52Qky20EJeOfjhsz_po&google_cver=1&google_push=AYg5qPK980N-X_kv91M9PUMZF_hTctkOMzQ9_v8uTTziBzS02wd1TufEcPoNRP_EmQ-XY5NwUk3cXiIV7Q2koinU0PnW5dm_yA HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPK980N-X_kv91M9PUMZF_hTctkOMzQ9_v8uTTziBzS02wd1TufEcPoNRP_EmQ-XY5NwUk3cXiIV7Q2koinU0PnW5dm_yA
Request Chain 245
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESENr99uNDXmzBtbCZ1Lj7boQ&google_cver=1&google_push=AYg5qPLbdLxumFfv7UYdXM36YKdf6YfSVNpdNjPYITkvbZOXzF08JF4XjN8DXdqSMnJd-j2JUjALZd8lY3ze7--ykitiiy7LP_A HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTA0NDc2MDA2NzQzODczMw%3D%3D&google_push=AYg5qPLbdLxumFfv7UYdXM36YKdf6YfSVNpdNjPYITkvbZOXzF08JF4XjN8DXdqSMnJd-j2JUjALZd8lY3ze7--ykitiiy7LP_A
Request Chain 246
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEMo086IeiljYESIbGtu7hCI&google_cver=1&google_push=AYg5qPJ-BkF7lW0HuWu5avacGMkPwLgrMTJmA-CtdLW-6z93NwsOC6Qz3R0FPv9GiwaQP3YfjX6GuwLHrhBPVdsxIh8UA6gkkGQ HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEMo086IeiljYESIbGtu7hCI&google_cver=1&google_push=AYg5qPJ-BkF7lW0HuWu5avacGMkPwLgrMTJmA-CtdLW-6z93NwsOC6Qz3R0FPv9GiwaQP3YfjX6GuwLHrhBPVdsxIh8UA6gkkGQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJ-BkF7lW0HuWu5avacGMkPwLgrMTJmA-CtdLW-6z93NwsOC6Qz3R0FPv9GiwaQP3YfjX6GuwLHrhBPVdsxIh8UA6gkkGQ&google_hm=nn6_oCotQ466icIIl6wXAQ==
Request Chain 247
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDa-SzPKneQ6yKMq_DOsz8Y&google_cver=1&google_push=AYg5qPKXreuy4S_w7As9QQ-gVSFEPwwyYet5DBleRmc001376UtqCnH8gyIZM1pUMRXvCcoM5FOk6L2FHxKqGFaZ6MOmHTMELvg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVBS04tUy1GSkQ3&google_push=AYg5qPKXreuy4S_w7As9QQ-gVSFEPwwyYet5DBleRmc001376UtqCnH8gyIZM1pUMRXvCcoM5FOk6L2FHxKqGFaZ6MOmHTMELvg
Request Chain 248
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&s=184023&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_tc=
Request Chain 249
  • https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEBRDS3qrRMmAFoKE_s6Wb10&google_cver=1&google_push=AYg5qPLuMUnVq7owPN1m6itftkmT9uwvuQsdm2WhZwFSKwHLi3Vze4um4_D1BeuELcQ3ZMgbpKSQp8_0S2bhWMt2FAwpcDYoWqw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPLuMUnVq7owPN1m6itftkmT9uwvuQsdm2WhZwFSKwHLi3Vze4um4_D1BeuELcQ3ZMgbpKSQp8_0S2bhWMt2FAwpcDYoWqw&google_hm=NjU0ODI3MTg3NzQ0NDE4NjEyNg%3D%3D
Request Chain 260
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESENG1Oa6YSiIl8PP_3h6xdaU&google_cver=1&google_push=AYg5qPLSzb61ZXv89Et_Em8NWycSmi6wrxi-LX3pdrL6koiThRgw6D2SCls4uj8ku3dTr-i3uGeiOq_4P9b4JO29nQ2XmmOaGp2E HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODI5NjQ4ODA0NjA3NDM5ODA0Mw== HTTP 302
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESENG1Oa6YSiIl8PP_3h6xdaU&google_cver=1
Request Chain 261
  • https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cver=1&google_push=AYg5qPKQ6_disJqqFuOWvkcP2ErzFuS6VbOPt6lDdsx_tw71Bc1ORfw4Hf8hmz-0Dx6xPFauIpwSt3-2os9F9OfGMcgbhB7lRjhh HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cver=1&google_push=AYg5qPKQ6_disJqqFuOWvkcP2ErzFuS6VbOPt6lDdsx_tw71Bc1ORfw4Hf8hmz-0Dx6xPFauIpwSt3-2os9F9OfGMcgbhB7lRjhh HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=alFRVDBTaW4xTFU5RnY1&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cver=1&google_push=AYg5qPKQ6_disJqqFuOWvkcP2ErzFuS6VbOPt6lDdsx_tw71Bc1ORfw4Hf8hmz-0Dx6xPFauIpwSt3-2os9F9OfGMcgbhB7lRjhh
Request Chain 262
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESENr99uNDXmzBtbCZ1Lj7boQ&google_cver=1&google_push=AYg5qPLi2fgEnITNctYQ-yBE3FSeiOdtSOWhinR7KSTuqNmCKc3L3ki-MSzU2Vetajk4T7NbZ9P2C7F2hitRkZ67cifmG7vgdF8 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTA0NDc2MDA2NzQzODczMw%3D%3D&google_push=AYg5qPLi2fgEnITNctYQ-yBE3FSeiOdtSOWhinR7KSTuqNmCKc3L3ki-MSzU2Vetajk4T7NbZ9P2C7F2hitRkZ67cifmG7vgdF8
Request Chain 263
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESECoDsiULCRA0nEddzXluu70&google_cver=1&google_push=AYg5qPK6JZLhCNeLOpOuJfFS7la5B7hvTScxTMQN4lijxvk5JVZaQuGnnS8wUboOn84Gc_H_fj4Rdw-kyj4SYvGjo2UNQFslO4Q HTTP 302
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESECoDsiULCRA0nEddzXluu70&google_cver=1&google_push=AYg5qPK6JZLhCNeLOpOuJfFS7la5B7hvTScxTMQN4lijxvk5JVZaQuGnnS8wUboOn84Gc_H_fj4Rdw-kyj4SYvGjo2UNQFslO4Q&checkcookies=true HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=dOFKKMv9WWPXnbp6ifhjjg&google_push=AYg5qPK6JZLhCNeLOpOuJfFS7la5B7hvTScxTMQN4lijxvk5JVZaQuGnnS8wUboOn84Gc_H_fj4Rdw-kyj4SYvGjo2UNQFslO4Q
Request Chain 264
  • https://rtb.openx.net/sync/dds?google_gid=CAESECByOLzEsIUJ0HbACUr9Zxc&google_cver=1&google_push=AYg5qPI2GCIMtTuF_OEXE1DhfWHhF3sUkYvpQ79w7AQl-FrogiQbTQ9b2fG8HMI6GPrEPC2J8fqPVM9NRHBjhgm6jx7xgYGzSYk HTTP 302
  • https://rtb.openx.net/sync/dds?google_gid=CAESECByOLzEsIUJ0HbACUr9Zxc&google_cver=1&google_push=AYg5qPI2GCIMtTuF_OEXE1DhfWHhF3sUkYvpQ79w7AQl-FrogiQbTQ9b2fG8HMI6GPrEPC2J8fqPVM9NRHBjhgm6jx7xgYGzSYk&ox_sc=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI2GCIMtTuF_OEXE1DhfWHhF3sUkYvpQ79w7AQl-FrogiQbTQ9b2fG8HMI6GPrEPC2J8fqPVM9NRHBjhgm6jx7xgYGzSYk&google_hm=gCYJTqg_yR0bWe6kIZ7pjA==
Request Chain 265
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDa-SzPKneQ6yKMq_DOsz8Y&google_cver=1&google_push=AYg5qPLxCc00n8gQBHWCDBXqMpp4kESqqckm3mI4el2JX2WggaaGo5Hs_ob82iE4TOvykgWZb5y13oTl-u3e3roa8OFQ-MgWY5_q HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVBTTMtTi1KM1dR&google_push=AYg5qPLxCc00n8gQBHWCDBXqMpp4kESqqckm3mI4el2JX2WggaaGo5Hs_ob82iE4TOvykgWZb5y13oTl-u3e3roa8OFQ-MgWY5_q
Request Chain 266
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc=
Request Chain 296
  • https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPIKrVzTOoxGBvey0K-iyrVi2abwlf235bLYUqJXIZZ8w-7zFA8nWlO86_E_5eSAa2MU7M9X4ujmdjKuIFwNoK6CP1ZSwTvpf1TVAHApMeRRtRNpKUka0tKpyQQF8M_RsXxh-hvU1Uh-&google_gid=CAESEEsoPlwgP06xn1I9hsG6Pik&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU14V1FRQUFBQmlnY1JrcA&google_push=AYg5qPIKrVzTOoxGBvey0K-iyrVi2abwlf235bLYUqJXIZZ8w-7zFA8nWlO86_E_5eSAa2MU7M9X4ujmdjKuIFwNoK6CP1ZSwTvpf1TVAHApMeRRtRNpKUka0tKpyQQF8M_RsXxh-hvU1Uh-
Request Chain 297
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESENwY52Qky20EJeOfjhsz_po&google_cver=1&google_push=AYg5qPLXvrcRc_PxaMTwJ2CKhK19-iFklTMhiAR7M5cde6Vyb1RZU3Y_1ydequIrN_oqUsQtXjD1TAj72vv1xYptgdV958ZsuaE-XwSlwdX-LR_iWVIAtVllhYFbyc6tSOLpMI3exe7mi0ff HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=j69gzFZAQQC8AF63M86HXg&google_push=AYg5qPLXvrcRc_PxaMTwJ2CKhK19-iFklTMhiAR7M5cde6Vyb1RZU3Y_1ydequIrN_oqUsQtXjD1TAj72vv1xYptgdV958ZsuaE-XwSlwdX-LR_iWVIAtVllhYFbyc6tSOLpMI3exe7mi0ff
Request Chain 298
  • https://a.tribalfusion.com/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPI3-yf3xq5qHbFmf924oy1RTwvXgEcNvLxsNYM_q1Atrn_WtWcYV54oOsjpv8ia3dQ0QxNgE8FRdVoe77QFMJA71a7dSXm1CJJuGrxX_dio54iu1f-7ERiJwy3ZO3YszdEWfvcXTT0&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPI3-yf3xq5qHbFmf924oy1RTwvXgEcNvLxsNYM_q1Atrn_WtWcYV54oOsjpv8ia3dQ0QxNgE8FRdVoe77QFMJA71a7dSXm1CJJuGrxX_dio54iu1f-7ERiJwy3ZO3YszdEWfvcXTT0%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPI3-yf3xq5qHbFmf924oy1RTwvXgEcNvLxsNYM_q1Atrn_WtWcYV54oOsjpv8ia3dQ0QxNgE8FRdVoe77QFMJA71a7dSXm1CJJuGrxX_dio54iu1f-7ERiJwy3ZO3YszdEWfvcXTT0&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPI3-yf3xq5qHbFmf924oy1RTwvXgEcNvLxsNYM_q1Atrn_WtWcYV54oOsjpv8ia3dQ0QxNgE8FRdVoe77QFMJA71a7dSXm1CJJuGrxX_dio54iu1f-7ERiJwy3ZO3YszdEWfvcXTT0%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Request Chain 299
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEMN5yPTtnG1bfsPeSWMMMkk&google_cver=1&google_push=AYg5qPKX4nDpMEnpM3QB6SbGkDxiGjTV1zItsugqrEe4CjVP_rSpZGqqWbeaXD3pRUI7-Rvtc3ElJsVsxspzBMfQFhD0ihNeT8HY83kkbbrrbUe9tgnOdfQZ3yMcHW3Evh-QHQk4iWLcIy4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEMN5yPTtnG1bfsPeSWMMMkk&google_push=AYg5qPKX4nDpMEnpM3QB6SbGkDxiGjTV1zItsugqrEe4CjVP_rSpZGqqWbeaXD3pRUI7-Rvtc3ElJsVsxspzBMfQFhD0ihNeT8HY83kkbbrrbUe9tgnOdfQZ3yMcHW3Evh-QHQk4iWLcIy4
Request Chain 301
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEIlchgsYrcTYzQj9olwz2Hk&google_cver=1&google_push=AYg5qPI_-jXK1-wPEEW830Ykk_t_pzaGtRfMZCxHkXyOZrSFMnFIxHIp-mNRVkwo-uWVKeAneeYMD-RrcUyBHXt8pi51TX-M5RwCk8FDihu8N2MfoZBFXql-yMB0jIubWx8grYgmTMhdBC0 HTTP 307
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEIlchgsYrcTYzQj9olwz2Hk&google_cver=1&google_push=AYg5qPI_-jXK1-wPEEW830Ykk_t_pzaGtRfMZCxHkXyOZrSFMnFIxHIp-mNRVkwo-uWVKeAneeYMD-RrcUyBHXt8pi51TX-M5RwCk8FDihu8N2MfoZBFXql-yMB0jIubWx8grYgmTMhdBC0&sovrn_retry=true HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPI_-jXK1-wPEEW830Ykk_t_pzaGtRfMZCxHkXyOZrSFMnFIxHIp-mNRVkwo-uWVKeAneeYMD-RrcUyBHXt8pi51TX-M5RwCk8FDihu8N2MfoZBFXql-yMB0jIubWx8grYgmTMhdBC0&google_hm=93258c300a564f1ec05f1414
Request Chain 307
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 365
  • https://a.tribalfusion.com/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPLdF8chLGuxSxKhNjn34_ZXEFFb5BzGXdxvbyNYhSu6M-lmgXNWyxkXTENnVLw9EpnMykipY8a5cQMR5aDQOTMvLhey3Iv83NHqgBG9d17Zpx57KBzwKqGhusoM_5ArRHbkTmDqMQ&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPLdF8chLGuxSxKhNjn34_ZXEFFb5BzGXdxvbyNYhSu6M-lmgXNWyxkXTENnVLw9EpnMykipY8a5cQMR5aDQOTMvLhey3Iv83NHqgBG9d17Zpx57KBzwKqGhusoM_5ArRHbkTmDqMQ%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPLdF8chLGuxSxKhNjn34_ZXEFFb5BzGXdxvbyNYhSu6M-lmgXNWyxkXTENnVLw9EpnMykipY8a5cQMR5aDQOTMvLhey3Iv83NHqgBG9d17Zpx57KBzwKqGhusoM_5ArRHbkTmDqMQ&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPLdF8chLGuxSxKhNjn34_ZXEFFb5BzGXdxvbyNYhSu6M-lmgXNWyxkXTENnVLw9EpnMykipY8a5cQMR5aDQOTMvLhey3Iv83NHqgBG9d17Zpx57KBzwKqGhusoM_5ArRHbkTmDqMQ%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Request Chain 366
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEF4GIZUvGuaqhdaf0e0J85g&google_cver=1&google_push=AYg5qPIqd_oLapWUD81m40sN73aHmuyAhmzbJoW7tyGX2dAfKAaq8Ns9QUkP2tZtvmP4YI0zTNNl4L1jGCqI3C77DDVmkJOlMoVilEU1010H89BsUZGFSHdRYQ6R8BNgQ8xeOEWRhQsiaw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIqd_oLapWUD81m40sN73aHmuyAhmzbJoW7tyGX2dAfKAaq8Ns9QUkP2tZtvmP4YI0zTNNl4L1jGCqI3C77DDVmkJOlMoVilEU1010H89BsUZGFSHdRYQ6R8BNgQ8xeOEWRhQsiaw&google_hm=MbVItVZnQrOkvQ7PaW0ZE44
Request Chain 368
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&s=184023&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1
Request Chain 369
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEIlchgsYrcTYzQj9olwz2Hk&google_cver=1&google_push=AYg5qPIhBYIZU5aHkg8TCYdiGiAjutdqacZC2Eahzwhjy8lN4KwFifnXnmSV0_Rwi73DKy1oaWmmMX2SVrlyCRtr7aCJpgnCg2dKIIoh-yZTiEASjqM3MiyE-CCuXsiK6y8lveS6tdZPRBU HTTP 307
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEIlchgsYrcTYzQj9olwz2Hk&google_cver=1&google_push=AYg5qPIhBYIZU5aHkg8TCYdiGiAjutdqacZC2Eahzwhjy8lN4KwFifnXnmSV0_Rwi73DKy1oaWmmMX2SVrlyCRtr7aCJpgnCg2dKIIoh-yZTiEASjqM3MiyE-CCuXsiK6y8lveS6tdZPRBU&sovrn_retry=true HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIhBYIZU5aHkg8TCYdiGiAjutdqacZC2Eahzwhjy8lN4KwFifnXnmSV0_Rwi73DKy1oaWmmMX2SVrlyCRtr7aCJpgnCg2dKIIoh-yZTiEASjqM3MiyE-CCuXsiK6y8lveS6tdZPRBU&google_hm=f7f3b239a35b3db6df5213bf
Request Chain 370
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJTQVBQZ11dzDqIDKDp6WCU&google_cver=1&google_push=AYg5qPLqW_yWUqLQ7IfffyPfwzdLXOhZUjeWUE8lGv5ozXfvQmcJtQNBp8wgBTrk_5mJ4Gic62nk7uf6qB8tFBBkvo2QzajGK0UNFGSZCyCLw8Ve3AFp1FZqte_maBJ7fQ-RIWioJTAw8hc_ HTTP 302
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJTQVBQZ11dzDqIDKDp6WCU&google_cver=1&google_push=AYg5qPLqW_yWUqLQ7IfffyPfwzdLXOhZUjeWUE8lGv5ozXfvQmcJtQNBp8wgBTrk_5mJ4Gic62nk7uf6qB8tFBBkvo2QzajGK0UNFGSZCyCLw8Ve3AFp1FZqte_maBJ7fQ-RIWioJTAw8hc_&verify=true HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1xS0MyNlpoRTJ1RndBM2xCLjVFY1NJNHA2cjlqeVJhLn5B&google_push=AYg5qPLqW_yWUqLQ7IfffyPfwzdLXOhZUjeWUE8lGv5ozXfvQmcJtQNBp8wgBTrk_5mJ4Gic62nk7uf6qB8tFBBkvo2QzajGK0UNFGSZCyCLw8Ve3AFp1FZqte_maBJ7fQ-RIWioJTAw8hc_
Request Chain 377
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESENwY52Qky20EJeOfjhsz_po&google_cver=1&google_push=AYg5qPIbK2FwyvMAaACUVVR3m6l3akesB63k52TMw_8iPX26lKhWMolA_bXRaWkmnQAszmU8PCN8i9tTcDlBfVhypSYMFanPPI4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIbK2FwyvMAaACUVVR3m6l3akesB63k52TMw_8iPX26lKhWMolA_bXRaWkmnQAszmU8PCN8i9tTcDlBfVhypSYMFanPPI4
Request Chain 381
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDa-SzPKneQ6yKMq_DOsz8Y&google_cver=1&google_push=AYg5qPLdAGIe1JUf4zdmeaDQrAf92AqRwGX58Z1ofAOvuo9yL7l5zJdo3ARfpRcxtkjivUdCfcLOTX3vM92i1GtWF8x3iOuKzMw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVCQUwtMUEtMTgxMg==&google_push=AYg5qPLdAGIe1JUf4zdmeaDQrAf92AqRwGX58Z1ofAOvuo9yL7l5zJdo3ARfpRcxtkjivUdCfcLOTX3vM92i1GtWF8x3iOuKzMw
Request Chain 382
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1
Request Chain 383
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJTQVBQZ11dzDqIDKDp6WCU&google_cver=1&google_push=AYg5qPIc187KvSq3ANxCMQEYGK3Q1-IYxALRXv7EcyRfbTD2eQ4hrgPX_f6WAM85wjl0jkQjd03WaYdsxADZiQylENCHb-KY3Gv7 HTTP 302
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJTQVBQZ11dzDqIDKDp6WCU&google_cver=1&google_push=AYg5qPIc187KvSq3ANxCMQEYGK3Q1-IYxALRXv7EcyRfbTD2eQ4hrgPX_f6WAM85wjl0jkQjd03WaYdsxADZiQylENCHb-KY3Gv7&verify=true HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1xS0MyNlpoRTJ1RndBM2xCLjVFY1NJNHA2cjlqeVJhLn5B&google_push=AYg5qPIc187KvSq3ANxCMQEYGK3Q1-IYxALRXv7EcyRfbTD2eQ4hrgPX_f6WAM85wjl0jkQjd03WaYdsxADZiQylENCHb-KY3Gv7
Request Chain 389
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 391
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 399
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEF4GIZUvGuaqhdaf0e0J85g&google_cver=1&google_push=AYg5qPLXVqRRFycv4f9Bje0TOOj3niVFnMYQlQvK37P-qQ9kQ_zzzk2k5HQkqOyvPZFbT7CKVCZR28_PawFfeKict8E1BeY_9rw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPLXVqRRFycv4f9Bje0TOOj3niVFnMYQlQvK37P-qQ9kQ_zzzk2k5HQkqOyvPZFbT7CKVCZR28_PawFfeKict8E1BeY_9rw&google_hm=MbVItVZnQrOkvQ7PaW0ZE44
Request Chain 400
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEMo086IeiljYESIbGtu7hCI&google_cver=1&google_push=AYg5qPI2rWWzxDmtoMUb_yc6h6BXi5SVvRoCDmamnoEAchZl60hAxZt8A--TqfFP2-x8AH2LmDKte8JnlGt2otrhFT2QviPBmPE HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEMo086IeiljYESIbGtu7hCI&google_cver=1&google_push=AYg5qPI2rWWzxDmtoMUb_yc6h6BXi5SVvRoCDmamnoEAchZl60hAxZt8A--TqfFP2-x8AH2LmDKte8JnlGt2otrhFT2QviPBmPE HTTP 302
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=google HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=2159827871749741986&expires=30&ssp=google HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPI2rWWzxDmtoMUb_yc6h6BXi5SVvRoCDmamnoEAchZl60hAxZt8A--TqfFP2-x8AH2LmDKte8JnlGt2otrhFT2QviPBmPE&google_hm=Ca-Auw5ESbaZmgIe0IgKbA==
Request Chain 401
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECDHcZU6r37gbQIA91KFDtc&google_cver=1&google_push=AYg5qPI44DR7cfDvIJKqeU7AxMDm8lpkriUnWnHI0LxC_Ep8W2MiMndm6DLHSqX86rVefJjEQMRR4wANxQV0ZrgA_fgaBwcFEj4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPI44DR7cfDvIJKqeU7AxMDm8lpkriUnWnHI0LxC_Ep8W2MiMndm6DLHSqX86rVefJjEQMRR4wANxQV0ZrgA_fgaBwcFEj4&google_hm=NzE5OTgxMzk1NDMzNzE0OTM4NQ%3D%3D
Request Chain 402
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESENrBjr9dqI0kLIkkp_Ih20M&google_cver=1&google_push=AYg5qPI-dq6Mqb7SdP70x8nx9kO8R-MnNw807_WAMjR2AZ_fqmxU2HlWFU7OqCtLi5puuJS-Zxz_y-0Gqtg_MKAvhwp6aow1lA HTTP 302
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPI-dq6Mqb7SdP70x8nx9kO8R-MnNw807_WAMjR2AZ_fqmxU2HlWFU7OqCtLi5puuJS-Zxz_y-0Gqtg_MKAvhwp6aow1lA&google_gid=CAESENrBjr9dqI0kLIkkp_Ih20M HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NTI5NTEwMzM3MDM2NDQxMzAyNQ%3D%3D&google_push=AYg5qPI-dq6Mqb7SdP70x8nx9kO8R-MnNw807_WAMjR2AZ_fqmxU2HlWFU7OqCtLi5puuJS-Zxz_y-0Gqtg_MKAvhwp6aow1lA
Request Chain 403
  • https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEBRDS3qrRMmAFoKE_s6Wb10&google_cver=1&google_push=AYg5qPICQoO_sX2D5ormD1j3o2YzfVhuWu1PhItcYsJ2VQyQHU6Lj5Czgeheyt6P0AH8IRIHHQAjwxVnQdNFp3qSEWPV-VdX0KA HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPICQoO_sX2D5ormD1j3o2YzfVhuWu1PhItcYsJ2VQyQHU6Lj5Czgeheyt6P0AH8IRIHHQAjwxVnQdNFp3qSEWPV-VdX0KA&google_hm=NTM0MDE1NjkwOTUzMDQ0MDE5
Request Chain 406
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESENG1Oa6YSiIl8PP_3h6xdaU&google_cver=1&google_push=AYg5qPL9Tx_RReg6KH3J6kQUD5EgDy-L6nEPWxtNU1Gd7oXGrSAgjzxuHBzwlTtLtTY7-fVtAoXwsYHKBUoYXFsq6PysIKpClmxg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODQ2MzEyMTIzMjI4NzEwNjM5NQ== HTTP 302
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEFTkfxTOooSg7x5UA4Ic3D4&google_cver=1
Request Chain 407
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEMN5yPTtnG1bfsPeSWMMMkk&google_cver=1&google_push=AYg5qPKrMB9e-O7ZUtMOp6s-jKa3bd6Ktj2dlF5g1AkCbYOQsV-l8DCgM92xgJSHBa72pae1OeOd9goq4VYYFvkFaqGl8UmLdTZ5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEMN5yPTtnG1bfsPeSWMMMkk&google_push=AYg5qPKrMB9e-O7ZUtMOp6s-jKa3bd6Ktj2dlF5g1AkCbYOQsV-l8DCgM92xgJSHBa72pae1OeOd9goq4VYYFvkFaqGl8UmLdTZ5
Request Chain 408
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESECoDsiULCRA0nEddzXluu70&google_cver=1&google_push=AYg5qPJH-3RaOYlrF9msdWa12vImJ0jxrG7kN7sTfyE4aOqlHVnLSYCzLBPHhNc0oHAHQGUZxLsDRja3sSN_hjocr2q5E-fX3lU- HTTP 302
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESECoDsiULCRA0nEddzXluu70&google_cver=1&google_push=AYg5qPJH-3RaOYlrF9msdWa12vImJ0jxrG7kN7sTfyE4aOqlHVnLSYCzLBPHhNc0oHAHQGUZxLsDRja3sSN_hjocr2q5E-fX3lU-&checkcookies=true HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=rBMEGhGoTArOwhCIVaUxWA&google_push=AYg5qPJH-3RaOYlrF9msdWa12vImJ0jxrG7kN7sTfyE4aOqlHVnLSYCzLBPHhNc0oHAHQGUZxLsDRja3sSN_hjocr2q5E-fX3lU-
Request Chain 409
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDa-SzPKneQ6yKMq_DOsz8Y&google_cver=1&google_push=AYg5qPIGHaElpjcrSyrlxrgYDdtDI2RvV_k0W1o8SupexFda0_gjiE8IAw0mhAuhir2zDlnbR6uoSFePhevefVGH7eCEidHOJcZO HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVCSVEtMUEtN1hG&google_push=AYg5qPIGHaElpjcrSyrlxrgYDdtDI2RvV_k0W1o8SupexFda0_gjiE8IAw0mhAuhir2zDlnbR6uoSFePhevefVGH7eCEidHOJcZO
Request Chain 410
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEOhqQGO4KfqrATm_j5JINjY&google_cver=1&google_push=AYg5qPIgNlIpQqHLvqB2IZiQzdjCnezXYZbshdfVOCQUUUwEb9kJEP8o0k0BzL1wscqfXYae6n_XTDpd1zLdwAHfC3Y-v709AHk HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPIgNlIpQqHLvqB2IZiQzdjCnezXYZbshdfVOCQUUUwEb9kJEP8o0k0BzL1wscqfXYae6n_XTDpd1zLdwAHfC3Y-v709AHk
Request Chain 411
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESENrBjr9dqI0kLIkkp_Ih20M&google_cver=1&google_push=AYg5qPISDww0w3EFpEyH7ICuL20lMW4RgtbmzoalbkSFoD3XvDQlTKXbVy2etyi_kOUFoWIjtnA74LGtUWhbbDV4zE-fhDncD3dC HTTP 302
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPISDww0w3EFpEyH7ICuL20lMW4RgtbmzoalbkSFoD3XvDQlTKXbVy2etyi_kOUFoWIjtnA74LGtUWhbbDV4zE-fhDncD3dC&google_gid=CAESENrBjr9dqI0kLIkkp_Ih20M HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NTI5NTEwMzM3MDM2NDQxMzAyNQ%3D%3D&google_push=AYg5qPISDww0w3EFpEyH7ICuL20lMW4RgtbmzoalbkSFoD3XvDQlTKXbVy2etyi_kOUFoWIjtnA74LGtUWhbbDV4zE-fhDncD3dC
Request Chain 412
  • https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESED4R2aliifiM0_ib6UxrfvM&google_cver=1&google_push=AYg5qPLA-_Hx-vKhSvpnsc63wUWsf91wF_f-HJ0_ZKYQbbYq_qZ3ni6n4HRa3bLknT-7sNIpMtR3N5QcH5t57r0wOL49tJvdtRHTbw HTTP 302
  • https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESED4R2aliifiM0_ib6UxrfvM&google_cver=1&google_push=AYg5qPLA-_Hx-vKhSvpnsc63wUWsf91wF_f-HJ0_ZKYQbbYq_qZ3ni6n4HRa3bLknT-7sNIpMtR3N5QcH5t57r0wOL49tJvdtRHTbw&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESED4R2aliifiM0_ib6UxrfvM&google_cver=1&google_push=AYg5qPLA-_Hx-vKhSvpnsc63wUWsf91wF_f-HJ0_ZKYQbbYq_qZ3ni6n4HRa3bLknT-7sNIpMtR3N5QcH5t57r0wOL49tJvdtRHTbw&apid=UP6bb92585-d00d-11eb-a91f-02cf5c076976 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA2YmI5MjU4NS1kMDBkLTExZWItYTkxZi0wMmNmNWMwNzY5NzY%3D&google_push=AYg5qPLA-_Hx-vKhSvpnsc63wUWsf91wF_f-HJ0_ZKYQbbYq_qZ3ni6n4HRa3bLknT-7sNIpMtR3N5QcH5t57r0wOL49tJvdtRHTbw
Request Chain 417
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 419
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESED16djXEDmtnj-qPyy2yGTg&google_cver=1&google_push=AYg5qPJm8Drq0KDsv2DOCzsRcfU8wQwMacKR0IvXbPpg8ETQ8MQTiuQ2RSQ1U9CBrZ6LHm7uW976hCmZlV9FLwRW9Vtj4hJP82w HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJm8Drq0KDsv2DOCzsRcfU8wQwMacKR0IvXbPpg8ETQ8MQTiuQ2RSQ1U9CBrZ6LHm7uW976hCmZlV9FLwRW9Vtj4hJP82w&google_hm=bwgcKwy_w_-gGEY5ZpImeA
Request Chain 422
  • https://rtb.openx.net/sync/dds?google_gid=CAESECByOLzEsIUJ0HbACUr9Zxc&google_cver=1&google_push=AYg5qPI-fdDh7P3d6g32b4fqj-avdTymh1lEBuM9ct5XgPfS3BYGG58h4N3yv2k5G8JwBEKw96KXApgJ-FDnYj-DLaToZKN93Qs HTTP 302
  • https://rtb.openx.net/sync/dds?google_gid=CAESECByOLzEsIUJ0HbACUr9Zxc&google_cver=1&google_push=AYg5qPI-fdDh7P3d6g32b4fqj-avdTymh1lEBuM9ct5XgPfS3BYGG58h4N3yv2k5G8JwBEKw96KXApgJ-FDnYj-DLaToZKN93Qs&ox_sc=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI-fdDh7P3d6g32b4fqj-avdTymh1lEBuM9ct5XgPfS3BYGG58h4N3yv2k5G8JwBEKw96KXApgJ-FDnYj-DLaToZKN93Qs&google_hm=MsGjoOZZwgoeZkZvW_V7wg==
Request Chain 423
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEIj-CKepAuwGj_ndu29MM84&google_cver=1&google_push=AYg5qPJlmo6D1Kdw4Z8dThRWFNcVp_FGmrNKvYNIpSQ3ilk3A6H6Dbu31xqGcWnM059_xqW0831u-w1AvAMGDTD6zQefys04FXA HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEIj-CKepAuwGj_ndu29MM84&google_cver=1&google_push=AYg5qPJlmo6D1Kdw4Z8dThRWFNcVp_FGmrNKvYNIpSQ3ilk3A6H6Dbu31xqGcWnM059_xqW0831u-w1AvAMGDTD6zQefys04FXA&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=fwnFHZ5XS-mNmrhrqBUHUA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJlmo6D1Kdw4Z8dThRWFNcVp_FGmrNKvYNIpSQ3ilk3A6H6Dbu31xqGcWnM059_xqW0831u-w1AvAMGDTD6zQefys04FXA
Request Chain 424
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDa-SzPKneQ6yKMq_DOsz8Y&google_cver=1&google_push=AYg5qPJvGZfJVgJ4ULdLj84JKKjZlyKrfGAcvo1sEDEziN7UJSnZBSQDG9igoPGMT0FA5yA67a42WXdicVyybo1RAVDc5YxGKv0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVCTVEtVC01MUlL&google_push=AYg5qPJvGZfJVgJ4ULdLj84JKKjZlyKrfGAcvo1sEDEziN7UJSnZBSQDG9igoPGMT0FA5yA67a42WXdicVyybo1RAVDc5YxGKv0
Request Chain 425
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEOhqQGO4KfqrATm_j5JINjY&google_cver=1&google_push=AYg5qPJiip_8_tsJTAHeWGxkcqAulZOly7aDTkQqfSoYdLvP2a_uwgs2lpvHDGK0-AwT1s_Mq6RTtbTkteIslbw53CjajEA5Di4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJiip_8_tsJTAHeWGxkcqAulZOly7aDTkQqfSoYdLvP2a_uwgs2lpvHDGK0-AwT1s_Mq6RTtbTkteIslbw53CjajEA5Di4
Request Chain 428
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 430
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 435
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEF4GIZUvGuaqhdaf0e0J85g&google_cver=1&google_push=AYg5qPJI1Dho6GkZ5m_zrk34HZKVJoCGSIVhaCjhToXu1Z-FAmvNgaFNyIIJQpJmMyxX8cV00f2kIRw_-KTdXelshwn3jDv0b24s HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPJI1Dho6GkZ5m_zrk34HZKVJoCGSIVhaCjhToXu1Z-FAmvNgaFNyIIJQpJmMyxX8cV00f2kIRw_-KTdXelshwn3jDv0b24s&google_hm=MbVItVZnQrOkvQ7PaW0ZE44
Request Chain 436
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECDHcZU6r37gbQIA91KFDtc&google_cver=1&google_push=AYg5qPL9dAf8aqF1SUv99-7sVT2wjxmHbxMB3QCCzHpJZmNeG2famqJPVIz9a98WEhYylDT7DcexD9Mek34rjFMnrWSRY0FFgNc_ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPL9dAf8aqF1SUv99-7sVT2wjxmHbxMB3QCCzHpJZmNeG2famqJPVIz9a98WEhYylDT7DcexD9Mek34rjFMnrWSRY0FFgNc_&google_hm=NzE5OTgxMzk1NDMzNzE0OTM4NQ%3D%3D
Request Chain 437
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEBYmjzLfJuUb3MPVd7arEBE&google_cver=1&google_push=AYg5qPIX7wkErA6PRsPdExYy5_olyoMe0aBnXWp87MxE5qswTCGYLcOglYRBcWtbUgI7zGJQBx4r4PezbQUU2w70hegyb-vTdqoi HTTP 302
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEBYmjzLfJuUb3MPVd7arEBE&google_cver=1&google_push=AYg5qPIX7wkErA6PRsPdExYy5_olyoMe0aBnXWp87MxE5qswTCGYLcOglYRBcWtbUgI7zGJQBx4r4PezbQUU2w70hegyb-vTdqoi HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzc1ODAwODY4NDEyNjgxNjkyMg&google_push=AYg5qPIX7wkErA6PRsPdExYy5_olyoMe0aBnXWp87MxE5qswTCGYLcOglYRBcWtbUgI7zGJQBx4r4PezbQUU2w70hegyb-vTdqoi
Request Chain 438
  • https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEBRDS3qrRMmAFoKE_s6Wb10&google_cver=1&google_push=AYg5qPIZvoRSDwcrtqWtLS1DXLSkRzPMfGfwH5WvTmOmguilBhvKvt8ddRMg4OlE1Z2KoBKuQzTvf06wyZiO3blJxrx-kCqzIkw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPIZvoRSDwcrtqWtLS1DXLSkRzPMfGfwH5WvTmOmguilBhvKvt8ddRMg4OlE1Z2KoBKuQzTvf06wyZiO3blJxrx-kCqzIkw&google_hm=NTM0MDE1NjkwOTUzMDQ0MDE5
Request Chain 439
  • https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESED4R2aliifiM0_ib6UxrfvM&google_cver=1&google_push=AYg5qPImWGIw2sY3rjnQYlVcja3dJn4QYN-JIbtDPpzq0gQG-poZOJT5sQeIVkabXD_BS1WSjUfXvTACoJ6wh-NQLt-yZaj_HlVzLg HTTP 302
  • https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESED4R2aliifiM0_ib6UxrfvM&google_cver=1&google_push=AYg5qPImWGIw2sY3rjnQYlVcja3dJn4QYN-JIbtDPpzq0gQG-poZOJT5sQeIVkabXD_BS1WSjUfXvTACoJ6wh-NQLt-yZaj_HlVzLg&apid=UP6bb92585-d00d-11eb-a91f-02cf5c076976 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA2YmI5MjU4NS1kMDBkLTExZWItYTkxZi0wMmNmNWMwNzY5NzY%3D&google_push=AYg5qPImWGIw2sY3rjnQYlVcja3dJn4QYN-JIbtDPpzq0gQG-poZOJT5sQeIVkabXD_BS1WSjUfXvTACoJ6wh-NQLt-yZaj_HlVzLg
Request Chain 443
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESENG1Oa6YSiIl8PP_3h6xdaU&google_cver=1&google_push=AYg5qPL16GFvoLJobaIuOlceJL4dfS6E5mackW6h359CwhZUXaFn25lNLRRFRtF_pAUPor3fz121zx83Jnhmr8s3D8kEcKhBcDaKz9hajSW8TtanQPa9w5WJuJVZ6PMWYVBJ03LRzuhHt0Q4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODQ2MzEyMTIzMjI4NzEwNjM5NQ== HTTP 302
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEFTkfxTOooSg7x5UA4Ic3D4&google_cver=1
Request Chain 444
  • https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cver=1&google_push=AYg5qPLnEcT3SUmKuH3NvGV3n3QixXEWapVNHkqrfx46ZIAoqOan-ucT71jCPUYWwqollmD5JowqWQ-_lCkx6wKIH9WPxSNOZxE-ArJmHEjQQ3DQAHSTRfSTcd9btChDr6mkf64ArfqRupwL HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cver=1&google_push=AYg5qPLnEcT3SUmKuH3NvGV3n3QixXEWapVNHkqrfx46ZIAoqOan-ucT71jCPUYWwqollmD5JowqWQ-_lCkx6wKIH9WPxSNOZxE-ArJmHEjQQ3DQAHSTRfSTcd9btChDr6mkf64ArfqRupwL HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RUJhVExsQkgxTFU5Rnc1&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cver=1&google_push=AYg5qPLnEcT3SUmKuH3NvGV3n3QixXEWapVNHkqrfx46ZIAoqOan-ucT71jCPUYWwqollmD5JowqWQ-_lCkx6wKIH9WPxSNOZxE-ArJmHEjQQ3DQAHSTRfSTcd9btChDr6mkf64ArfqRupwL
Request Chain 446
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESENr99uNDXmzBtbCZ1Lj7boQ&google_cver=1&google_push=AYg5qPJpySQ-iudyc8CK6bUtXhGte2ilfb6DHoH1GTOkTJvLo_j9LThOCZ09n-nDQMXehA-9foopcLff6UPhQ6EcwOz3INFqEZ2GO9rnJD1KUnqvkE2CpGCygazVAvbXKZecM7qmAtc6W-7l HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTA0NDc2NDM3NjQzMDczMw%3D%3D&google_push=AYg5qPJpySQ-iudyc8CK6bUtXhGte2ilfb6DHoH1GTOkTJvLo_j9LThOCZ09n-nDQMXehA-9foopcLff6UPhQ6EcwOz3INFqEZ2GO9rnJD1KUnqvkE2CpGCygazVAvbXKZecM7qmAtc6W-7l
Request Chain 447
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEBYmjzLfJuUb3MPVd7arEBE&google_cver=1&google_push=AYg5qPJqjTx2SBtBPfuhwiLb1sr_KJ-XSroblnzKGrq2qIZc4oFdKWS-EPGCQt-KMKIHhmYPThRFBMiQKth7Md4lLLpVFhJY3ZKxG2ldlEMv_tURVB6ZRHSQtvMJ6LgZSqMFki1koZ3bV1M HTTP 302
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEBYmjzLfJuUb3MPVd7arEBE&google_cver=1&google_push=AYg5qPJqjTx2SBtBPfuhwiLb1sr_KJ-XSroblnzKGrq2qIZc4oFdKWS-EPGCQt-KMKIHhmYPThRFBMiQKth7Md4lLLpVFhJY3ZKxG2ldlEMv_tURVB6ZRHSQtvMJ6LgZSqMFki1koZ3bV1M HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njk3NzMwNDMxMTc4NzMwNzYwMQ&google_push=AYg5qPJqjTx2SBtBPfuhwiLb1sr_KJ-XSroblnzKGrq2qIZc4oFdKWS-EPGCQt-KMKIHhmYPThRFBMiQKth7Md4lLLpVFhJY3ZKxG2ldlEMv_tURVB6ZRHSQtvMJ6LgZSqMFki1koZ3bV1M
Request Chain 448
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEMrUnK-mQNrwah8D_tr4_Pw&google_cver=1&google_push=AYg5qPJYJD2VfoF3ePk-nohjyl98EFRHhZCS7-mNLxHXm-ctK4rPkAiXe2KZI0_K2CTuXgpsF7JumKeKwR3h4bYeD-h5G3A2LU0R6c7QWbg-NyocmaBTe0G5Lr_1KkURVV-GGW-0fX4oxbDn HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-1ee0d14d-1714-470e-a824-1be06a4d5606-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAYg5qPJYJD2VfoF3ePk-nohjyl98EFRHhZCS7-mNLxHXm-ctK4rPkAiXe2KZI0_K2CTuXgpsF7JumKeKwR3h4bYeD-h5G3A2LU0R6c7QWbg-NyocmaBTe0G5Lr_1KkURVV-GGW-0fX4oxbDn%26google_hm%3DAx7g0U0XFEcOqCQb4GpNVgY HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJYJD2VfoF3ePk-nohjyl98EFRHhZCS7-mNLxHXm-ctK4rPkAiXe2KZI0_K2CTuXgpsF7JumKeKwR3h4bYeD-h5G3A2LU0R6c7QWbg-NyocmaBTe0G5Lr_1KkURVV-GGW-0fX4oxbDn&google_hm=Ax7g0U0XFEcOqCQb4GpNVgY
Request Chain 451
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 453
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si

433 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ncmhcso.org/
Redirect Chain
  • http://ncmhcso.org/
  • https://ncmhcso.org/
100 KB
15 KB
Document
General
Full URL
https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c6be205177c18200172a6c008cd6ff719ecc96f0cab72db76bda2e6775cc521
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
ncmhcso.org
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-type
text/html; charset=UTF-8
x-frame-options
SAMEORIGIN
cache-control
max-age=86400
expires
Sat, 19 Jun 2021 08:15:56 GMT
vary
Accept-Encoding
access-control-allow-origin
*
x-xss-protection
1; mode=block
cf-cache-status
DYNAMIC
cf-request-id
0abfc9f4bd00004ec2c2204000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=tNt7euzGgQvSzZYsr%2F4b%2FRH%2F1E9h5asjW1yqWuO7mUFfJO1i9G2KW%2FrddDAJg27DMCBJf577TYw2i2mV0sLSRrL8WRK%2FiMwlCRRi%2FTXQo1fMmNJNZF0qw4wn1usPpT9Kv6XwAA0%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6613129accc54ec2-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

Date
Fri, 18 Jun 2021 08:15:56 GMT
Transfer-Encoding
chunked
Connection
keep-alive
Cache-Control
max-age=3600
Expires
Fri, 18 Jun 2021 09:15:56 GMT
Location
https://ncmhcso.org/
cf-request-id
0abfc9f49900004e9d7b3a9000000001
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=LMnGJ%2BceMnrPXBdxGQX4EM9MA1z2tm%2FzKRgjN3mRRTuRJpgpg4ptrlXFZlrHOaerKGvrlrfTBQKXg2jcHA7Tfyv8v%2BHwEnqptyZr4e8EWwIns7s1zLCLPwTOPxkq0JhCXzpWGEE%3D"}],"group":"cf-nel","max_age":604800}
NEL
{"report_to":"cf-nel","max_age":604800}
Vary
Accept-Encoding
Server
cloudflare
CF-RAY
6613129a894a4e9d-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
/
ro3.biz/
20 KB
20 KB
Script
General
Full URL
https://ro3.biz/?pu=g5qtmmzqme5ha3ddf4ztonrr
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.198.248.63 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
8c9f3ee23b6ae0b36483139ef7ce1248148795f0a30b2ce63f86f42a9fe646b5
Security Headers
Name Value
Content-Security-Policy img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 18 Jun 2021 08:15:56 GMT
server
nginx
content-security-policy
img-src https: data:; upgrade-insecure-requests
strict-transport-security
max-age=31536000
content-type
application/javascript; charset=UTF-8
701e95e6-7737-482a-9dc2-06280155425a.min.js
cmp.optad360.io/items/
497 B
832 B
Script
General
Full URL
https://cmp.optad360.io/items/701e95e6-7737-482a-9dc2-06280155425a.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:cc00:6:b871:4f00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bd7680f0d4768bf17b38b5834d7671e6e456d9655b4ae3cb39186d1fcd93f5c2

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 02:07:16 GMT
via
1.1 a32f966fc5896281eb3de44fd8f57d40.cloudfront.net (CloudFront)
last-modified
Mon, 12 Apr 2021 08:54:56 GMT
server
AmazonS3
age
24977
etag
"7acdc116a0830ba0aef5e087010246ba"
x-cache
Error from cloudfront
content-type
application/javascript
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
497
x-amz-cf-id
4sSF0EVdk_MMvlmrUohoB_f--kR9qSK_RebAK6YNmB5Wnof_SB8VvQ==
plugin.min.js
get.optad360.io/sf/0cb56948-cae8-47f8-b292-fbe3862a81d2/
251 KB
70 KB
Script
General
Full URL
https://get.optad360.io/sf/0cb56948-cae8-47f8-b292-fbe3862a81d2/plugin.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206e:3a00:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
16726b76043e97235cf0b1f6cc92e799194b324647636f5da5867e9641e422bd

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 07:55:08 GMT
content-encoding
gzip
last-modified
Wed, 07 Apr 2021 11:04:17 GMT
server
AmazonS3
age
1249
etag
W/"58f0e2d6b2f64adb42f6d8b868ba8d14"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 7c17b3af9cda4d5f0ff45961b7be9fdc.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
x-amz-cf-pop
VIE50-C1
x-amz-cf-id
9Wpy9ZQa0A9Ii3fJJtJzTCRkkDbCzntgO536ISEnBDJeP8uW_At1Bg==
adManager.js
cst.cstwpush.com/static/
59 KB
60 KB
Script
General
Full URL
https://cst.cstwpush.com/static/adManager.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.42 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
4f7b6c826559e7a9fdd87aa3dab65d9032e27f9677e2c894bf8add376af093e6
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 18 Jun 2021 08:15:56 GMT
Connection
Keep-Alive
Last-Modified
Tue, 25 May 2021 14:27:38 GMT
x-amz-meta-s3cmd-attrs
atime:1621952841/ctime:1621952841/gid:0/gname:root/md5:f7f10698b0e6bb748101b0917e29d311/mode:33188/mtime:1621952770/uid:0/uname:root
x-amz-request-id
tx000000000000068af65a2-0060cc53d4-fb33aff-fra1a
etag
"f7f10698b0e6bb748101b0917e29d311"
Vary
Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW
1624004156.dop213.pa1.t,1624004156.cds033.pa1.shn,1624004156.cds033.pa1.c
Content-Type
text/plain
Cache-Control
max-age=2984
x-rgw-object-type
Normal
strict-transport-security
max-age=15552000; includeSubDomains; preload
Accept-Ranges
bytes
Content-Length
60434
cookieconsent.min.css
cdn.jsdelivr.net/npm/cookieconsent@3/build/
5 KB
1 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.css
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cd0d0b6e50ff01ff2f3a9a70d7cfb66a7c6cb9acf7a566325568be6d3bd31fc4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
28400
x-cache
HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f4f600002c526511b000000001
x-served-by
cache-fra19172-FRA
timing-allow-origin
*
server
cloudflare
etag
W/"135e-3nthfC1sCV/yhiNebPZMMo2hpL8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
cf-ray
6613129b1e232c52-FRA
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/
135 KB
48 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3796cf12ca9b6f5f93255046f5bf7d70a82c6b389698ed6c007903940c17c5ad
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
48867
x-xss-protection
0
server
cafe
etag
2918852401321146490
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 18 Jun 2021 08:15:56 GMT
style.min.css
ncmhcso.org/template/rubik/css/
25 KB
4 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/style.min.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1698abe528bb1f8e76991814a09aacb0ec7247d421ed2e4ff8f00e3fb1275712
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/style.min.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125137
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f51800004a80d72f3000000001
last-modified
Mon, 29 Mar 2021 13:27:10 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"643a-5beacd6c04d03-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=7UmIWRtnncss%2FU6a1Rr66y2covm%2FaFTNctrv7xnnPI3Il1U7icfY0ZEYCurqHPStRoO5ibVGjfk6S9MtZ6fmDfNaToXw4QB%2BD9VEw49Osn%2B5a%2ByM6YZzIlUCYE%2B24UZXqiZq5Fk%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129b5a9c4a80-FRA
expires
Wed, 30 Jun 2021 21:30:19 GMT
styles.css
ncmhcso.org/template/rubik/css/
2 KB
1 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/styles.css?ver=5.1.1
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3ad2fcb328295f1199d593adaba909f3eea790f695554ac3c1da7aa009fc0e0d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/styles.css?ver=5.1.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125137
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f51800004a80ca8af000000001
last-modified
Mon, 29 Mar 2021 13:27:10 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"695-5beacd6bf4361-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=KzJ0DTdgA7CB2uQ1EmxpEgrvcriyghGcBCSHnTzGr2L7Aus2agKhTiRTMGntUg2BfEe9rmWwlNIqcVPv0aN0hXR8mlK%2ByA3rL4Autoo4NsXqJDZ4%2BoFJf9kFnLAhxSKXJDpUqtU%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129b5aa44a80-FRA
expires
Wed, 30 Jun 2021 21:30:19 GMT
shortcode.css
ncmhcso.org/template/rubik/css/
8 KB
2 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/shortcode.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d6299ceb6ce9c971a58efb0bd1fe66a5eb96317a0dd675a608d7a1c12ec11fc7
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/shortcode.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125137
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f51800004a802386d000000001
last-modified
Mon, 29 Mar 2021 13:27:09 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1fcd-5beacd6bd013d-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=OC7dLrPJbYryxXcfXLVFlHrDhrTCp6zaOiI3dR9jSKr5O5nRXxTC09%2FMBa6VXGq1U3WyWWkvhIHWXjqJOJyZfM1u5iDhgh9y937OuwXBl5AMn4080EgW425iL3LL3b4oQcXEm%2BY%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129b5aa04a80-FRA
expires
Wed, 30 Jun 2021 21:30:19 GMT
bootstrap.css
ncmhcso.org/template/rubik/css/
36 KB
6 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/bootstrap.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3320c0d7115359837e0643f49b0828132df3424cedbb4b32428297dde2cf6c66
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/bootstrap.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125137
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f51600004a80e7b1d000000001
last-modified
Mon, 29 Mar 2021 13:27:05 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"91ab-5beacd675a719-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=0qinw2bc8BmaoegYujp%2BeSI751DK2HXmjrRYbDx98xqXhumWyrmsgTE%2F7qSty%2Buq2Sgdwt4V5EPEyyfAEJCUD%2BR64kl27gY2K5dsjFMbpHTgHQz%2FpYgPvm9WyY0uQzJjGfDlk7o%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129b5a984a80-FRA
expires
Wed, 30 Jun 2021 21:30:19 GMT
font-awesome.min.css
ncmhcso.org/template/rubik/css/
30 KB
7 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/font-awesome.min.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d3ed5e7e4c4aafe8c1f5d004e7eee33b5887117d2125848352a2cda86dd7ed0
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/font-awesome.min.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125137
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f51900004a801e39a000000001
last-modified
Mon, 29 Mar 2021 13:27:06 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"78e2-5beacd686dd79-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=yUCwtZr0id3lEpnBLEYVs1ThDt%2F4Eet%2BESoUBwiwpiGdl5%2BLfdT2BO4o%2FlhUjolZqamBYgYoj640nuC6ovmNk8HDushQg1BlKxNmxpxdDbgFIpQtNb38yVZl3CiEQj%2BeqC5mEus%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129b5aaf4a80-FRA
expires
Wed, 30 Jun 2021 21:30:19 GMT
external.css
ncmhcso.org/template/rubik/css/
58 KB
8 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/external.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2935547d3f71917ad204c10123bc6c14bc037d3814b760d50a7540cc0ef6734
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/external.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125137
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f51700004a80e7b1e000000001
last-modified
Mon, 29 Mar 2021 13:27:06 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"e889-5beacd684ca35-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=N467igI%2BgT2SUePP3JUOql9WVLiQ4L23Lcbs0HWeqJg8toN17hFEPvh3YJDOG0zpENzlRfwI7k%2Fvc9l55pTQWZ5ajn1zZNDH9p25ezdJNLPISC9DEwLrKYdgtZt3frCNEgWM0cE%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129b5a9e4a80-FRA
expires
Wed, 30 Jun 2021 21:30:19 GMT
bkstyle.css
ncmhcso.org/template/rubik/css/
243 KB
35 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/bkstyle.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b51b115bd237a8ddd57dfcba97289c21e011e73888f1bbff4dfc7a6046ea245
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/bkstyle.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125136
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f51b00004a80f628a000000001
last-modified
Mon, 29 Mar 2021 13:27:05 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3cc29-5beacd676b0bb-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=USgyRzdIHf47vvnwhRJwJkUualSp83aqQRo7OpmP1aHdoKb3pZALD8OP4UC2gxKhxECrI8ZeDaVeV6v1kvaiXP30V8jdnizq94UP7KybRpVnAUNfVNt8YEYOutd9pc5nREFIzOc%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129b5a924a80-FRA
expires
Wed, 30 Jun 2021 21:30:20 GMT
css_1110.css
ncmhcso.org/template/rubik/css/
931 B
902 B
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/css_1110.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7dfdeeab3d7d536feca8c4d4ba7c7487eb380ae350cb6df273f88047519c404a
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/css_1110.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125136
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f51800004a800410b000000001
last-modified
Mon, 29 Mar 2021 13:27:05 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3a3-5beacd67af683-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=oyjlMwPHBhmwzTH4vRYOfztCjV7TUZjQsCOQxVjTyqVfg8y43%2FjyY5uhwssi2JHiMjQbQkmGTpGssB6XDnkel4CBeTOnrrXNhOKQOhrp8CfUgqsr0QawcJun4D1p1jEBUHlHuOM%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129b5aa94a80-FRA
expires
Wed, 30 Jun 2021 21:30:20 GMT
responsive.css
ncmhcso.org/template/rubik/css/
66 KB
8 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/responsive.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9066d3560e4855d5ad6b44ce3e5413931c24bcd03921ece8f582a947d632194d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/responsive.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125136
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f51700004a8038a6a000000001
last-modified
Mon, 29 Mar 2021 13:27:10 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"109e1-5beacd6bf4361-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=mwd0neAW5lkwoUb%2BCNxajc9oS9UY3RpM%2FpgJ9DBPUFX6PCFFnDQrZj%2Bd4JOBfe%2FUUFWDnnZIk2g1XUVMjArf8OSGhorMEHtlo5x9AKiMikZ4sRDK20KHWryFQGBABdOeoMfKfqY%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129b5a9a4a80-FRA
expires
Wed, 30 Jun 2021 21:30:20 GMT
css
fonts.googleapis.com/
27 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Libre+Baskerville%3A400%2C700%2C400italic%7COpen+Sans%3A300%2C400%2C600%2C700%2C800%2C300italic%2C400italic%2C600italic%2C700italic%2C800italic%7CPT+Serif%3A400%2C700%2C400italic%2C700italic&ver=1549941966
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2d1affae24db39c09d9df7afaa24f8c1fcbcad374d03acbc8d273744ba985252
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 08:04:23 GMT
server
ESF
date
Fri, 18 Jun 2021 08:15:56 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 08:15:56 GMT
jquery.js
ncmhcso.org/template/rubik/js/
95 KB
33 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery.js?ver=1.12.4
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf34e1b87bbfd9d9b185dec994924a496e279d8dc9387ad8d35bc0110134c4d3
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery.js?ver=1.12.4
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125136
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f51900004a80120c2000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"17a6a-5beacd6e190e0-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=gMuQtGFEvKbbfNSBem%2Fz6rQkOi9%2FGySETa8sqmFDTETXMXVJJi%2FWn1lT8mPY3qsjB6iJQSpqPYIPpVrCQD4tfUnATLQnqcSCmZv9HQYq9gMKP4NoWf9W1E%2FXUyS4SMVTtFgWuWM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129b5aab4a80-FRA
expires
Wed, 30 Jun 2021 21:30:20 GMT
jquery-migrate.min.js
ncmhcso.org/template/rubik/js/
10 KB
4 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery-migrate.min.js?ver=1.4.1
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery-migrate.min.js?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125136
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f51600004a80be115000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"2748-5beacd6dc5117-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Di0Xw443CAYQz8j%2Fv9gBP34r3h0HhkGx5SdRoZEVYcZYl5YAypLN3R7PwYyvOaWsmJftNgjA%2FNa3D8wYXuHT0N5z1F4ImjwnxXA%2BtvuhtSVxqg7HhbFWVnGiHNjh1cF%2FTrsETds%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129b5a994a80-FRA
expires
Wed, 30 Jun 2021 21:30:20 GMT
smrcp_19121001.js
cdn.zx-adnet.com/adx/
144 KB
19 KB
Script
General
Full URL
https://cdn.zx-adnet.com/adx/smrcp_19121001.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3701da754cd5a0bc28caf5540c9d07c59164f08cfc5a3fb57ffc4864ce97abe5
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1624004157.853091,VS0,VE140
etag
"5b3dfee603f4fa43f768bcdb3f5f4a2cdce1c019b73ecbe79f7cb0d0ca77d787-br"
x-served-by
cache-cdg20746-CDG
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600,public
date
Fri, 18 Jun 2021 08:15:56 GMT
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive
content-length
19503
x-cache-hits
0
how-do-i-use-potassium-permanganate.webp
ncmhcso.org/img/health/
65 KB
66 KB
Image
General
Full URL
https://ncmhcso.org/img/health/how-do-i-use-potassium-permanganate.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8f9c0f2a66f6b525d673234d1a154cbab6e8e818444ae3dbcdcdc1e363447541
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/how-do-i-use-potassium-permanganate.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2687
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
66526
cf-request-id
0abfc9f58d00004a801938c000000001
last-modified
Mon, 29 Mar 2021 12:15:34 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"103de-5beabd6b67baa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=y9M6W0HHQBSa%2BQZaAcsSPHydoPileLOXczZ3lBArUtuVyZR5z6VDsyOn7DhlVce4fnNbLIgDyPq9DhkhCZWfKJvkqPGscZQkuIpK7u2Geu9tf%2BUVcevdfaVLkJcQ4UK%2BLTzpx%2F4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfc9b4a80-FRA
expires
Fri, 25 Jun 2021 07:31:09 GMT
what-are-the-early-signs-of-fatty-liver-disease-2.webp
ncmhcso.org/img/healths/
36 KB
37 KB
Image
General
Full URL
https://ncmhcso.org/img/healths/what-are-the-early-signs-of-fatty-liver-disease-2.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a02543a271a2e93a371359389f7f0829c41c043b199a62fd3b16aca9e8be6bed
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/what-are-the-early-signs-of-fatty-liver-disease-2.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2687
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
37016
cf-request-id
0abfc9f59000004a80febca000000001
last-modified
Mon, 29 Mar 2021 13:26:00 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"9098-5beacd29f62e1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=LHh2orevzNVjhr058WdT%2BIfx8cRaXfGOSThhR0JPAwWl%2BAcYAVWxg9yF41Uo%2Bkrdlx2zMUvvfx72lbqvP97zTNIFqzqfVBF4HjsZPAQlJS81PLXrlEHDlyuPjfvE4vRFZWnRy1k%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfc9f4a80-FRA
expires
Fri, 25 Jun 2021 07:31:09 GMT
mengenal-terapi-hormonal-untuk-saha-syndrome-1.webp
ncmhcso.org/img/health-care/
46 KB
47 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/mengenal-terapi-hormonal-untuk-saha-syndrome-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4006b64a6ddf4849049fe8693771c52302c97b3e88d3aa35ac5865313e048b51
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/mengenal-terapi-hormonal-untuk-saha-syndrome-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
76609
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
47332
cf-request-id
0abfc9f58d00004a80120ce000000001
last-modified
Mon, 29 Mar 2021 12:58:49 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"b8e4-5beac71644d17"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=dsYn9TG8soFSVBmlNpjpKSn%2B5Ii%2BOElx4CZ5NpS%2BZ0XFS1f8674Qj4wqQNH8fibHKfT3GyX4z8XRdwwu5TYUEEL4eNUSd5iMvhK5EGjKXuPKqWP0WobWHfz0DXDz5vFtSg%2B%2B4cY%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfca14a80-FRA
expires
Thu, 24 Jun 2021 10:59:07 GMT
what-is-a-differential-diagnosis.webp
ncmhcso.org/img/health/
29 KB
29 KB
Image
General
Full URL
https://ncmhcso.org/img/health/what-is-a-differential-diagnosis.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fef8f00d7ff361898d09f4b65d83bb2099ffaf35a94346aaf9be9e04194c86a6
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/what-is-a-differential-diagnosis.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2687
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
29450
cf-request-id
0abfc9f5a100004a8028ad7000000001
last-modified
Mon, 29 Mar 2021 12:42:42 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"730a-5beac37c1b83c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ouWPPWdz1%2FcLgWen4kSdwi9FlR8fZmL6yW0h6oj6hCfxx6DGPpNKeydUbGYsx7EN9W4Y1SxGmivIAbBXioWSiNgwfs1E00xhXJ4EwWTdRj7BhwbJmyiCK%2FHAbAeesza2Vl5IwYw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfca54a80-FRA
expires
Fri, 25 Jun 2021 07:31:09 GMT
endometriosis-real-talk-pain-doesnt-need-to-be-your-normal-1.webp
ncmhcso.org/img/health/
38 KB
38 KB
Image
General
Full URL
https://ncmhcso.org/img/health/endometriosis-real-talk-pain-doesnt-need-to-be-your-normal-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0ce2127e2b4b945b4b6a14941f8a1b4eaeea5efa1bfee9f282a3644e2101a38
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/endometriosis-real-talk-pain-doesnt-need-to-be-your-normal-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
38500
cf-request-id
0abfc9f58f00004a80ec9be000000001
last-modified
Mon, 29 Mar 2021 12:12:55 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"9664-5beabcd3cb168"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=GialaY9YYiCqjbBLHzp6mPfBL5nCvHdvW5Gy4t84OtFonINuLGLZYyiYtD5LhyOcO1PwQWYHWHQe6eyURp57Oy4keSSGctuIwYsUC3WPNyb%2BpJhGXzPo1kGyOZshZAlE1QKPXXE%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfca94a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
how-long-does-it-take-to-detox-from-alcohol.webp
ncmhcso.org/img/health/
42 KB
43 KB
Image
General
Full URL
https://ncmhcso.org/img/health/how-long-does-it-take-to-detox-from-alcohol.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7b066e3aa45dc331dacc74fa884c5c588a031fa19dcc6a79834ee4ed03fcf9e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/how-long-does-it-take-to-detox-from-alcohol.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
43346
cf-request-id
0abfc9f58f00004a801938d000000001
last-modified
Mon, 29 Mar 2021 12:20:17 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"a952-5beabe7916cb2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=G8TsARP%2BR70L2ZVRIAJHFqFW43FHdtp4VDl7HUP47ilYuVVLcQZafgVAn94DlI9HVb5%2FjRla%2B8OrwYygI%2FiQSvkBYrga8vM3%2BoIcf%2Fs3krUZcUGNBR9fAv9aj0eye%2BDe6bj0LDs%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcaf4a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
newly-discovered-gene-could-help-doctors-fight-heart-disease.webp
ncmhcso.org/img/about-everything/
59 KB
59 KB
Image
General
Full URL
https://ncmhcso.org/img/about-everything/newly-discovered-gene-could-help-doctors-fight-heart-disease.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb2eef2b6b36030d9ccee4fc669d3a400e9a53dc9b7aee9105e36f3879ce430e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/about-everything/newly-discovered-gene-could-help-doctors-fight-heart-disease.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
60148
cf-request-id
0abfc9f59000004a80013ca000000001
last-modified
Thu, 01 Apr 2021 17:53:10 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"eaf4-5beece7996374"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=WbD3MGN9l8jZMLc2%2FcTSExde%2BnzvCbtz%2FMJ%2FnzUVPn5WkPICaLZe0FMSvjKfb5qHNQP59HolkKRyRoBeAuifFntPHqHTB1b%2F1vCvRZtDB%2FbdZidXEuFNStijRJx736e5jT9Leyw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcb14a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
ketahui-peranan-pelembap-untuk-dermatitis-atopik-1.webp
ncmhcso.org/img/health-care/
31 KB
31 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/ketahui-peranan-pelembap-untuk-dermatitis-atopik-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f962292f54a0af7d847fd22b0287247b1631dab1d64e789ccc66a4cf554ba6f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/ketahui-peranan-pelembap-untuk-dermatitis-atopik-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
31270
cf-request-id
0abfc9f59000004a80dc9e0000000001
last-modified
Mon, 29 Mar 2021 12:56:31 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"7a26-5beac6921ccbe"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Zd%2FwtZwYeOH4oim%2FGu%2B%2F7BuNQACzLKdUKqNX9PWUlewGFO15PzL2w5K1wZ8R9JoqW4PGtYcXVWD1qQf57KG1ef8CWa%2FYbbBPaqkJnMb9iXsdyFG1FIivisA75JnyL8W8kC43P4Y%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcb24a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
hoved-halskrft-og-hpv.webp
ncmhcso.org/img/healths/
35 KB
35 KB
Image
General
Full URL
https://ncmhcso.org/img/healths/hoved-halskrft-og-hpv.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a6fca8abada4b5bde38f5d9112e464068b2b763f0dce2471f3e8cdf10b36a3ac
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/hoved-halskrft-og-hpv.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
66977
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
35694
cf-request-id
0abfc9f59100004a80392c7000000001
last-modified
Mon, 29 Mar 2021 13:12:50 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"8b6e-5beaca37c45e9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lxgpSn%2BvESskunUe1EjtlKCdHrLFqBI8iRpvfRkrMIX1QzZ3JtFRORjSF7ypYpgJx4s0hvgcjPh5xc5HT5nK4DtZgD9jJJ8FeBn9nncMzeLxV3l%2BZnwI2Baf1hiZXcImbC38r2I%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcb44a80-FRA
expires
Thu, 24 Jun 2021 13:39:39 GMT
how-to-identify-and-style-your-hair-type-1.webp
ncmhcso.org/img/health/
40 KB
41 KB
Image
General
Full URL
https://ncmhcso.org/img/health/how-to-identify-and-style-your-hair-type-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bee9b5df45533db9b11564b2edeb77fcb7aa91f086ca8c2ceb1e73b3ad4ff56a
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/how-to-identify-and-style-your-hair-type-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
41398
cf-request-id
0abfc9f59100004a800f884000000001
last-modified
Mon, 29 Mar 2021 12:21:32 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"a1b6-5beabec0a79ea"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=E3fVS8QViG%2BKTZSJj6s78C5zEPvFYdi5ZW0Mhapw21VRBy9Ax5OhoApTUPq2SHfgCeaMr%2BmRLdoqUBOnaj8EgqzX0saM3tmJkVG%2F1kPQeyK5Zyok8NLtGvvmcbPjbWBzi1ioLYA%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcb74a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
facts-to-know-about-osteoporosis.webp
ncmhcso.org/img/about-everything/
53 KB
54 KB
Image
General
Full URL
https://ncmhcso.org/img/about-everything/facts-to-know-about-osteoporosis.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
084c3ffb87ac836cfbea178e0b9a7496ad13ddc7102c6b2d6d2cc0c541a4fcd0
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/about-everything/facts-to-know-about-osteoporosis.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
54612
cf-request-id
0abfc9f59100004a80d3969000000001
last-modified
Thu, 01 Apr 2021 17:52:43 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"d554-5beece5f8627c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=c%2Bg2ebwuu29S6H74LsIDu7Wkz787F8ObVeqLatNHhea9G4yLL%2BWEoVdxsAGrH5gRe%2B4LFA68Miwgkf8bHUFTVOQEHJNsyDjjXXzG0eB4m7Tzh7rEr8LX1Y8xzTUqsW5eGj3ZgV0%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcba4a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
foods-good-for-your-kidneys.webp
ncmhcso.org/img/about-everything/
39 KB
39 KB
Image
General
Full URL
https://ncmhcso.org/img/about-everything/foods-good-for-your-kidneys.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8705434f588b28f46f84404752aed93c8c07749f28999cac226b8cc031bed100
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/about-everything/foods-good-for-your-kidneys.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
39658
cf-request-id
0abfc9f59100004a80f926a000000001
last-modified
Thu, 01 Apr 2021 17:52:45 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"9aea-5beece61168e9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=YTgVZjGxhKTs4Qn1PxvlLv%2BC2zLi5cY9rX3dxeROv1%2BJY%2BQWArx9NHWu0wQFgMpf5ak4NMuUxM3P9JXij7rOmZofRgwkPDqZNVYsG3OZ5np1eBVG0iWJO3GCISCjr%2BcIfszkC%2Fs%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcbc4a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
mengenal-akupresur-dan-manfaatnya-untuk-tubuh-anda-1.webp
ncmhcso.org/img/health-care/
35 KB
35 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/mengenal-akupresur-dan-manfaatnya-untuk-tubuh-anda-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
adedd54a65a2ced28df706dea11f8a13cf8aff484e2338b2ed94c6d06fd15051
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/mengenal-akupresur-dan-manfaatnya-untuk-tubuh-anda-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
35442
cf-request-id
0abfc9f59200004a80e0301000000001
last-modified
Mon, 29 Mar 2021 12:58:24 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"8a72-5beac6fe53bca"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bhBb29Ml4wnKdWCdRd2ALpblT6bdhzWXAlPaOdEIDhVIGo%2Bym%2BD4W7BnQuja8oalMlbq9Ohbs3c4GfBnjaNYZaoW4NmRM80itbQcWuHLqiZX6qi6UWGE%2FjxeeOrd8xUJwG5pC80%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcbe4a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
efek-samping-operasi-angkat-rahim-dan-cara-menanganinya-1.webp
ncmhcso.org/img/health-care/
35 KB
36 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/efek-samping-operasi-angkat-rahim-dan-cara-menanganinya-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
41a7157117502a4074fa3928da88baa0f854ce20204ad2cfe56d1ec7cb0d1516
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/efek-samping-operasi-angkat-rahim-dan-cara-menanganinya-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
35938
cf-request-id
0abfc9f59200004a80e7b2f000000001
last-modified
Mon, 29 Mar 2021 12:51:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"8c62-5beac56ba7b80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=M1334Ul7pWecwbWbtJA%2F0PkY%2BAywYJEALZOlBpsL6%2FTYc0BzaLkB6DlpqSzefeePwFzo%2BqZRQC10q1oEbgl%2FzZ3w1MndTnXMF%2ByICqHF%2BdK7G5I0B3tkpHE74cF65J2%2FeEavcn0%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcbf4a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
working-a-9-to-5-job-and-managing-your-psoriasis-tips-for-success-1.webp
ncmhcso.org/img/health/
47 KB
47 KB
Image
General
Full URL
https://ncmhcso.org/img/health/working-a-9-to-5-job-and-managing-your-psoriasis-tips-for-success-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9d8b1f9682086a46a9c2dd9c81e7fb1930b990b7b55c220045d143cf74c4d41
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/working-a-9-to-5-job-and-managing-your-psoriasis-tips-for-success-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
47710
cf-request-id
0abfc9f59300004a80be921000000001
last-modified
Mon, 29 Mar 2021 12:46:39 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"ba5e-5beac45e16dc8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Bli%2Fdo%2FkFwUqAFUNxj15nBxYW3Pj5XmrC8YQlPgD%2F5kR1sb0kBuZHl9%2F1JPcBo4OJH2PHvzRadGwEZxJwhQl9GtDCBbrVrkOD8J8dDZ%2Fb%2BX6taWaRZPMOW2is0gyf8BTVcuChmA%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcc34a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
f-en-sund-vskebalance.webp
ncmhcso.org/img/healths/
29 KB
29 KB
Image
General
Full URL
https://ncmhcso.org/img/healths/f-en-sund-vskebalance.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
42e63bc8fb7c61c18051e1fd20d3f65135c0ac491c3923c4d23463eb6c4196ab
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/f-en-sund-vskebalance.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
29482
cf-request-id
0abfc9f59900004a80ec9bf000000001
last-modified
Mon, 29 Mar 2021 13:11:21 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"732a-5beac9e31411b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=EAnV1vLn%2F965bHXJTqz%2FGkdsjXSyy6Gwg7kCtEQMZCcLCZAxQSz0vch8qE7a09NfyFIvBRyyfZuyOwndlUCDJ15Bp2YRlSJ3nY1KfSCxQ%2F2tPvPyq%2BBhz6ENmvwa7HdyMUICNOM%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcc54a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
popular-loofah-sponges-may-not-be-the-best-shower-accessory-heres-why.webp
ncmhcso.org/img/health/
33 KB
34 KB
Image
General
Full URL
https://ncmhcso.org/img/health/popular-loofah-sponges-may-not-be-the-best-shower-accessory-heres-why.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a47d09528b6740e7828e18f5470ea66ef6aa372da68ac0ae9d1f62e6b31cb295
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/popular-loofah-sponges-may-not-be-the-best-shower-accessory-heres-why.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
33742
cf-request-id
0abfc9f59300004a80c11ec000000001
last-modified
Mon, 29 Mar 2021 12:26:57 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"83ce-5beabff6cc5c7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=3ZU6YPc8uv49GmJkgG3wrpFvqHfC7eQVO%2B%2BCnLSJD%2Fi22rFxSCMDwNjCHMZpuyHA6x57uvNxQPZs%2BzEzMaUdjR%2F72KB5hxdBRP%2BUMQKq1MNRrsvbv7g61mVxvLfxOhU0vPWWnw4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcc84a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
targeted-treatment-for-advanced-breast-cancer-7-things-to-know.webp
ncmhcso.org/img/health/
36 KB
36 KB
Image
General
Full URL
https://ncmhcso.org/img/health/targeted-treatment-for-advanced-breast-cancer-7-things-to-know.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
895322ddf04461eb90de9cd679a2623c0b1338229177c8bc6371f0af9ca48099
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/targeted-treatment-for-advanced-breast-cancer-7-things-to-know.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
36480
cf-request-id
0abfc9f59900004a802387a000000001
last-modified
Mon, 29 Mar 2021 12:30:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"8e80-5beac0ba77971"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=4Nuh9h0lpaox4bpVaOGJOx0T3a9kwEy7khnwwz6pbX4r8MneJR1acdQImVpHyon7hog%2F8qTUduo51xtcH3cOMZkYzo5VltczPKxcegjCyJ7KtihZCyVxa%2BipxOe%2BBXs1HcdxqT4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfccb4a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
tactile-hallucinations.webp
ncmhcso.org/img/health/
39 KB
40 KB
Image
General
Full URL
https://ncmhcso.org/img/health/tactile-hallucinations.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fed9797c6cf467d34177d2661e16d74c396764883bcdafc50c9969fbe4f8b241
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/tactile-hallucinations.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
40038
cf-request-id
0abfc9f59400004a80f6298000000001
last-modified
Mon, 29 Mar 2021 12:30:18 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"9c66-5beac0b6e486a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lcsoSgRV0%2Fz55vUwdnkCni05AFkltCh0bvfA%2BZ7fMnvSDD5nMAfRxZ%2B9PM%2ByuVC5LZ7UoIM1p7IPAG7DBxaakaFHsdGrXksVhZ1kO%2Fu87KealDZrU7SCdkyIDSD%2BAfmq0fRar2Y%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfccc4a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
do-any-natural-treatments-for-headaches-work-2.webp
ncmhcso.org/img/healths/
51 KB
51 KB
Image
General
Full URL
https://ncmhcso.org/img/healths/do-any-natural-treatments-for-headaches-work-2.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
245a83b9565ae54ec44de7b48debafe08ff8884319ac1ca738923701703e0b85
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/do-any-natural-treatments-for-headaches-work-2.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
51866
cf-request-id
0abfc9f59500004a80f2992000000001
last-modified
Mon, 29 Mar 2021 13:10:43 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"ca9a-5beac9bee904b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=uo2%2FBG9ZEn734XQHuRvNHQhQRA6trGchbCF6%2B60Ki7RusAk8Eae%2FtPZNiidzToKBMPsVu0b6oHbgXgnuR44zrdYswn66%2Fwt4ni%2BLLkKX4rJ48n3E9yVryhUONEoFDuviDjzAnMM%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfccd4a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
rhesus-disease.webp
ncmhcso.org/img/healths/
26 KB
26 KB
Image
General
Full URL
https://ncmhcso.org/img/healths/rhesus-disease.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e285b95c09593f6e5c9ef91738ede73e7a026ff8eb683321aaab031c1cf94939
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/rhesus-disease.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6646
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
26344
cf-request-id
0abfc9f59600004a80ca8be000000001
last-modified
Mon, 29 Mar 2021 13:20:05 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"66e8-5beacbd69aae9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=3Ad6RKmmY2sfbdKXhR7jYwA2neJWja9s7M9soZ7lQ9cwGYj74V%2F0nZMRGaNyfczpX0UaOGaS%2FuHIhxPSIROMgrWCmout3DwqoynYwx4LKMD8BcVEfbSccPX%2BLu%2BdygzUCWp1I1s%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfccf4a80-FRA
expires
Fri, 25 Jun 2021 06:25:10 GMT
covid-19-and-crohns-your-guide-to-risks-and-recommendations-1.webp
ncmhcso.org/img/health/
35 KB
35 KB
Image
General
Full URL
https://ncmhcso.org/img/health/covid-19-and-crohns-your-guide-to-risks-and-recommendations-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
097cb55ac0307c25d1545a83582c26efb8a0081cfa56b46b16d41b74795cd590
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/covid-19-and-crohns-your-guide-to-risks-and-recommendations-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
35378
cf-request-id
0abfc9f59600004a80e8a38000000001
last-modified
Mon, 29 Mar 2021 12:09:32 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"8a32-5beabc12032f1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=GxcSj93hKfzCyfdInnoSjU6H%2FBxhVUdUk%2FhYjKw0ySMTILN1JVWnciRHZ%2Fni2hB4FM2GBvQplme1PSg6FextXCRend8SPzBOB1h1UYL8TwdOi9pQUGCjf3vYq%2FXz5lWIfTQ1OmY%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcd04a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
asupan-ini-penting-dikonsumsi-usai-melahirkan-lho-1.webp
ncmhcso.org/img/health-care/
34 KB
34 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/asupan-ini-penting-dikonsumsi-usai-melahirkan-lho-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
94ca88ba84d96801a5f13ad3aa207d4556782d77d275a82c6953e1acd771b868
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/asupan-ini-penting-dikonsumsi-usai-melahirkan-lho-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
34600
cf-request-id
0abfc9f59700004a80e7b30000000001
last-modified
Mon, 29 Mar 2021 12:49:13 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"8728-5beac4f0a6853"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=dgowZXT6pXl3%2F361mfVq7pefkncIyo0C78dHyfVqcCPOrK%2Bl%2Fn41TcN8%2FR%2BlGfhTAIkd4%2BGqHGzesYLNfrWjPWBF%2Bd6LS8hMrYzJYMK4cWkNHqTAmp3U8eCjxiAIGI0fYXXegJ4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcd54a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
everything-you-should-know-about-nausea.webp
ncmhcso.org/img/health/
42 KB
42 KB
Image
General
Full URL
https://ncmhcso.org/img/health/everything-you-should-know-about-nausea.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c51eca1adbb140a91c274a0fd9b205446c4adbc15741cdd0335bae69c31ef194
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/everything-you-should-know-about-nausea.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
42596
cf-request-id
0abfc9f59b00004a803603c000000001
last-modified
Mon, 29 Mar 2021 12:13:35 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"a664-5beabcfa09691"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=RAHmBQEbTc1HasE%2FGzagVi8NnGiw4zNvlOwshloIfVTq2wpnGUb8ScAx8QVmL%2FdtMAQqCzbBKdwBe9yyCKHseRUaRa44%2FA0NFvKYWmm37rPDWYWVJ%2FmS4kCi6BwNZowwY3Isuxg%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcdb4a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
tag.js
mc.yandex.ru/metrika/
218 KB
70 KB
Script
General
Full URL
https://mc.yandex.ru/metrika/tag.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
c6754c3241a18169afee078352f5e11c9c8eec97b9e2fb173f541ce2d07dd210
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
last-modified
Thu, 17 Jun 2021 09:26:05 GMT
etag
"60bf3bc8-114ef"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
content-length
70895
expires
Fri, 18 Jun 2021 09:15:56 GMT
why-are-my-muscles-itchy-and-how-do-i-treat-them.webp
ncmhcso.org/img/health/
22 KB
23 KB
Image
General
Full URL
https://ncmhcso.org/img/health/why-are-my-muscles-itchy-and-how-do-i-treat-them.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
801b9fd504871ed3dbc4fdf09891f075e172345dc9cfdea77e938aecce1d6267
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/why-are-my-muscles-itchy-and-how-do-i-treat-them.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
22928
cf-request-id
0abfc9f59700004a800f885000000001
last-modified
Mon, 29 Mar 2021 12:45:49 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"5990-5beac42e14750"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Y6XbMU8d8i4teW5ZHd6W5JoBtoXmoh8WvxnMYYELhPRYEkiqI4MbaGgeGg8C2IhRiRaRBqHShAfhFUsBAR8%2F1tfXcsAFgcbMOJSIBQsGweJRQa%2F2jpnu6oWeKaRZFhePsDnR%2FvA%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcde4a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
bunda-ini-tips-aman-merawat-kesehatan-kuku-dan-jari-bayi-1.webp
ncmhcso.org/img/health-care/
24 KB
25 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/bunda-ini-tips-aman-merawat-kesehatan-kuku-dan-jari-bayi-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f83b3380950504ef92c86cd293a94bcd4168734a16e4a0511e904e040e2698c
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/bunda-ini-tips-aman-merawat-kesehatan-kuku-dan-jari-bayi-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
24760
cf-request-id
0abfc9f59800004a80eb805000000001
last-modified
Mon, 29 Mar 2021 12:50:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"60b8-5beac532d17dc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=he855%2BO3E2ywT2s0qQxBMpLZH0HlkHkFXm1b1tk18TfSWX%2Bcl6J7veisYFVAanHjaBhsAFblpNjyfjuBpfpUkuQ215n98bVmnc4iCUSQKOmte9bJZebXA6xQGSpTahIxhJO5zcE%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfce04a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
anaphylaxis.webp
ncmhcso.org/img/healths/
29 KB
30 KB
Image
General
Full URL
https://ncmhcso.org/img/healths/anaphylaxis.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
01ca50b063b0ce958f45b7469c3cd70f734dfb115ab6c1940a6e9c9ba1ad0d7c
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/anaphylaxis.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2672
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
29602
cf-request-id
0abfc9f59e00004a80d396a000000001
last-modified
Mon, 29 Mar 2021 13:05:01 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"73a2-5beac878cc3be"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=sVaX%2B4T4TGCdJSkokrJDClPdr%2BmIhrIvRAkAB8ygC50OWTnr11Gbdri4elH4QI37Ukipd9SLG8OalSefun4xLuxt4zQCNFVUQGzB3GCNWynu1VQdcRkhNKnj3pSb6N7jZXbeHUc%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfce24a80-FRA
expires
Fri, 25 Jun 2021 07:31:24 GMT
exercises-for-pregnant-women.webp
ncmhcso.org/img/about-everything/
47 KB
48 KB
Image
General
Full URL
https://ncmhcso.org/img/about-everything/exercises-for-pregnant-women.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5c64aa5391ddf404691dbca4d6bca2ba97eea185f6dad6ad34501109b1991a8f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/about-everything/exercises-for-pregnant-women.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
93633
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
48372
cf-request-id
0abfc9f59800004a802b2dc000000001
last-modified
Thu, 01 Apr 2021 17:52:41 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"bcf4-5beece5e36355"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=qi%2BlCrPomWW0izIqMMlPofQVeIjZWjTicHNup4NkXLlULzwZDFNSTzQQ3PIe0WAZUZSNSp3sCoomSzYHmhwVCea7NBQd%2BsPDZQO%2BJ%2F0Zcjc%2FJO38KFEoc96Ws5brK5pikwI9%2FQw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfce44a80-FRA
expires
Thu, 24 Jun 2021 06:15:23 GMT
fish-oil-vs.-statins-what-keeps-cholesterol-down.webp
ncmhcso.org/img/health/
30 KB
31 KB
Image
General
Full URL
https://ncmhcso.org/img/health/fish-oil-vs.-statins-what-keeps-cholesterol-down.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
933acc052f712423ce964b9648e9d031889426baca88265d65a84482c48eff40
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/fish-oil-vs.-statins-what-keeps-cholesterol-down.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
30748
cf-request-id
0abfc9f59900004a80120cf000000001
last-modified
Mon, 29 Mar 2021 12:14:07 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"781c-5beabd1820c20"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=tq7Uf7z5tc22ib02N7PkdAAr2Bm%2FA%2FvciUNW8hR40wwypvA8eJZQLYV8jCKMDhUkAppIMdnQsq5dp0jsHnncwqQPR4zGKpzwFaBKFVgRLlU%2FOWeUD%2FECRne7S1WyJNCQB6BRiwk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfce74a80-FRA
expires
Fri, 25 Jun 2021 07:07:01 GMT
does-saliva-kill-sperm-if-youre-trying-to-get-pregnant-1.webp
ncmhcso.org/img/health/
32 KB
33 KB
Image
General
Full URL
https://ncmhcso.org/img/health/does-saliva-kill-sperm-if-youre-trying-to-get-pregnant-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cfb0125cd267872096f73d3252a8d8136c764a8f221e0c03be47675ee4b92d87
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/does-saliva-kill-sperm-if-youre-trying-to-get-pregnant-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
72643
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
33092
cf-request-id
0abfc9f59900004a80f6299000000001
last-modified
Mon, 29 Mar 2021 12:11:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"8144-5beabc70ae46c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HfH50HDEPxeVpAxWp50F7FzG9i0Rba%2FTGKig9iQmQTjtu7UCDTFuTtMGvSKeXw8%2BEpk06BJmkZyeMzyz01l1GVBnHWfESiAfn%2FrEcricLoY2%2BwF5aUrWYd%2B7CJVmiFuaYSG8hYs%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcea4a80-FRA
expires
Thu, 24 Jun 2021 12:05:13 GMT
9-resources-for-coping-with-coronavirus-anxiety-1.webp
ncmhcso.org/img/health/
43 KB
43 KB
Image
General
Full URL
https://ncmhcso.org/img/health/9-resources-for-coping-with-coronavirus-anxiety-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8d3e97c51668aa293da7ad2451f86fb288758f33961da09f8f89293894c39b0
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/9-resources-for-coping-with-coronavirus-anxiety-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
43732
cf-request-id
0abfc9f59a00004a801a3ae000000001
last-modified
Mon, 29 Mar 2021 12:01:28 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"aad4-5beaba44bca45"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=7F34fActF4wcVHCzDE1JqmTMUbrzTudqFX0js4ZmGUtCJgoQ11NBzvTxT%2FClDmqjsERYn1uTGaJ0krG0CiNPGv8RT1Ih%2BmtCVUq3GeDrjCIIdzL4Sk2nDguK5xYFqxX4DkvO2Ls%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcee4a80-FRA
expires
Fri, 25 Jun 2021 07:07:01 GMT
how-to-identify-and-treat-a-vitamin-e-deficiency.webp
ncmhcso.org/img/health/
68 KB
68 KB
Image
General
Full URL
https://ncmhcso.org/img/health/how-to-identify-and-treat-a-vitamin-e-deficiency.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b6828dcd79d5e4080a40bbaa202534607024537cfda9e006bd8a6bd3070eea32
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/how-to-identify-and-treat-a-vitamin-e-deficiency.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
69346
cf-request-id
0abfc9f59a00004a80c3a30000000001
last-modified
Mon, 29 Mar 2021 12:21:33 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"10ee2-5beabec1ac5e8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=WlMkWFRCFYVpTnjwSFnM82yV565wjRDt%2FpEZcTjPFCaKroqzUKRBrWCh%2BqG1GYHXFR1yNQ2ZBRVVCSV%2BqTpEe7k5nNPxORPn7p5aAZbfPfy1xZpo%2BES%2B4UrJ8oWsQ2b8bMQrYvg%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcf04a80-FRA
expires
Fri, 25 Jun 2021 07:07:01 GMT
10-physical-and-mental-benefits-of-basketball.webp
ncmhcso.org/img/health/
68 KB
69 KB
Image
General
Full URL
https://ncmhcso.org/img/health/10-physical-and-mental-benefits-of-basketball.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fac79d344dd7977a5a36a889b7edbbf425edf3d849ee295f6fdf7abef47bdaf8
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/10-physical-and-mental-benefits-of-basketball.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
70132
cf-request-id
0abfc9f59a00004a802f2ca000000001
last-modified
Mon, 29 Mar 2021 11:56:24 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"111f4-5beab922a7d4d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HgxuEauJ0oRT2q964P9L90hzR%2FXpZ8Re%2Fmy74pn3HmxVL0lACTtfgHwjjXhlW1pf6dKmuXuzPiG7W0QBoi5Dn6Q6Y2SCEdHlnsj7PCW%2FFyOnlhO7R%2FNG7SxnFekCbd0yHLFHfKk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcf44a80-FRA
expires
Fri, 25 Jun 2021 07:07:01 GMT
memahami-fungsi-sistem-saraf-pada-manusia-1.webp
ncmhcso.org/img/health-care/
24 KB
25 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/memahami-fungsi-sistem-saraf-pada-manusia-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fdc8bdecda1ab3aedaa5bb67da798f0fcdc20dca26b280dafc3da7006db0c90b
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/memahami-fungsi-sistem-saraf-pada-manusia-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
24606
cf-request-id
0abfc9f59d00004a80d21ac000000001
last-modified
Mon, 29 Mar 2021 12:57:57 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"601e-5beac6e4a7489"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=9DaY4RuJoLpJhse3jgaj%2BbSifxlvEgZOluOn8KwKUFOPji5twO2Rf5EtQl5%2FrQTnCduTRSIVea2NAVz2hXCR5C%2FCqjIQuYAfy01ttbpGGR4INhr8IX%2BtIamdO6cotVG%2FVMU4jX4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcf54a80-FRA
expires
Fri, 25 Jun 2021 07:07:01 GMT
ny-start-med-rygestop-5.webp
ncmhcso.org/img/healths/
82 KB
83 KB
Image
General
Full URL
https://ncmhcso.org/img/healths/ny-start-med-rygestop-5.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
26a5a8e9c29d59d397c641ab9923d92272fe2e0130f1e5b63e8f2ac4a17e9278
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/ny-start-med-rygestop-5.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
84386
cf-request-id
0abfc9f59b00004a8032b8d000000001
last-modified
Mon, 29 Mar 2021 13:18:39 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"149a2-5beacb853627f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=QPPW%2Fk3KJmn6PFypWsMfwajOb9A%2FB7egKUukU6FtpFkneZwe3J9TWEneaPTQjqkY3TwVOFpjJh0iDK%2BOA1PcQxY2TP%2Fkt6AqIq6kV3hS%2FbzzU5NcZzC3cs5GbiPSpPqi1yNe%2Fhw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcf74a80-FRA
expires
Fri, 25 Jun 2021 07:07:01 GMT
what-can-you-do-if-your-child-refuses-to-eat-anything-1.webp
ncmhcso.org/img/health/
42 KB
43 KB
Image
General
Full URL
https://ncmhcso.org/img/health/what-can-you-do-if-your-child-refuses-to-eat-anything-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56d33482c52294fd6906af2608a0c331809db4831160351c91054c53001a923c
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/what-can-you-do-if-your-child-refuses-to-eat-anything-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
43324
cf-request-id
0abfc9f59b00004a800f886000000001
last-modified
Mon, 29 Mar 2021 12:39:43 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"a93c-5beac2d1872bd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=M%2BnYXOIT678xMRwFOV7v0u%2BYw8EivIEbygCmTNURIzEXOS7U094HYJ1ZCdbDdRCVj6eqDG2iEkz6LjYqn6EVqpcqRP3GOEDskQG3LnoLd3bRPAfyW6vd53XegGyhf4j8EV3AgiI%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcf94a80-FRA
expires
Fri, 25 Jun 2021 07:07:01 GMT
how-to-pass-your-three-hour-glucose-test-1.webp
ncmhcso.org/img/health/
31 KB
32 KB
Image
General
Full URL
https://ncmhcso.org/img/health/how-to-pass-your-three-hour-glucose-test-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e2cd509924855071489aa3b65f460a2a2206dd104c4a9e6e6292420286c935f1
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/how-to-pass-your-three-hour-glucose-test-1.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
31724
cf-request-id
0abfc9f59b00004a80fb838000000001
last-modified
Mon, 29 Mar 2021 12:21:51 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"7bec-5beabed2ab13a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=gcACTP%2BTjrA8Aw1PqJU%2B6xU0iASrgR5lXG4DEbFvr9c1INhNmRRuXtgTQyFSYyzwnmlv1s05G7G4H3YZwO5J5vIIarvEfXkfDkf35JRqcO1OiTjFJukwQiY8M9vw7z2NqlVOTlo%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcfa4a80-FRA
expires
Fri, 25 Jun 2021 07:07:01 GMT
atrial-premature-complexes.webp
ncmhcso.org/img/health/
32 KB
33 KB
Image
General
Full URL
https://ncmhcso.org/img/health/atrial-premature-complexes.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9315547869e07ac733a6bce355b07e2afe531de40dc338cea1f3afb52f147fce
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/atrial-premature-complexes.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
32808
cf-request-id
0abfc9f59c00004a80eb806000000001
last-modified
Mon, 29 Mar 2021 12:06:35 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"8028-5beabb6966ca5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=nbPIpkFiMjTnBhIM7J%2BF8o%2FfynCP88avh7mPe0xLDjDJq%2FJ3P2bN%2BwPxSxiw8gTFF7wuPBMucuKbZSS6JpT6z0IxZeCwIfTF6HjMdAJ3sn5jhRmbud9i3DaAwPug%2Fklso2Jg89s%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcfb4a80-FRA
expires
Fri, 25 Jun 2021 07:07:01 GMT
5-ways-to-treat-dry-nose.webp
ncmhcso.org/img/health/
67 KB
68 KB
Image
General
Full URL
https://ncmhcso.org/img/health/5-ways-to-treat-dry-nose.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9bea616a0517194b82d3a49a36f05d82fbcd8fe5336f3a822a83abf6587b87be
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/5-ways-to-treat-dry-nose.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
68632
cf-request-id
0abfc9f59c00004a80120d0000000001
last-modified
Mon, 29 Mar 2021 11:59:36 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"10c18-5beab9da394cd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=oNP7EzqIMDpLO4eZwp1%2BkJ75N260iCszQEBINNguM9NUiu0p48tUof9gJxveQYuqRofEF8lhXNIvPZ2iXQWmXUj6oEcZilVdIBb1IRP6%2FAwY7IdtOgr1fdTlJJ5ouGB522Dkhpw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129bfcfd4a80-FRA
expires
Fri, 25 Jun 2021 07:07:01 GMT
nyrekrft-flere-fr-diagnosen-og-flere-overlever.webp
ncmhcso.org/img/healths/
36 KB
36 KB
Image
General
Full URL
https://ncmhcso.org/img/healths/nyrekrft-flere-fr-diagnosen-og-flere-overlever.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e88ec9e3c949c9efe4d81c17fb0210396b658c7a72c6a248211a26f65007946b
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/nyrekrft-flere-fr-diagnosen-og-flere-overlever.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
4135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
36682
cf-request-id
0abfc9f59e00004a80be923000000001
last-modified
Mon, 29 Mar 2021 13:18:40 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"8f4a-5beacb861d9ba"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=XH8Q%2ByT1rMx91IRwxsT3Rm7JQMkkTX%2FMh7EDZjKk2o3Baho%2BBuem5aOyb7RQSsRTdyCJordPZcNTwAzKlbobm9pfYSR9tIGTIYz0gyGmE%2FMfSDvVjw0iWi%2B89%2BMjQGuuH8S9UjM%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129c2cff4a80-FRA
expires
Fri, 25 Jun 2021 07:07:01 GMT
scripts.js
ncmhcso.org/template/rubik/js/
14 KB
4 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/scripts.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b7e17926b30342edecee8b3a93029ac51462e2b479277d8e077ba57173eb1900
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/scripts.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f55b00004a801e3a5000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3868-5beacd6e2e8a3-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=cnkpkiqbuGyBeI7U5JrQn%2FoAkp%2FwUca%2Fa1TLeXOpg%2Bb2BHFZqirV8Qubt6EmOi59StC2mDpOiSKFhe0Kmn%2BLmcNIKry6oqFQpw0CyjAypcZMvXjU4iFG65PlZDjVVFSEHtvhHPk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bcbae4a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
shortcode.js
ncmhcso.org/template/rubik/js/
2 KB
1 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/shortcode.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4433ff0f49844a27a31acc576d573f17fcff11480ff4c8abf0d17576dc4ffa17
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/shortcode.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f57a00004a8036038000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"625-5beacd6e384e4-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2FtVtDB%2FzSguf2gyKKBG2iAcG1qz%2Bw0bRCFzX6Qg8fqnw81DoffVIKXl4HTr1cJaY7oqorymPP7k3dzdSKN%2F5cM9v2MOlPanhvsIcoZqRvBBR80Y2menf%2BvMZgyLMC8Qoh%2BRlSRM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc374a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
widget.min.js
ncmhcso.org/template/rubik/js/
7 KB
3 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/widget.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
38a448e9e03a9f64e7611b19af4bb8ec97fde2c708dc57ebbc7701be7ae3af08
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/widget.min.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f57d00004a80be124000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1afc-5beacd6e48e86-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=V7MpdrZFqlNGzREIK4h4HtXiQO3xcRiQVApdIcDFD6aMWjrp%2BZR8%2BPGv%2Fs3iFKvxEPUrcuHaR22vRN%2FAsIbVNGjU9eN0Ctga4w9Yo1bI07uaCG2QnB%2F4OePSvMfjzuNy23qFTl4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc384a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
core.min.js
ncmhcso.org/template/rubik/js/
4 KB
2 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/core.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
936567bc744e199e02bfc3c33fe2bc9c862999e0d479e2a694aa7485460a3960
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/core.min.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f57b00004a80d21a8000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"fa0-5beacd6d1d183-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2FkJPT8WM1GZNXMlkogWm2kEvAyEM%2B2sf7uh%2F958fLu92jqDKEU%2FXXDlfPRFwqLhagFeBtSwTDcrbuToLP7kk514ccQKuhgmxS5yfeaV94j9DPxU02i5aAzWPUTjA5Ii9I%2BOx4tE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc3a4a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
tabs.min.js
ncmhcso.org/template/rubik/js/
12 KB
4 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/tabs.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
429f6b7a5802c15145bddd69b400dae34b814eebd42ea1a32934c9a55a159391
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/tabs.min.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f57b00004a80392c6000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"2f4e-5beacd6e4bd66-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=mVuCV1QhImh%2FRmWpab9CouAfHN0sOpeoqE0GHjfRm9sYFz3RLpeylbTtvK1VWsJSNZD1uG%2Bv3NSjD2k0F6zWMkUVnIHuJcPofxxoMy9Geo4ps8QTgXLi4hRJN5KUEvlgVH4hMN4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc3b4a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
accordion.min.js
ncmhcso.org/template/rubik/js/
8 KB
3 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/accordion.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bbde0ea9c50274448afdee811988867d3579169daff16b64bcb99ad1ee10905f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/accordion.min.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f57c00004a80fb832000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"2188-5beacd6d2db25-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=dSTrC1bfYP6JEofjbaLmUm1m3dcIzXrFAzeL4kPOB1u5LZDkLBHZqwonADphjYp76g8rSR5mkVmHVq3xuNd6o%2FbV%2B0WGeVvw%2BEzy4a0g6bqn0l4E8gAS%2Bzk9V8JaU1%2FnJqTlt4s%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc3e4a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
imagesloaded.min.js
ncmhcso.org/template/rubik/js/
8 KB
3 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/imagesloaded.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
854d677b850907cd851eac7e3f02f05a1e056f05bd5563199c5d93044ff16840
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/imagesloaded.min.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f57c00004a80dc9df000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1f3a-5beacd6da1e93-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bvbiMTkzmfe0isBN5Sjk%2FlTkUK32bw1wBQui8N5XGMpDSTz27Sl%2FRpKCYaYgLcu74pEACb86yCuiOSpd5oJig5eJExE0UMXh4b3KdsGZ5ORM7zKZA8ADM4hHpURGp8GbiCRZTgQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc424a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
masonry.min.js
ncmhcso.org/template/rubik/js/
28 KB
9 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/masonry.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3ca3e467b7d4d6b403aa4619019d9250b11449c8ee9c91c90bcbc9acdd64fea2
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/masonry.min.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f57e00004a80f6295000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"711a-5beacd6df7d9c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2BzlVWEUT0lc4KcvR3KV6Mb7tRr%2B7WIhgPE1HtNHzJpXcu9gio2xjCgdTUovoyey%2FTszSnCpIxRF9Yl1Dn0260G9wtBWFL5wJVeoaqTsxxEHiMi46hj9QogFRKAMD90htyYnZ4D8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc464a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
jquery.masonry.min.js
ncmhcso.org/template/rubik/js/
2 KB
1 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery.masonry.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c2e606e1fc82ea3a554aad5d0520e25d2677b89a891dc5c49e7ace08fce92e25
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery.masonry.min.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f57f00004a801e3ac000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"71b-5beacd6dd1c38-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=v4pDzWW%2BvxS%2B5TQ3vaoZIp7I6l8o7g%2FnkeuADsWYXXam447t9QPNapTVycRsh%2FLZ9JR%2BYx9c%2FGjbR5xHu5PHBL%2BaeY%2BO7hRYwna8xvOjkbrGlGxJYja%2BgPzdHPNGMvhI60r9Ey4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc4d4a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
cookie.min.js
ncmhcso.org/template/rubik/js/
2 KB
2 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/cookie.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfdbae14960ab90f96810eb628e6115a85d20927e6c487007b5c1dff13a4268c
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/cookie.min.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f57f00004a80eb803000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"866-5beacd6d2eac5-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HVYuI0bmUENzxXLJX5fqdDej%2BTGnQEAOROZ4r26bentUoO8xE4MmOBngGWp7s0UOTw%2BffhQC2oZBu%2Bj0FiZsOIQD4oTGNVFGiDQTXrNe1gXtWEJgPK4%2FVdrxo25zLUxbjh%2BFozc%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc4f4a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
jquery.flexslider.js
ncmhcso.org/template/rubik/js/
55 KB
12 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery.flexslider.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e7a1412730fc4c5b0f5722472d217ec2e106e0756fe6d97a37b0ea89db35960
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery.flexslider.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58000004a80f9266000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"dbfe-5beacd6db1894-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=OkaQYw6MqjeAhjC1seVdQoO7jaypo0isrgPT3GpgRv6jKTGZfbqNOfRU05iWSEk9sRLgZpyFuZVL0UlNOVYNxJ%2FO5M5xFuo9PqgzJ8EKQiQLwJdEx%2FdNLOSz3VcZzit94yHTBKE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc594a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
froogaloop2.min.js
ncmhcso.org/template/rubik/js/
2 KB
1 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/froogaloop2.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc46f44565a092c856a6d70471d942caca57598049a85ce80366c1c5831d0f3e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/froogaloop2.min.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58000004a80d02a8000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"6e9-5beacd6d943d1-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=gKatL0ZWyRryswZz7OQP9GhoxoRgbANv8WTbmlaZViI3Sz2%2BDZuPeJQAwXQo2WMo9ZBfep7kku9iUJnlsLtniUeabcFRCvkDaltLsNFZxhWb98%2Fz3h16HbAjaHVPMjfjauR82jQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc5b4a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
modernizr.custom.26633.js
ncmhcso.org/template/rubik/js/
9 KB
4 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/modernizr.custom.26633.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bc621afdf972c39066502aeed507c2cd0752f0cec9c932224fae97cc2a1d10a5
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/modernizr.custom.26633.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58500004a802f2c6000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"24e7-5beacd6df9cdd-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=sJebYgKN7FLVxuSCjOw5SVDH2Po4YPymtoZA9%2Bs0GzRxsKpfLhCGnD66GY78FrQ7Hw8XpN9TsyulbCnDUcEVdT2Eu51Jt47dwuMKpPecCdDit4uEUpaIM9MVVqq3L5O3pa3qtII%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc5e4a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
justifiedgallery.js
ncmhcso.org/template/rubik/js/
0
0
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/justifiedgallery.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/justifiedgallery.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
79
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58600004a800c0d8000000001
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bv8kI9cfuMrmGp943Gbku%2FtUCsSj5kZ2MBUMxEe5axKX4qlYLTFs572ow3ZuSBu2bc3ixdqhiMWX62NT0Jz3NMGv3%2Bv4tSyG%2FcIELuwxlUfMU3kSocN6AWj3D0ZiuYtc9qZ1cho%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc714a80-FRA
jquery.magnific-popup.min.js
ncmhcso.org/template/rubik/js/
20 KB
8 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery.magnific-popup.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ef35581d56516af9c0a792f09316bda2494a5f497edf5de30e6ab74052bc380
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery.magnific-popup.min.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58600004a80eb804000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"51d3-5beacd6e18140-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wFuuvBXE3JlV29RNw5z41LKe9e2BvIhhwge%2FHuQD%2F%2Fk%2B9GeJr4I%2BODhJ1V1obul418SwsCtI7Hwhp98jpSsQhGrBjucLh22NQ11bJiSD0KcptBwLrjhT905FZdd6qeHnocZZV%2BM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc754a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
jquery.fitvids.js
ncmhcso.org/template/rubik/js/
3 KB
2 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery.fitvids.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0d5f91a5430829df5638fa69b85a6e361876d5499744cc724d01c342d944a75
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery.fitvids.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58600004a8004119000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"cbe-5beacd6d7ad8e-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=dyLNxNygCSDoC%2Fk5gH2I4XK6xRVOlFIClEGm2Em5VAcBw5hCHybeaTiVPm62Jk6lw3UrkUiZ0ZHHd0rh7hrEk6VRzRkuUWTxaYpLMgQJgzwlf%2F0n4ORqQvBw3opQ6Bkc4oFmJq0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc794a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
jquery.fs.tipper.js
ncmhcso.org/template/rubik/js/
7 KB
2 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery.fs.tipper.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fb666fd52dd0d79bf7fffcacac8e560df56ed197509545f314269c7d44d4183
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery.fs.tipper.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58a00004a802c089000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1b0f-5beacd6d8a790-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=zJqN%2FjM%2BDJa510CMj6Rqsa%2Fg6JQtETsWduGG%2Bn2L7FxUlzLsnCMd0I1QW9NHyYAqpMDeNotQwcoS1lk0CRZ6%2FYlyKWG3T%2FyZTdweesWVXsU1GyjqsLPkkHiAWBVe0wuIM6Ym%2FUA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc7b4a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
slick.js
ncmhcso.org/template/rubik/js/
36 KB
9 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/slick.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e5baf1d366ed7dc7fce4e7dbca6245c0b7ef74e8d3a6cd6ae7641e725c5024e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/slick.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58700004a80211df000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"8ea5-5beacd6e50b87-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=hOZacxjF8XCJQops%2FGxACWkEOjWIzD3hfn6ztR2SDs5IJUaS9cjmODUelyoOU2gVa%2F0yRuJgidjSoOfjIBaLIXQfjSOS43uDBpd2FB7bMy4CIOprz%2Fp8dCUh%2B8GeQe2%2FjvWrjz0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc7d4a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
jquery-news-ticker.js
ncmhcso.org/template/rubik/js/
7 KB
3 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery-news-ticker.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab9df2bccffeb373df3ec6f8c10d1e229a7a05770637875f018673cc9318d3ac
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery-news-ticker.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58800004a80013c9000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1d36-5beacd6dd79f9-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2BF1fXk33hnc4VJCqCzOzNPeEoAH3IaX5Td3Uy1vt%2B2B9d77uZPsfGTbXecCXYkXxVPwf6rx0prW97VyOU%2BTv1bNEtij4t4KPwrtQRF7pVomkqcAjolWnMtRPn9Ivz9cC%2FTCAAy8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc804a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
onviewport.js
ncmhcso.org/template/rubik/js/
4 KB
2 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/onviewport.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8254c9521e087388e9bf4ffe934db413d93a10140e77e7931595fa191bd4aed7
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/onviewport.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58900004a8007399000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"ffe-5beacd6e190e0-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=L5TKfbexQ3vejnUmUmvTFKTctC2HcL9jF7YxmYFUmvZV8VaDWnTR1wjWbwBbTRr4Say0igyUMxisliGJQ2qOi%2B2KXtl2ywTrGI8A6u9jrcbz3mgC%2FbNrT7PIRovgHeiK1RWleW0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc834a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
module-load-post.js
ncmhcso.org/template/rubik/js/
72 KB
7 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/module-load-post.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7cc10d6b929d18973c7eda0205c914669edbd44cad3e656a5737d3dde64ad0f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/module-load-post.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58a00004a8023878000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"11f55-5beacd6e2e8a3-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=FRG54hDWsFl%2BMqIBl5%2FJ7RCwhlIIozJhGopuCON5f22XCchwl9hjeoUTR5x8lX1mkqfztsv%2FgKqcVsmhDTsyn%2BhA2IF90xIvHkP7yIca%2FvGiMaahNmvWO1l0vqE02B1U0Nzw1k0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc8a4a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
menu.js
ncmhcso.org/template/rubik/js/
3 KB
1 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/menu.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e6085301708c5091aa3bd00ca313d09f08a1ea02926745978796ce6b433b03ba
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/menu.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58b00004a802f2c7000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"a8b-5beacd6ded1bb-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=xU31Pes46HesvuX7Za7hlrqLw4E5U2xdv64Kn4NHJsPHW9BqaM7U1yP1tpl%2BPf4GGrQVxzY49p42USp6xvoMu6%2B5QTsn71vZIa15MZCBLtZxb%2FyWoiUmyiL7HE3%2BzF8GEMLEQXg%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc934a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
playlist.js
ncmhcso.org/template/rubik/js/
2 KB
1 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/playlist.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
09961140c12f8d7e4b768fe77f20560945ccf4b92be9ca816369d51f502af9cf
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/playlist.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58b00004a8038a7b000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"68e-5beacd6e20de1-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=tI82iUceDhh%2BJQ4DIVL6PYbOI50BN1d10UvQAgJnNiiJi%2BVYOWN7XezWqHIDYxxrACqUn35pGymTTaQ52Ryu9MHN9h0DAYhTyNv0Mgt53rTwP6xcg9lX618MWWhm1pJ04MgpmC4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc944a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
customjs.js
ncmhcso.org/template/rubik/js/
39 KB
7 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/customjs.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
83620fc89fc1d579db7168aab01b0b8ad43bc46590a2de59d7fda09e8564f9cf
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/customjs.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f59100004a80fb837000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"9d5b-5beacd6d972b1-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=6W%2BayD540R90tHog6q2%2BEjJyj7oVqFkFyDmFQuZq8tuwr0uAB7KE5tyQpBGfXRbSswHQ2VhKuWoIxPfGpKsKtwb8uEab4A1fR45GitPwoeDu8dJBVoT30hpsXCfGeJMuBdZRjFo%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc954a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
wp-embed.min.js
ncmhcso.org/template/rubik/js/
1 KB
1 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/wp-embed.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/wp-embed.min.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
125135
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58c00004a80ca8bb000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"57b-5beacd6e6b16a-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=JiJ2%2B%2BJQpb6dkI33o%2F9xibcbo6SBUOf8U9BAxCtqBSKnvDXAw9G4ztV59cEI2xiKiYWXkwttOts7kbKwGkqlrfJk20pbwT31KfiedDFvfO4yF7Cu3aFM0%2BrWjD3ueDuWcd9l9RU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129bfc984a80-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
cookieconsent.min.js
cdn.jsdelivr.net/npm/cookieconsent@3/build/
20 KB
7 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e55842a856a6d829feca3c3ad736c136b6c7549e9247274f78aa296259e06e24
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
5168
x-cache
HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f58000004e08c0013000000001
x-served-by
cache-fra19140-FRA
timing-allow-origin
*
server
cloudflare
etag
W/"50d5-nLraS9YXyGxjjPLr3exyStWWkHs"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
cf-ray
6613129c0e974e08-FRA
kmKiZrc3Hgbbcjq75U4uslyuy4kn0qviTgY3KcA.woff2
fonts.gstatic.com/s/librebaskerville/v9/
27 KB
27 KB
Font
General
Full URL
https://fonts.gstatic.com/s/librebaskerville/v9/kmKiZrc3Hgbbcjq75U4uslyuy4kn0qviTgY3KcA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Libre+Baskerville%3A400%2C700%2C400italic%7COpen+Sans%3A300%2C400%2C600%2C700%2C800%2C300italic%2C400italic%2C600italic%2C700italic%2C800italic%7CPT+Serif%3A400%2C700%2C400italic%2C700italic&ver=1549941966
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2ca57650e9d1881e382bd324039937317b18e44fd5fadab6d09018d426a2622a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://ncmhcso.org
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 06:24:42 GMT
x-content-type-options
nosniff
age
525074
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27932
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:02:29 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 06:24:42 GMT
EJRVQgYoZZY2vCFuvAFWzr8.woff2
fonts.gstatic.com/s/ptserif/v12/
32 KB
32 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ptserif/v12/EJRVQgYoZZY2vCFuvAFWzr8.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Libre+Baskerville%3A400%2C700%2C400italic%7COpen+Sans%3A300%2C400%2C600%2C700%2C800%2C300italic%2C400italic%2C600italic%2C700italic%2C800italic%7CPT+Serif%3A400%2C700%2C400italic%2C700italic&ver=1549941966
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ef391572f9fbb7bab7fef6ce2c4fc92ad68a8c148889a79cb9f9b1452d851fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://ncmhcso.org
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 12:13:20 GMT
x-content-type-options
nosniff
age
504156
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32960
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:06:03 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 12:13:20 GMT
EJRSQgYoZZY2vCFuvAnt66qSVys.woff2
fonts.gstatic.com/s/ptserif/v12/
29 KB
29 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ptserif/v12/EJRSQgYoZZY2vCFuvAnt66qSVys.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Libre+Baskerville%3A400%2C700%2C400italic%7COpen+Sans%3A300%2C400%2C600%2C700%2C800%2C300italic%2C400italic%2C600italic%2C700italic%2C800italic%7CPT+Serif%3A400%2C700%2C400italic%2C700italic&ver=1549941966
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e548abcd8734bfcf8b4ebbbca1af98f9e8ae1e0ff884c0971f29498a4fc108f4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://ncmhcso.org
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 05:05:29 GMT
x-content-type-options
nosniff
age
529827
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29400
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:05:20 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 05:05:29 GMT
can-i-drink-alcohol-while-taking-wellbutrin.webp
ncmhcso.org/img/health/
25 KB
26 KB
Image
General
Full URL
https://ncmhcso.org/img/health/can-i-drink-alcohol-while-taking-wellbutrin.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e62d60477b5e0d08d646f6d2ddfceccd5c42390f2eb952a64c3d4c7e3d45eb0
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/can-i-drink-alcohol-while-taking-wellbutrin.webp
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
27828
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
25936
cf-request-id
0abfc9f5a600004a80392cb000000001
last-modified
Mon, 29 Mar 2021 12:08:06 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"6550-5beabbc044c62"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=qAKj4%2BcR7y679sDVdOOP7vrjWXy1z865JUdZEs9MTZfODN5k%2Bke07ydn9tw5%2BTyIWkgoIAOFpgkuWT1oeyQQIqChLggDNL%2Fowb6wAKdI4qZJymyGuATlmLCEjAIQMlMTMhu1qzs%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129c2d284a80-FRA
expires
Fri, 25 Jun 2021 00:32:08 GMT
fontawesome-webfont.woff2
ncmhcso.org/template/rubik/css/
75 KB
76 KB
Font
General
Full URL
https://ncmhcso.org/template/rubik/css/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/template/rubik/css/font-awesome.min.css?ver=5.0.6
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
origin
https://ncmhcso.org
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
font
cookie
__oagr=true
:path
/template/rubik/css/fontawesome-webfont.woff2?v=4.7.0
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
ncmhcso.org
referer
https://ncmhcso.org/template/rubik/css/font-awesome.min.css?ver=5.0.6
:scheme
https
sec-fetch-site
same-origin
:method
GET
Origin
https://ncmhcso.org
Referer
https://ncmhcso.org/template/rubik/css/font-awesome.min.css?ver=5.0.6
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:56 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
117493
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
77160
cf-request-id
0abfc9f5a600004a80148b7000000001
last-modified
Mon, 29 Mar 2021 13:27:06 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"12d68-5beacd689eabe"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HWDl9GsZy%2FlpL2es5XKw7%2B0xoZtjIQ49MbSfPJt%2F1sw4vTxwLm2ryY0RqXAxYuuZ447AgU%2BFwvzCmeoHFceA4klwY%2BMvCCnJcu5hKlCJ%2FAJXze0Tevni0TnsCRWMqD4uYrO%2Fkms%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
6613129c2d2b4a80-FRA
expires
Wed, 23 Jun 2021 23:37:43 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20210616/r20190131/ Frame 0155
10 KB
5 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20210616/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20210616/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 19:02:37 GMT
expires
Thu, 01 Jul 2021 19:02:37 GMT
content-type
text/html; charset=UTF-8
etag
15579341980913220427
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4579
x-xss-protection
0
age
47600
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
1788
na.nawpush.com/tags/
241 B
363 B
XHR
General
Full URL
https://na.nawpush.com/tags/1788
Requested by
Host: cst.cstwpush.com
URL: https://cst.cstwpush.com/static/adManager.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.25 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
850ebe5afa86a299ed655f0dd371f0bb4c80e38b73d855edf5139c3475f0d7f0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 18 Jun 2021 08:15:57 GMT
cache-control
max-age=300, public
content-type
text/plain; charset=utf-8
server
nginx/1.18.0
content-encoding
gzip
x-proxy-cache
HIT
/
stat.optad360.mgr.consensu.org/
20 B
286 B
XHR
General
Full URL
https://stat.optad360.mgr.consensu.org/
Requested by
Host: get.optad360.io
URL: https://get.optad360.io/sf/0cb56948-cae8-47f8-b292-fbe3862a81d2/plugin.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
18.196.233.38 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-196-233-38.eu-central-1.compute.amazonaws.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
8e721fdaed85657fea7e22eff33717764bbdd7249181ed3184a6eb3215f14d15

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 18 Jun 2021 08:15:57 GMT
Content-Encoding
gzip
Server
nginx/1.14.0 (Ubuntu)
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
gpt.js
securepubads.g.doubleclick.net/tag/js/
62 KB
21 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: get.optad360.io
URL: https://get.optad360.io/sf/0cb56948-cae8-47f8-b292-fbe3862a81d2/plugin.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
sffe /
Resource Hash
92f37bb02bae4c1d3b4538e432614ae81f4eb82746255b10592885cd6591fa52
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"905 / 60 of 1000 / last-modified: 1623971959"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21462
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:15:57 GMT
prebid4.10.1.js
get.optad360.io/sf/
380 KB
381 KB
Script
General
Full URL
https://get.optad360.io/sf/prebid4.10.1.js
Requested by
Host: get.optad360.io
URL: https://get.optad360.io/sf/0cb56948-cae8-47f8-b292-fbe3862a81d2/plugin.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206e:3a00:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b961bb522a21c8710fa523ee1b97d3ae8880606088e221a08525621d54b014ca

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 21 Feb 2021 04:57:05 GMT
via
1.1 7c17b3af9cda4d5f0ff45961b7be9fdc.cloudfront.net (CloudFront)
last-modified
Tue, 20 Oct 2020 11:44:25 GMT
server
AmazonS3
age
10120733
etag
"8b3682ab6cf8d8156745869486e3291e"
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
public, max-age=31556926
x-amz-cf-pop
VIE50-C1
accept-ranges
bytes
content-length
389196
x-amz-cf-id
TjQjkNnkryGMK1VttLQDsy-8-bMFF_0rOfnrOVxLqFJTbTpTfSa2xQ==
1.jpg
allthebestsofts.com/rubik-times/wp-content/uploads/2018/06/
52 KB
53 KB
Image
General
Full URL
https://allthebestsofts.com/rubik-times/wp-content/uploads/2018/06/1.jpg
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.121.248 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium68-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
7733e901ce4639c446a06c89071cca31e57b494ca45e1b25ef1c523caf6e4083

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:57 GMT
last-modified
Mon, 14 Jan 2019 04:29:04 GMT
server
LiteSpeed
content-type
image/jpeg
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
53756
expires
Fri, 25 Jun 2021 08:15:57 GMT
sync_cookie_image_decide
mc.yandex.com/
Redirect Chain
  • https://mc.yandex.com/sync_cookie_image_check
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9308.c9VWNxU_8jnFfUeB9ZDQkqLptXuF2UG8qpscmunB9yDn7SA3bW0JVyp7c5ZD0wzp.pvy75vCegxafuUcLN2CSr-ndAB4%2C
  • https://mc.yandex.com/sync_cookie_image_decide?token=9308.EehRMYuS1cxGUjujJxZij_6o3OEuUVSper2DBITr9zGLGOPjEoHOgBVGQQebsuY5PiUbrVQWb0EeiTUszshplg%2C%2C.n7rIJha9Uxq8IgrvpJLe0jQCi20%2C
75 B
75 B
Image
General
Full URL
https://mc.yandex.com/sync_cookie_image_decide?token=9308.EehRMYuS1cxGUjujJxZij_6o3OEuUVSper2DBITr9zGLGOPjEoHOgBVGQQebsuY5PiUbrVQWb0EeiTUszshplg%2C%2C.n7rIJha9Uxq8IgrvpJLe0jQCi20%2C
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:57 GMT
strict-transport-security
max-age=31536000
content-length
75
x-xss-protection
1; mode=block
content-type
text/html; charset=utf-8

Redirect headers

location
https://mc.yandex.com/sync_cookie_image_decide?token=9308.EehRMYuS1cxGUjujJxZij_6o3OEuUVSper2DBITr9zGLGOPjEoHOgBVGQQebsuY5PiUbrVQWb0EeiTUszshplg%2C%2C.n7rIJha9Uxq8IgrvpJLe0jQCi20%2C
date
Fri, 18 Jun 2021 08:15:57 GMT
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
justifiedgallery.js
ncmhcso.org/template/rubik/js/
0
0
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/justifiedgallery.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:233f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/justifiedgallery.js
pragma
no-cache
cookie
__oagr=true; _ym_uid=1624004157775488931; _ym_d=1624004157
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:57 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
80
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f7b600004a80f62cd000000001
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lS70MD2VguPps7qbSz%2FtnmJlYioBvXIBjHcJYyC2bIPDrYpWduN7cmkWDDyVI6H6xrcvuYhWf4a87DvwzByQU2ppkWe%2B3Zp%2BP8iyYhddE4RqNK2jTwKKwRHZcV9pK0gLkbZsz1g%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
6613129f8d434a80-FRA
abs.js
cdn.zx-adnet.com/adx/
200 B
254 B
Script
General
Full URL
https://cdn.zx-adnet.com/adx/abs.js?
Requested by
Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/adx/smrcp_19121001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
9be45d830a633e050edaa82361e4ecac3cc189b3a3975a41aa01ae3cb4e4120b
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1624004157.371750,VS0,VE203
etag
"437b8edcf8ac42ac5e7961966dea7cee69a38a82519efa00f6f37a753caad24c-br"
x-served-by
cache-cdg20746-CDG
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600,public
date
Fri, 18 Jun 2021 08:15:57 GMT
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive
content-length
118
x-cache-hits
0
advert.gif
mc.yandex.com/metrika/
43 B
136 B
Image
General
Full URL
https://mc.yandex.com/metrika/advert.gif
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:57 GMT
last-modified
Thu, 17 Jun 2021 09:26:05 GMT
etag
"60bf3bc8-2b"
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
content-length
43
expires
Fri, 18 Jun 2021 09:15:57 GMT
csub.js
js.wpushsdk.com/npc/sdk/wpu/
6 KB
3 KB
Script
General
Full URL
https://js.wpushsdk.com/npc/sdk/wpu/csub.js
Requested by
Host: cst.cstwpush.com
URL: https://cst.cstwpush.com/static/adManager.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.25 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.16.1 / PHP/7.1.28
Resource Hash
240f2fa6d9c547702519223d888610d5517255aa52ad0c04d86f0ec6d0ab76d6

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:57 GMT
content-encoding
gzip
server
nginx/1.16.1
x-powered-by
PHP/7.1.28
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Fri, 18 Jun 2021 09:15:57 GMT
cache-control
max-age=3600
x-proxy-cache
HIT
pubads_impl_2021061503.js
securepubads.g.doubleclick.net/gpt/
325 KB
114 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
sffe /
Resource Hash
408abc3a5bedff37056ecb1ba4872225de8a269ffe9aa04fd8fd38a7e7ec5116
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 15 Jun 2021 21:10:23 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
116743
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:15:57 GMT
checkabuse
cdn.zx-adnet.com/
70 B
374 B
Script
General
Full URL
https://cdn.zx-adnet.com/checkabuse?surl=https://ncmhcso.org/
Requested by
Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/adx/abs.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash
cc7cc67c9a20cdb365cee019afd88e150a17a99f8984fe2ab6be0aa10e031ebd

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:57 GMT
content-encoding
gzip
x-powered-by
Express
x-cache
MISS
content-length
81
x-served-by
cache-cdg20746-CDG
server
Google Frontend
x-timer
S1624004158.738451,VS0,VE160
etag
W/"46-EvbgeHJd39XoipOEZOe1/kP8fRE"
vary
cookie,need-authorization, x-fh-requested-host, accept-encoding
content-type
text/html; charset=utf-8
x-cloud-trace-context
dd44a928b372153ac6beee10f1c44291
cache-control
max-age=3600,public
function-execution-id
dvjm60m028lf
accept-ranges
bytes
x-orig-accept-language
en-US
x-country-code
RO
x-cache-hits
0
latest.json
cdn.jsdelivr.net/gh/prebid/currency-file@1/
2 KB
1 KB
XHR
General
Full URL
https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20210618
Requested by
Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid4.10.1.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49894b52d15fdca5393109cc22008f85b6eaba81d87686597e602a466932f71a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 18 Jun 2021 08:15:57 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
18859
x-cache
HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfc9f94900006395adaa2000000001
x-served-by
cache-fra19151-FRA
timing-allow-origin
*
server
cloudflare
etag
W/"699-4F08GFbexTqglNeGGXgoiYOTyXk"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
cf-ray
661312a20e336395-FRA
1
mc.yandex.com/watch/68669068/
Redirect Chain
  • https://mc.yandex.com/watch/68669068?wmode=7&page-url=https%3A%2F%2Fncmhcso.org%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Alvg2sn1re62lx62l%3Afp%3A306%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-U...
  • https://mc.yandex.com/watch/68669068/1?wmode=7&page-url=https%3A%2F%2Fncmhcso.org%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Alvg2sn1re62lx62l%3Afp%3A306%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen...
184 B
266 B
XHR
General
Full URL
https://mc.yandex.com/watch/68669068/1?wmode=7&page-url=https%3A%2F%2Fncmhcso.org%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Alvg2sn1re62lx62l%3Afp%3A306%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A562%3Acn%3A1%3Adp%3A0%3Als%3A596760834038%3Ahid%3A422011575%3Az%3A120%3Ai%3A202106180101557%3Aet%3A1624004157%3Ac%3A1%3Arn%3A649063888%3Au%3A1624004157775488931%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1624004156526%3Ads%3A0%2C17%2C47%2C4%2C60%2C0%2C%2C%2C%2C%2C%2C%2C%3Adsn%3A0%2C18%2C47%2C3%2C60%2C0%2C%2C%2C%2C%2C%2C%2C%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1624004158%3At%3AMedizinische%20Informationen%2C%20Die%20Sie%20Vertrauen%20K%C3%B6nnen%20-%20ncmhcso
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
5d7cc259e704335896d08543304ae31eeaf36f735cdf5e0767d4a4e78e62e0ec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:57 GMT
x-content-type-options
nosniff
last-modified
Fri, 18-Jun-2021 08:15:57 GMT
strict-transport-security
max-age=31536000
content-type
application/json; charset=utf-8
access-control-allow-origin
https://ncmhcso.org
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
184
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:15:57 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:57 GMT
last-modified
Fri, 18-Jun-2021 08:15:57 GMT
location
/watch/68669068/1?wmode=7&page-url=https%3A%2F%2Fncmhcso.org%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Alvg2sn1re62lx62l%3Afp%3A306%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A562%3Acn%3A1%3Adp%3A0%3Als%3A596760834038%3Ahid%3A422011575%3Az%3A120%3Ai%3A202106180101557%3Aet%3A1624004157%3Ac%3A1%3Arn%3A649063888%3Au%3A1624004157775488931%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1624004156526%3Ads%3A0%2C17%2C47%2C4%2C60%2C0%2C%2C%2C%2C%2C%2C%2C%3Adsn%3A0%2C18%2C47%2C3%2C60%2C0%2C%2C%2C%2C%2C%2C%2C%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1624004158%3At%3AMedizinische%20Informationen%2C%20Die%20Sie%20Vertrauen%20K%C3%B6nnen%20-%20ncmhcso
strict-transport-security
max-age=31536000
access-control-allow-origin
https://ncmhcso.org
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:15:57 GMT
integrator.js
adservice.google.fr/adsid/
107 B
853 B
Script
General
Full URL
https://adservice.google.fr/adsid/integrator.js?domain=ncmhcso.org
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:15:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
107 B
570 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=ncmhcso.org
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:15:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/
48 KB
23 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=425230823421772&correlator=1016820112607953&output=ldjh&impl=fif&eid=31061019%2C31061278%2C31061290%2C31061463%2C31061475%2C44740386&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=121764058%2Cncmhcso.org_SF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C750x100%7C970x90&cookie_enabled=1&bc=31&abxe=1&lmt=1624004157&dt=1624004157882&dlt=1624004156654&idt=1203&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1200&adks=747879360&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1&msz=728x-1&ga_vid=1278456423.1624004158&ga_sid=1624004158&ga_hid=49947777&ga_fc=false&fws=640&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
239028d83453a0539d6ebf5af82bd089b9de53a498381195e8ce692c614456fa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:58 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23666
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/safeframe/1-0-38/html/
0
0
Other
General
Full URL
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

container.html
cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame AA5C
6 KB
3 KB
Document
General
Full URL
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-38/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
3108
date
Fri, 18 Jun 2021 08:15:57 GMT
expires
Sat, 18 Jun 2022 08:15:57 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
osd.js
www.googletagservices.com/activeview/js/current/
73 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e3d2fb5e2edecc03632d4232f8956dfc6cea25557cdd082cab892d00f2769bc4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:58 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842926269324"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28241
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:15:58 GMT
pixel
googleads.g.doubleclick.net/xbbe/ Frame 9FA2
624 B
300 B
Document
General
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CKrcqwIQu4SQjgIY4ZC4pQEwAQ&v=APEucNV7rYtWj_shoEW05mvkTZ--zQZfBmcMceiyABQAHHEHU612EVAEB32BK6FhJmbJYatzQ4n69IVrqSa3ASwg5UjOP7y637QN4c1Atm5ZvlDnHrPSj-2nbrskbkZDfu6VZCLjG0IQ64XVbw1ILS-0R790hbnnMFr6cdKmA9SaF6P_o_b9qLmXfxesOmRhvR05OIL6dZ1z4UXjd5q4jnrdeiZp5XkAvA
Requested by
Host: cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
URL: https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/xbbe/pixel?d=CKrcqwIQu4SQjgIY4ZC4pQEwAQ&v=APEucNV7rYtWj_shoEW05mvkTZ--zQZfBmcMceiyABQAHHEHU612EVAEB32BK6FhJmbJYatzQ4n69IVrqSa3ASwg5UjOP7y637QN4c1Atm5ZvlDnHrPSj-2nbrskbkZDfu6VZCLjG0IQ64XVbw1ILS-0R790hbnnMFr6cdKmA9SaF6P_o_b9qLmXfxesOmRhvR05OIL6dZ1z4UXjd5q4jnrdeiZp5XkAvA
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Fri, 18 Jun 2021 08:15:58 GMT
server
cafe
cache-control
private
content-length
276
x-xss-protection
0
set-cookie
test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUnCub_SAQVEMRTYsKgCAP7SteA6E4N-a_M02qKP-ePkiCNRuT0FPBxmuYlG; expires=Wed, 13-Jul-2022 08:15:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Fri, 18 Jun 2021 08:15:58 GMT
abg_lite_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame AA5C
17 KB
7 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 07:52:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1403
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 07:52:35 GMT
omrhp_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20210616/r20110914/elements/html/ Frame AA5C
6 KB
3 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20210616/r20110914/elements/html/omrhp_fy2019.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0dc4093b6b9286ebfc6c728ddd3a70812a726d79d6f41d60a506fd5b93c4929c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:08:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
475
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2661
x-xss-protection
0
server
cafe
etag
7752240862628680351
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:08:03 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame AA5C
0
107 B
Ping
General
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvZQGo5HSnsVSwWI_HY7phLF5S16xc9wD0U0K04d3_DdwcjsD41f6q35DytzyBOzFAejwGsCU4hwkgEjzzPkikuREBFjjrnw2FWkw0O2rK08_T2dxl9z0NUkNmunyBThuQMwTRQKFIbDZGkm3u8SqyULst4Ok35rWnXL4PxHyO7vQwjBiT-0qSBAQHtENHuNcoONdAqRMKbrf2ZDxEtUVVgvpQyM0Y9H74zIsutR55niYYCB6ctHtrPZgtIgCvZZgtgrVQCcYfeHQVHHYWaIwMdHd_3f-HG7Qpq1-VB_skF36PEk9YrxfNpqdBvKRcDwsD2Ae3_L75w2IeUl4x-U_1LZpRBLs5ijARDClk037h-hWh4xIWgP4lv3lckdnf0wAYsuf7Hd0JCz90NfCxWEOnpd57xVBae6e0uQnba1yH-QV0XwGxJj4_bhQUJkxWJmLA-DFdEd3kDJ-wToYakF6y-FZaCE5M4h8BIY-Kc_lLPcvNKShaKXTBue0jxHs61ZsIW5LL_ENQ_6CoBUQ8qCKKICOhIb4khUGH1yTwgnTgGnUg0oZmz8i_Hzx9pl8iEWKbXulyUaL6s0l5hW8m2u73b1bVCpjte7gMeqyi-ha2Qbev21MzkjZctKmspUPCRrzNIIhFBrnD24TBZYpU7KEw3wQaV81W0H6wzKE_IjnoujKDYpmojUVXwX4Cqcnu5NDOyBUrx6VUlHzaVNWbdcIO7fpyU3goHhtTBElpC7YGFsAxb1140_OmP5SL4EH-YwNZpjfuovNadCTOJoynhmFJnThTCsL_RUU9FMYjyHRM1Oo5UXTLRSDhl23TqrCMYMYFDL8lsYK0K7LZlsrMqAkTC-qTS2CsrsBD7EFKraKeTTRjnyLVSiWacYyjzVJWpRGQsdSz2nHT-o7hZX38ZEqvr-dtqMUL4Gm7_FkgUOMh4x6w87CaRzyw1WhFBvWqFq0HZAH-2rCz9yLKsW4QN0G9LrH2sqtEHP1irReVEddSoQjvQmu6CHP4AyLmjFYdUVaaYsRsKyJL9VaqNz9xEb7sAxPMtXI2oggOKskkID6LDPXmenXKBxpr_ArxWHDDDO5s5QSqovIEfMpy9VS43QgtoaR-sr8nPwOAug_SUVZLLFrvBDjCzloFm7-F7RdCq40acq7hJ&sai=AMfl-YRsIoWrxX_x8wp30DopcXnHUJokSC9W12EShEmwAkNBxvYZHOVyvsWcw3ThhAY_qM_IjNOXF77rb_44HFMkcSRN3el9AsD3JUFjy1kTaF3W1Ozh-tzAqf5FXGCqm1NH0weZLFjPDvoFDPlgVpEXo4QLTYkkVdSIJ6QeGWeUHme-kBsYUV3F3qgbUQx3zMYxgNLhjiECkGYmVDiECU2VBxtlY-4lT1ahpISVUNwbN7PDPWr-4_2Mysb8tb6aACsUfia3pskzCXoCsY9Tt8gm7PsLshMno1DNbaNDZLUzm1aDSQxkd8O5JhJ2ZDLmPxqC05Jj9OgO28yrEpQ7Pz1xy1AculwXEyMiOBk4882kwtK7Ki6mHlMc8V04kAynMyLyxw&sig=Cg0ArKJSzLCCodpxnvHnEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210616.81764&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s45-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date
Fri, 18 Jun 2021 08:15:58 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame AA5C
41 KB
15 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 17:39:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
52617
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 17 Jun 2022 17:39:01 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame AA5C
42 B
63 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D0s7aUqUEwKOlDtEzMp5eq8nxyfVO0BuU7SXTMpcu6y1cSkfVdEKwJSkKuWNp46PDlA0vfeu1WaQ8Jm-vENk2HJCxxXRrgrwU3rpGghuZBEj8lddk
Requested by
Host: cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
URL: https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:58 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame AA5C
3 KB
2 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
URL: https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
115
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:03 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame AA5C
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
URL: https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:58 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:15:58 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame AA5C
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
URL: https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:11:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
277
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:11:21 GMT
4283290865978041780
s0.2mdn.net/simgad/ Frame AA5C
41 KB
42 KB
Image
General
Full URL
https://s0.2mdn.net/simgad/4283290865978041780
Requested by
Host: cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
URL: https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a32f044efea4645c07446e220297106cd3ff3bda357e599a0238ac8dceccb4e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 13:49:49 GMT
x-content-type-options
nosniff
age
498369
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42103
x-xss-protection
0
last-modified
Thu, 22 Apr 2021 08:09:06 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 13:49:49 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame AA5C
0
545 B
Ping
General
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvZQGo5HSnsVSwWI_HY7phLF5S16xc9wD0U0K04d3_DdwcjsD41f6q35DytzyBOzFAejwGsCU4hwkgEjzzPkikuREBFjjrnw2FWkw0O2rK08_T2dxl9z0NUkNmunyBThuQMwTRQKFIbDZGkm3u8SqyULst4Ok35rWnXL4PxHyO7vQwjBiT-0qSBAQHtENHuNcoONdAqRMKbrf2ZDxEtUVVgvpQyM0Y9H74zIsutR55niYYCB6ctHtrPZgtIgCvZZgtgrVQCcYfeHQVHHYWaIwMdHd_3f-HG7Qpq1-VB_skF36PEk9YrxfNpqdBvKRcDwsD2Ae3_L75w2IeUl4x-U_1LZpRBLs5ijARDClk037h-hWh4xIWgP4lv3lckdnf0wAYsuf7Hd0JCz90NfCxWEOnpd57xVBae6e0uQnba1yH-QV0XwGxJj4_bhQUJkxWJmLA-DFdEd3kDJ-wToYakF6y-FZaCE5M4h8BIY-Kc_lLPcvNKShaKXTBue0jxHs61ZsIW5LL_ENQ_6CoBUQ8qCKKICOhIb4khUGH1yTwgnTgGnUg0oZmz8i_Hzx9pl8iEWKbXulyUaL6s0l5hW8m2u73b1bVCpjte7gMeqyi-ha2Qbev21MzkjZctKmspUPCRrzNIIhFBrnD24TBZYpU7KEw3wQaV81W0H6wzKE_IjnoujKDYpmojUVXwX4Cqcnu5NDOyBUrx6VUlHzaVNWbdcIO7fpyU3goHhtTBElpC7YGFsAxb1140_OmP5SL4EH-YwNZpjfuovNadCTOJoynhmFJnThTCsL_RUU9FMYjyHRM1Oo5UXTLRSDhl23TqrCMYMYFDL8lsYK0K7LZlsrMqAkTC-qTS2CsrsBD7EFKraKeTTRjnyLVSiWacYyjzVJWpRGQsdSz2nHT-o7hZX38ZEqvr-dtqMUL4Gm7_FkgUOMh4x6w87CaRzyw1WhFBvWqFq0HZAH-2rCz9yLKsW4QN0G9LrH2sqtEHP1irReVEddSoQjvQmu6CHP4AyLmjFYdUVaaYsRsKyJL9VaqNz9xEb7sAxPMtXI2oggOKskkID6LDPXmenXKBxpr_ArxWHDDDO5s5QSqovIEfMpy9VS43QgtoaR-sr8nPwOAug_SUVZLLFrvBDjCzloFm7-F7RdCq40acq7hJ&sai=AMfl-YRsIoWrxX_x8wp30DopcXnHUJokSC9W12EShEmwAkNBxvYZHOVyvsWcw3ThhAY_qM_IjNOXF77rb_44HFMkcSRN3el9AsD3JUFjy1kTaF3W1Ozh-tzAqf5FXGCqm1NH0weZLFjPDvoFDPlgVpEXo4QLTYkkVdSIJ6QeGWeUHme-kBsYUV3F3qgbUQx3zMYxgNLhjiECkGYmVDiECU2VBxtlY-4lT1ahpISVUNwbN7PDPWr-4_2Mysb8tb6aACsUfia3pskzCXoCsY9Tt8gm7PsLshMno1DNbaNDZLUzm1aDSQxkd8O5JhJ2ZDLmPxqC05Jj9OgO28yrEpQ7Pz1xy1AculwXEyMiOBk4882kwtK7Ki6mHlMc8V04kAynMyLyxw&sig=Cg0ArKJSzLCCodpxnvHnEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=60&vt=11&dtpt=59&dett=2&cstd=0&cisv=r20210616.81764&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s45-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:15:58 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame E37F
22 KB
8 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/Enqz_20U.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
8395
date
Fri, 18 Jun 2021 06:29:05 GMT
expires
Sat, 18 Jun 2022 06:29:05 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
6413
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
rum
dsum-sec.casalemedia.com/ Frame 9FA2
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB0Xw5OigJlwcy2OpKAzedE&google_cver=1
43 B
1014 B
Image
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB0Xw5OigJlwcy2OpKAzedE&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKrcqwIQu4SQjgIY4ZC4pQEwAQ&v=APEucNV7rYtWj_shoEW05mvkTZ--zQZfBmcMceiyABQAHHEHU612EVAEB32BK6FhJmbJYatzQ4n69IVrqSa3ASwg5UjOP7y637QN4c1Atm5ZvlDnHrPSj-2nbrskbkZDfu6VZCLjG0IQ64XVbw1ILS-0R790hbnnMFr6cdKmA9SaF6P_o_b9qLmXfxesOmRhvR05OIL6dZ1z4UXjd5q4jnrdeiZp5XkAvA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-218-208-246.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 18 Jun 2021 08:15:58 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Fri, 18 Jun 2021 08:15:58 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:58 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB0Xw5OigJlwcy2OpKAzedE&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 9FA2
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMxWPhJ5PK0fl3gSP-5zlwAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB0Xw5OigJlwcy2OpKAzedE&google_cver=1
43 B
894 B
Image
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB0Xw5OigJlwcy2OpKAzedE&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKrcqwIQu4SQjgIY4ZC4pQEwAQ&v=APEucNV7rYtWj_shoEW05mvkTZ--zQZfBmcMceiyABQAHHEHU612EVAEB32BK6FhJmbJYatzQ4n69IVrqSa3ASwg5UjOP7y637QN4c1Atm5ZvlDnHrPSj-2nbrskbkZDfu6VZCLjG0IQ64XVbw1ILS-0R790hbnnMFr6cdKmA9SaF6P_o_b9qLmXfxesOmRhvR05OIL6dZ1z4UXjd5q4jnrdeiZp5XkAvA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-218-208-246.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 18 Jun 2021 08:15:58 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Fri, 18 Jun 2021 08:15:58 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:58 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB0Xw5OigJlwcy2OpKAzedE&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
setuid
ib.adnxs.com/ Frame 9FA2
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEPTkLTO0ZK2ysrthepr4oro&google_cver=1
43 B
1023 B
Image
General
Full URL
https://ib.adnxs.com/setuid?entity=101&code=CAESEPTkLTO0ZK2ysrthepr4oro&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKrcqwIQu4SQjgIY4ZC4pQEwAQ&v=APEucNV7rYtWj_shoEW05mvkTZ--zQZfBmcMceiyABQAHHEHU612EVAEB32BK6FhJmbJYatzQ4n69IVrqSa3ASwg5UjOP7y637QN4c1Atm5ZvlDnHrPSj-2nbrskbkZDfu6VZCLjG0IQ64XVbw1ILS-0R790hbnnMFr6cdKmA9SaF6P_o_b9qLmXfxesOmRhvR05OIL6dZ1z4UXjd5q4jnrdeiZp5XkAvA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 18 Jun 2021 08:15:58 GMT
X-Proxy-Origin
89.40.183.142; 89.40.183.142; 690.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.173.234:80
AN-X-Request-Uuid
8c82c238-0b66-4e61-8417-9c2f992d2f16
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:58 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ib.adnxs.com/setuid?entity=101&code=CAESEPTkLTO0ZK2ysrthepr4oro&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
290
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 9FA2
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkxOTA2MDA2MjIxMjQ1MDQ0Ng%3D%3D
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkxOTA2MDA2MjIxMjQ1MDQ0Ng%3D%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKrcqwIQu4SQjgIY4ZC4pQEwAQ&v=APEucNV7rYtWj_shoEW05mvkTZ--zQZfBmcMceiyABQAHHEHU612EVAEB32BK6FhJmbJYatzQ4n69IVrqSa3ASwg5UjOP7y637QN4c1Atm5ZvlDnHrPSj-2nbrskbkZDfu6VZCLjG0IQ64XVbw1ILS-0R790hbnnMFr6cdKmA9SaF6P_o_b9qLmXfxesOmRhvR05OIL6dZ1z4UXjd5q4jnrdeiZp5XkAvA
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:58 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 18 Jun 2021 08:15:58 GMT
X-Proxy-Origin
89.40.183.142; 89.40.183.142; 690.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.173.42:80
AN-X-Request-Uuid
ed58e758-d06a-49a5-b255-a4bab7df0adf
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkxOTA2MDA2MjIxMjQ1MDQ0Ng%3D%3D
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
truncated
/ Frame AA5C
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
544d363da5e7a8c242b864594ef42271591a1023a3840867f28209289d2ef3dd

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
pagead2.googlesyndication.com/bg/ Frame E37F
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f781adfea30c3876a3540cbe92d910804408a1926b4140345f13f5ece75dc1a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 05:41:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
9261
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5750
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 18 Jun 2022 05:41:37 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame E37F
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BospLPVbMYKrhOMORrASmyZeYDwAAAAA4AeAEAg&bg=!-_il-LzNAAZktE7iZLQ7ACkAdvg8Wkan4W6zEptEeYloQXuW7oNWkmL6Dp2fyLwMq8flXHEIGzI-ggIAAACPUgAAAAxoAQcKABkelhigi5t5vumnfy28HRsNyRnJHxE7Rh0amQLHlO_9yXAJBSvYBFXBG22OwzlFgiQikC2RUJq0zY0afOcL5YBUvSUv-LcPmYJVQPGZp2dI2g5iUyOI3WzBZJo1Fbxur8JYmd03NiDiY3MLaHYB-5WAARlQWmJpFgbDEPLqCkEUsbdyacDlT-krz2FYa9SW5ExkW9QViGVKsCW3ZlskRHb6ReuC9unC8hglZjS5KTSE4X6r0-I9LnbddIgwFL2O49CsIBzBYjMnzqylfY5k-kL3AQ05p3WJ2KlTFuYnvAvA58J9-4v1Af2VjfVY_2frvkjKmdAlObKOf7YlEEh3EL0zS4GnA7oZtp6nqtBkUDMrzZzgtDAhmsQdICWTOHlQ3wLiQICY8T4TGhSrWL71amz6xPu_zWF6vYM0N_DzyvFMuQ093t5fPdUXPVxuBaWZI3ApCZxR-QZzTUBCAjgPD-9EaLzA8JQBRqJlAsHkMe1fdwnzkvL69rNPfCKhPDBr-1VnEE8dvwpkfoXZ5qOr8xm1ST6ShQkdK0g_fSxRWRfpDmhgF2Qrmun3ClYV5dzzKIggKqY1HBn8AEhDixUfPACoZtPdTFcywtAGJ3Dh6N4NS57U4FjtvCidon36C_F4MdCg3jVLRsTwkM0IfMJrvDPN03L3fSSgrHZ3orfubbbrbrbTLorSG5eQei5-W0AHnG7dJRzVd6lqYv6zh6SxVMCAOcpP7d-96FaDa7Kf952rCPRyXw5ttSyLNMqLrjsdpS1uR4ZAX_Pb0oMMU1e3mUw5MZylYP4EpeBrwU-G-yH2tr0KluXjPSuuRvAy-NpRgrXw-AAv9E2ifUyjhECLfoelfXMIjflM9roPb0XSdvpFF3JA54sdaQ7e7VQhZHi4aE3wGv6YOvOKrJjQebyr1U2oMKJQ0NSzWrhhaoCJEArKALxhXjyLYJyLlPkbDQd2cn89RiP4b5jF8gPNHnvnKxrfaNh2
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:58 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/
10 KB
8 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021061503&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
77b54e7aac64e99a511ff05adeeae0a9bb8c1e35b344b922457e42b1c229dc88
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:15:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7847
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1622653785071769"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6437
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:15:58 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/223/ Frame 1A73
12 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/223/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
5022
date
Fri, 18 Jun 2021 07:55:50 GMT
expires
Sat, 18 Jun 2022 07:55:50 GMT
last-modified
Wed, 17 Mar 2021 18:24:30 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
1208
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame 8B3E
783 B
763 B
Document
General
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
299b497f434737f5831af8b11f754f854a050fb9e6355a9bfb020be1679dec44
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-2nWB5iJ45/xo6+NDINONjg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/aframe
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

expires
Fri, 18 Jun 2021 08:15:58 GMT
date
Fri, 18 Jun 2021 08:15:58 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-2nWB5iJ45/xo6+NDINONjg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
514
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
pagead2.googlesyndication.com/bg/ Frame 1A73
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
450cd8f0848a395dd1c0e329fe4f5444e58cfd576162312a30d74a095d7135f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 20:50:36 GMT
content-encoding
br
x-content-type-options
nosniff
age
41122
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5759
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 17 Jun 2022 20:50:36 GMT
gen_204
pagead2.googlesyndication.com/pagead/
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=223&t=2&li=gpt_2021061503&jk=425230823421772&bg=!ubqluv7NAAZktE7iZLQ7ACkAdvg8WkK5nHDeciQO5aEJpAxzgX6VmvVSHJAW1npo7k6W0s2iY79OkAIAAAB1UgAAAA5oAQcKAQkyDKTAumi1At7y2-geKkqGPdhqPUe7wwF5L3j4ZLN-OOI3cfIHcy-pzyIOPkqFw61qY93DN7Qs9AHXicjJi4V_Fv2y04cg79IglwR4xPcTz63hYQYT7JIA3R6g0kSXzXFjefhdZ3BXvExXQFFvOFIMvR-K08U240_hfVUYUrPfs8UpYdfPltATH4vxLWOa_rEK477RrwpId6Af-li19tpleKXouyfJQvzwCKW9j-N6nBOQtLh4ARe4c2aM8q5-N8sEpQNLhrbWbaCNzAH2vJgzE4O2FGrwechxd1zavdnoDbqJFuRSK3Hn44JMWyhG4TJL2MEYhU4EbSvfQNAUktmqHBC4m6D740eOmQJk4GUJuu4mQk46GoznRdn9MZeHDRJXjOLhgaAspKyainmT7sSwajYiabUFkdnjc0BPFZNDWmkQG5C6BRUVQeo0bVG3e3A9CgUNSL_MpHnrjoU9S26-YEBwBDh6whFSuBSzFPhqhMgsSOwbbp3C9hxAKNljD3ZpuT-BGWbdE4Tt-BpIVH24OKWdLY3wV0Bci5oOch6a7c5tyl3R3aXtTjXMFLez06WSlVgGJISSeiKVHsyyqT3KdNaANd1ic14V-eT2E35A6O1oZ7mkQdHlqcr8EyNXvhehVhtTIrpFcyJQGOZZ1YD-Nv_ybsSsdICa249DmOQS5qhvfyszdbGMjkyHB9fJw8cX_3qVWvcuN8JnnK8wbvNzyPaArrVrnwArTQ_jA50XwbGg1dW_WsctVD0qvHhpLRnoClUqbzei96BIdqN7nMQRtApPiunfyfgWNgqe5CjyotpZ0cH9ebJ2YCaAAVSvh9XT88y1jNzBWmvOYHeJfnhEWsGVjNyq_8w87Ln5VfLmqF4rDSHvypMAeWnM5dr4cRpInnbCtKOtepSRl0vItfbTbuVwdg1og_mlB9WJAxInn5bIflLAZ1qTJXpDZPTEuMQiBkCW0laAgIhjdjuJ3UIRVLcJ_iQYGaFk3TTQ80TFWgdUpCixbLSnSK9zfJ9nj99rOUodRWVBLUukR5-w6w4XDTJ6FP0YRvXrgDJwUzf6DL59HzH-csI3WEgTXo8zrOH1doMkm-f-gZdxKb4OZUVvcJWFiu0iNGTxK2elyXdmN6PxpCMesy1Mniyd85hvgD8HxqpVk4m8ZIEy6qA34Ns7
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:59 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame AA5C
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst2b-6mtEM-OODM21ep2Kms5FmVDuLRD1HoWNg_V9cucETVLADZdANTlyWMWM6e8ktXfkK34J94M1jPa_aEhlD-XyH6nOcWktKlEz2aHWcaxLTkZAHrH7PQqqUQ7A&sai=AMfl-YSp-uxq4QwtWNSR-dNniIToSUJZ-Q6B6dYSjff5kL9dnjmo1OyQsbi5uARSHvz-4WBHLl54ViMU8wEI06XmdDaOIanjZcipO9SNEq4AVCtsjSzhlGbxgiLezm1UUF0&sig=Cg0ArKJSzG-m4Mtt_otZEAE&cid=CAASFeRoBKDxcEzqZNv1N4jnfdBMprUbcQ&id=lidar2&mcvt=1001&p=1110,436,1204,1164&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20210616&bin=7&avms=nio&bs=0,0&mc=0.96&if=1&app=0&itpl=20&adk=747879360&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1624004158289&dlt=31&rpt=196&isd=0&msd=0&r=v
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:59 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/
62 KB
21 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/adx/smrcp_19121001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
sffe /
Resource Hash
92f37bb02bae4c1d3b4538e432614ae81f4eb82746255b10592885cd6591fa52
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"905 / 313 of 1000 / last-modified: 1623971959"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21462
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:15:59 GMT
gpt.js
www.googletagservices.com/tag/js/
62 KB
21 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js?zx
Requested by
Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/adx/smrcp_19121001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
aa7ad08dddb3da63c9512897e1918a62f8fa96268d92fa1c3c2b4edbf4014686
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:15:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"905 / 250 of 1000 / last-modified: 1623971959"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21461
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:15:59 GMT
/
mc.yandex.ru/watch/56614870/ABS/
43 B
83 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.4554015813845278
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:59 GMT
last-modified
Fri, 18-Jun-2021 08:15:59 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:15:59 GMT
1
mc.yandex.ru/watch/53428543/
Redirect Chain
  • https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.26325862960156354
  • https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.26325862960156354
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.26325862960156354
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:59 GMT
last-modified
Fri, 18-Jun-2021 08:15:59 GMT
strict-transport-security
max-age=31536000
location
/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.26325862960156354
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:15:59 GMT
/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.319373398760632
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:59 GMT
last-modified
Fri, 18-Jun-2021 08:15:59 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:15:59 GMT
1
mc.yandex.ru/watch/53428543/
Redirect Chain
  • https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.6342927061272257
  • https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.6342927061272257
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.6342927061272257
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:59 GMT
last-modified
Fri, 18-Jun-2021 08:15:59 GMT
strict-transport-security
max-age=31536000
location
/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.6342927061272257
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:15:59 GMT
/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.28408091869659
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:59 GMT
last-modified
Fri, 18-Jun-2021 08:15:59 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:15:59 GMT
1
mc.yandex.ru/watch/53428543/
Redirect Chain
  • https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.46656032025398697
  • https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.46656032025398697
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.46656032025398697
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:15:59 GMT
last-modified
Fri, 18-Jun-2021 08:15:59 GMT
strict-transport-security
max-age=31536000
location
/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.46656032025398697
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:15:59 GMT
/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.12262263699933573
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:00 GMT
last-modified
Fri, 18-Jun-2021 08:16:00 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:16:00 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.7586423822549611
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
mc.yandex.ru/watch/56614870/ABS/
43 B
143 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.01905209596332491
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:00 GMT
last-modified
Fri, 18-Jun-2021 08:16:00 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:16:00 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.5473338210186314
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.6501350629741123
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:00 GMT
last-modified
Fri, 18-Jun-2021 08:16:00 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:16:00 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.790603692995218
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.7034144439587264
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:00 GMT
last-modified
Fri, 18-Jun-2021 08:16:00 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:16:00 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.16601382577531587
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.5740560137466681
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:00 GMT
last-modified
Fri, 18-Jun-2021 08:16:00 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:16:00 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.7549790394103473
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.18480423936605606
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:00 GMT
last-modified
Fri, 18-Jun-2021 08:16:00 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:16:00 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.06920725243807513
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.5457641795645722
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:00 GMT
last-modified
Fri, 18-Jun-2021 08:16:00 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 08:16:00 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.5632907463068375
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

integrator.js
adservice.google.fr/adsid/
107 B
165 B
Script
General
Full URL
https://adservice.google.fr/adsid/integrator.js?domain=ncmhcso.org
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:15:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
107 B
165 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=ncmhcso.org
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:15:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=425230823421772&correlator=1016820112607953&output=ldjh&impl=fif&eid=31061019%2C31061278%2C31061290%2C31061463%2C31061475%2C44740386&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x250&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1624004159&dt=1624004159963&dlt=1624004156654&idt=1203&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=348&adks=3270891412&ucis=2&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x-1&msz=1600x-1&ga_vid=1278456423.1624004158&ga_sid=1624004158&ga_hid=49947777&ga_fc=false&fws=4&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
1be611c7de2c8b87a8bf4b7a57bb94ce4dbadebe377354669e5f2f696ac7ef0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4493
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289077
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=425230823421772&correlator=1016820112607953&output=ldjh&impl=fif&eid=31061019%2C31061278%2C31061290%2C31061463%2C31061475%2C44740386&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x250&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1624004159&dt=1624004159965&dlt=1624004156654&idt=1203&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1465&adks=3308174817&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1050x-1&msz=1050x-1&ga_vid=1278456423.1624004158&ga_sid=1624004158&ga_hid=49947777&ga_fc=false&fws=4&ohw=1600&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
b8187fba06b7cd142d9c8b8577b3502214812c37eb1d01b8bb71c27ee4820b30
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4489
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289305
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=425230823421772&correlator=1016820112607953&output=ldjh&impl=fif&eid=31061019%2C31061278%2C31061290%2C31061463%2C31061475%2C44740386&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=580x400&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1624004159&dt=1624004159967&dlt=1624004156654&idt=1203&frm=20&biw=1600&bih=1200&oid=3&adxs=330&adys=2402&adks=3927901111&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=690x-1&msz=690x-1&ga_vid=1278456423.1624004158&ga_sid=1624004158&ga_hid=49947777&ga_fc=false&fws=4&ohw=1600&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
beae13f90f6a20b41296f5f4ff5338c50888e9bd36b804e01cff003023b5b27f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4380
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289290
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
5 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=425230823421772&correlator=1016820112607953&output=ldjh&impl=fif&eid=31061019%2C31061278%2C31061290%2C31061463%2C31061475%2C44740386&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=580x400&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1624004159&dt=1624004159969&dlt=1624004156654&idt=1203&frm=20&biw=1600&bih=1200&oid=3&adxs=330&adys=3831&adks=1647123121&ucis=5&ifi=5&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=720x-1&msz=720x-1&ga_vid=1278456423.1624004158&ga_sid=1624004158&ga_hid=49947777&ga_fc=false&fws=4&ohw=1600&btvi=4&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
e1561a2d50a0156bcf1398c94e7ea6bd7aec40f3bc68a887307994c2f5a4f7ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4578
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335342070
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
5 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=425230823421772&correlator=1016820112607953&output=ldjh&impl=fif&eid=31061019%2C31061278%2C31061290%2C31061463%2C31061475%2C44740386&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=580x400&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1624004159&dt=1624004159970&dlt=1624004156654&idt=1203&frm=20&biw=1600&bih=1200&oid=3&adxs=330&adys=4903&adks=3667475515&ucis=6&ifi=6&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=720x-1&msz=720x-1&ga_vid=1278456423.1624004158&ga_sid=1624004158&ga_hid=49947777&ga_fc=false&fws=4&ohw=1600&btvi=5&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
7fc68afd08e0a5f7a38236190b44cd54bdfb867e688110e83f03e9fa76e3c9de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4599
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289296
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=425230823421772&correlator=1016820112607953&output=ldjh&impl=fif&eid=31061019%2C31061278%2C31061290%2C31061463%2C31061475%2C44740386&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=580x400&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1624004159&dt=1624004159973&dlt=1624004156654&idt=1203&frm=20&biw=1600&bih=1200&oid=3&adxs=330&adys=5997&adks=1362492076&ucis=7&ifi=7&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=720x-1&msz=720x-1&ga_vid=1278456423.1624004158&ga_sid=1624004158&ga_hid=49947777&ga_fc=false&fws=4&ohw=1600&btvi=6&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
92effbe8a78dd9230be215e6677310241baa9add26361c38a476df719bad79fe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4376
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289299
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
10 KB
5 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=425230823421772&correlator=1016820112607953&output=ldjh&impl=fif&eid=31061019%2C31061278%2C31061290%2C31061463%2C31061475%2C44740386&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1624004159&dt=1624004159978&dlt=1624004156654&idt=1203&frm=20&biw=1600&bih=1200&oid=3&adxs=1018&adys=2402&adks=3104077658&ucis=8&ifi=8&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=315x-1&msz=315x-1&ga_vid=1278456423.1624004158&ga_sid=1624004158&ga_hid=49947777&ga_fc=false&fws=4&ohw=1600&btvi=7&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
19991510333e02070e2fd3ebb17c5bd13754996a7f7384a522944ed3f1f904c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5457
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289194
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=425230823421772&correlator=1016820112607953&output=ldjh&impl=fif&eid=31061019%2C31061278%2C31061290%2C31061463%2C31061475%2C44740386&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1624004159&dt=1624004159980&dlt=1624004156654&idt=1203&frm=20&biw=1600&bih=1200&oid=3&adxs=1018&adys=3392&adks=3815144746&ucis=9&ifi=9&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=315x-1&msz=315x-1&ga_vid=1278456423.1624004158&ga_sid=1624004158&ga_hid=49947777&ga_fc=false&fws=4&ohw=1600&btvi=8&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
f670bb4075e685a118d47b2a729af67b3f9916d93f8e2a74db953f3ce4336f36
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4363
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289080
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=425230823421772&correlator=1016820112607953&output=ldjh&impl=fif&eid=31061019%2C31061278%2C31061290%2C31061463%2C31061475%2C44740386&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1624004159&dt=1624004159982&dlt=1624004156654&idt=1203&frm=20&biw=1600&bih=1200&oid=3&adxs=1018&adys=4886&adks=3173476851&ucis=a&ifi=10&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=315x-1&msz=315x-1&ga_vid=1278456423.1624004158&ga_sid=1624004158&ga_hid=49947777&ga_fc=false&fws=4&ohw=1600&btvi=9&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
7a5dd1c2ec3bd61e7f09f4eea6318c74c8f4eb1d53ba5922cb266531a8c7351f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4369
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335342079
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=425230823421772&correlator=1016820112607953&output=ldjh&impl=fif&eid=31061019%2C31061278%2C31061290%2C31061463%2C31061475%2C44740386&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1624004159&dt=1624004159984&dlt=1624004156654&idt=1203&frm=20&biw=1600&bih=1200&oid=3&adxs=283&adys=7636&adks=524095259&ucis=b&ifi=11&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=316x-1&msz=316x-1&ga_vid=1278456423.1624004158&ga_sid=1624004158&ga_hid=49947777&ga_fc=false&fws=4&ohw=1600&btvi=10&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
f6819d771c21878ae3342bb2b9a33b695659e77824c9394be7c882b8debc63f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4375
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289113
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 5AFB
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu4M-cnH5MutdUXtRnrxXAI4X3z6sDYRBA_vXsZtmNGaT4Q0CbRxSwmtxhthqSm-ocHMD5ZQWnVq2kfKnjsxC9Yb5zTOSxXdANNleL8UcI5bHPnl-PtkBCIrfj6hQZt73GpnoPGO019vWOjY-s8o-I7iP4sHG1OcsZOqYsj0z5F8INeSDO6B39RbKhg7np70ygZbIR2snAAKGhWVzFCUchPOFNbn7oOfQHIDC8k58NGKeStuPU4iVXyzFn6KmmkIhP_2pTzO8fi6jp2DPLahOX2a_BR5i9rrg&sai=AMfl-YQP10noOyHHuRdoKa3fGiKK_fqqycgkCbsumsK0vsRcewMrqGyI9Yxhy8lkZh0UyZBjrA6S3VjrXETlwhrQGAs0hhoaGaBDY__8NkfNKF44qbBch-ku6rUeR_ZOOhVL&sig=Cg0ArKJSzPY3exK-2IGeEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:00 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:00 GMT
ALLzxvr.58
bk.jampartizan.com/ZXM/OPTR/ Frame 5AFB
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.58
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1624004160.168559,VS0,VE273
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-cdg20756-CDG
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 08:16:00 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 5AFB
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame DBC2
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstGHt7ZFw3JKIgm5FS_vZb1_UvA08G7kcUKTIeJfj2MAscIsTsOK2_GksrtV1Bg8mmBnr1tOaHP2A0D1wfhJDC_kq20i7yCJuw2m812n8tgiLRN_RVd9pGr8uvzC7INKsadSNATVZTSVNk5ACXf_KxASWr1towMbORdMBDSMumYjTvAoz344xgQs_zngEd6syXdOUiAnbueC-n4HgwB2_eEp4acSDZEYS5mHeEd6gtaVvYyxYworp0JRCHvK8SimBOMGmUxXADfKXjSny0FY0Dvs_Y&sai=AMfl-YQfC2yHJRI9Wfok0KkxHp_r0dEXUtA0ZO7NrIrgPxFcnzuJy1ad7qKS810oTs_VSXDUP5BzJ1rD5ypB6snJekFXlJVN_vQJZMf_NU1RfffZ9HGB7JU1bHESMgX8PHfG&sig=Cg0ArKJSzKIXxX7LUOFwEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:00 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:00 GMT
zxvr.15
bk.jampartizan.com/ZXM/OPTR/ Frame DBC2
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/zxvr.15
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1624004160.168670,VS0,VE141
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-cdg20756-CDG
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 08:16:00 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame DBC2
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame C1C4
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstPHAueH3Az5EG3MO-Z-CIqpyEscReaBC1lMw3h0wrXL6VcwMHdeb_2QHIDB8GDtuPGIqTsa4jqfqSb_sholbdLGtUZnhf0jfWksZfdR_LgMutWEiWWI-S-YcMO_j2kE5KIBCi3niM8eAOHTtpfRu4BAFoJYLBJOle7TwN_CaCjow_12YpXP5AWuvcR_QCi9V8QrMU3DwFg_62JcQ_QpTCC8NOxguajegBvp54agfeaBk0o53Z14H4ROEB6lKOuwCMDs5_pHOPm-3PBLFVvPK5VGWI&sai=AMfl-YTDOhNxcghG9tpw0dnHI5RjzNbItdOSyRM7_3GXuwTBkUmrbnk7DLZE_qA3cMcM3u9tt_EG_StkEVeF3skTyqwxkaBpkh-8Zj3CS8tSDHlY2VD6G_CSO7IaSmKfPs1b&sig=Cg0ArKJSzIVnmuVmAdmFEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:00 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:00 GMT
ALLzxvr.75
bk.jampartizan.com/ZXM/OPTR/ Frame C1C4
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.75
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
246adef29fe1329a53847079c91950a159407881774e15b5d5df2e8cb276534c
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1624004160.168740,VS0,VE158
etag
"629bdb77bd34cfd294109a1585d5c643b6680e2abccef7e380ae44297360d399-br"
x-served-by
cache-cdg20756-CDG
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 08:16:00 GMT
accept-ranges
bytes
content-length
1178
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame C1C4
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame C0AD
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstAroan7ao849hDBJniweOYLnU8RhiHaL8Ph9qcs_wMi8mMqoPj64_xhiRW0IZpXdXsitSJxUyUbmur0BXiSoCT4NlbYEOWHDR7Dt2CVC8O6QoGQUDk9DXTBo4vAf8d62mpo7a1cP9ZjJ2uHhz-OwMhHlSqvjJ_HBRJS2zd0yBjz6xZWn9od9Vodbg7QF0ngTGESV-JQ5f6X5Jx4qwITTJxy-7YC1QgoXhMai6KhlP3-J9yS_M4cGT6J-S8IEHh_ksyrbL3py0EfjivZQ7L7lgNG1c&sai=AMfl-YTSbpr2yAIq_zI0WNP5_EsOUMtML1fHQhn02wKbe5S5bmCg4ARhmZKng1PqCZCpqSVBbHWlxfPjgNn1EUeNSQ9eK-Gg_f3GQhxlLR2RLf0rNUF7jif7MSIWrgG4mJg&sig=Cg0ArKJSzJVOfRpFewqGEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:00 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:00 GMT
zxvr.60
bk.jampartizan.com/ZXM/OPTR/ Frame C0AD
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/zxvr.60
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1624004160.168727,VS0,VE161
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-cdg20756-CDG
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 08:16:00 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame C0AD
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 8A3B
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvwhWBEyZMBppVZoBMXOYDNNyseVTptXlTUmmS5gej7JiqK1dmnfVKakDUXMwZkh6Qs_pifQ9zdAEMCSyGMS7W1ONPYlGx7dYDBE0ePqG7yIekSXVEe6iMZE1iYwGPnkgyGQzV6A3LU2OO0QPS6Dxlfz2xc9Wau9fUuCHXotbMf11GBedTydKtWQfhKzFIM6ohOUb_AuLAyJrkX4HjaJclMSA2NnyZqFB_nYxr3YpqBk1hcKE7jEoxGxmosEfAxYqhBfR-qUPwVT_9L3kFBxjY2VnY&sai=AMfl-YQr5ordBOHCni3y5oaYpVORTNCuPV1XGZbK2n8Xf7BTr1Ns5hgzbVatmKTZjcHQN6dE3O0Tt5i9KOCalVO5EYUEtbZAPhWlfzQq1r0-ULvrVYN6SSfpl0E2X0Yzi0TS&sig=Cg0ArKJSzJEpBIT9KcCyEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:00 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:00 GMT
ALLzxvr.1
bk.jampartizan.com/ZXM/OPTR/ Frame 8A3B
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.1
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1624004160.168878,VS0,VE171
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-cdg20756-CDG
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 08:16:00 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
1
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 8A3B
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 9C24
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuIqF1jh5dSzChyCIxaihHb8dKVpEhG8yyyP-teR1-IUGF5VxJZUTtPXrVTX1SuO6_R1zSIGEAF4DV5bCTHXGjZu8E4lc2MUicSXjcZtGws-Fhr7fYejdbHFSqgPDcrDTv1P63zXgmzhfFgtWg7GeQ7t24_hrb6jvlqjAosmj71eCqRiDWfjKzcwzBaPd0AKzRC9soc1VcLfJe0F-FVyuxOk8BUU8qxq91ofHTIPuZe7bvshgNpmY5ZDW3tMRufRmvmKyxhJIrC4qPMIoO12EaerFe8-FMypw&sai=AMfl-YQdphjtR_GVbmoKncUf0UF5tkRrmh1sVGqicGH5wt6DlWsUnc6K9uxDyC1p-U7kIc1yYNdZld_rA_lOy4yKfWJq42Qtv3E3azWRIurOt40fyrG2V9Ukv-52mpmJpJ8g&sig=Cg0ArKJSzA3EpY1IO0LLEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:00 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
ALLzxvr.1
bk.jampartizan.com/ZXM/OPTR/ Frame 9C24
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.1
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1624004160.169949,VS0,VE170
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-cdg20756-CDG
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 08:16:00 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
1
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 9C24
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame DE15
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstdybuQBpWE9835TfVCZE0OesAxv0Jk4_ghvOxpB6k8FBcdDckW-Lc73AyKsz221wZiI9l9Th2z6TrAektV6bRextWdE4o8JWHp_Qym0ZI_XfsMGxev88YR_Sw506WtcUvSXspofrUELYHNfrCgpApLG33yKw2xGtB06MEC0mQf1CcNqfkaWjyhtJ0oMXHQzOJAZZDuIbwGhDoYyqzb_sAVcXEPDCVbhRUyg05WQaxxXyPcPTeIjTnEdcLSFW6UBZZqOI3Dyn_8seOLRb-dicxSFCU&sai=AMfl-YQtKg4OhFbLiay8MRHzkfXzFKzcNbJO81O6yTyJLH5p4zHKczy1pq2Z2VNmlJ1vEO_giLlCt4omJyA0CJJJryUYlLiQ_N5KyAn4xx0netf9yUOYd-y9r_IaD9i2uiA6&sig=Cg0ArKJSzBCG9fzJ3b3hEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:00 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
ALLzxvr.74
bk.jampartizan.com/ZXM/OPTR/ Frame DE15
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.74
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1624004160.170952,VS0,VE141
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-cdg20756-CDG
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 08:16:00 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame DE15
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame A0D9
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssafC8XR8gIsG84SPsEW0nyEGBEFvpNVwv9MDQupDpybJTlGo0HujNgKtR4sOBHMESlHj6eqf9p4-Vgl4oLLrIlaX0IEjQSG6fMn1zvhNDk97aYjsWRq1e9tWxJWwPG5cN7dwzAorWKo5xARGApJ_adpt2iAJnvyLROnjKLxlnvuMRrXIhdRLcOV1FVZpufOeyWx_EfvdnM-a0dQqJVDCnruknaCfvdZO9lrOiBu2-yiy2IX2wBss940rgGUAfY9e5WmxaSx_pnGnae7SQMvIzUrmU&sai=AMfl-YSXhU25bE18oeJHTK5ZgUbTvSzMcbf1tPi6bi6Bwxme75Kz0iO9c0jaKfD5Hu6Md7lOOLOeGhQwS0sJgyusIQiFwEg8IJ38wXJVJhZYplDLRMNPz_wylAUFxlJVrtQ&sig=Cg0ArKJSzAebb5FElrhqEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:00 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
ALLzxvr.36
bk.jampartizan.com/ZXM/OPTR/ Frame A0D9
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.36
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1624004160.171104,VS0,VE161
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-cdg20756-CDG
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 08:16:00 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame A0D9
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 520F
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssLz8VGTM2_zd5Qn581I9e9zUKOWxevsnUMDvQEYdGJOQ_8_0dWNi-ku49o9jOdITwnI4OA9oOXFtLnaZNPs3UEPp-FPdcd030V_OpFVapQszggkdls87mKHLxLo5zFpA5ASGEJ_iKgVm5F3sipA7HAJ94dWgFxzSh386nFL_Fqm7qR26wAVvX3z1DbHifigwj1CgTSoCtGp-txF2TGXvILPcjK47a0tZPLVHC19gcdXbPC1NRyxAihJzZS0IiBrSxYh0V2lBNl6d91mKfKn7FWnlVHDIhoIg&sai=AMfl-YQ_gOcNjsg4WndngvRP6fxnIhhcdtCE1CdXPs5-n9FSt5H_-_sqewW4RHiV_WrY_WLDWe_RKNUXTRexQ8m8B9zqpSyd731BfE6xLMVPt3WFxZjOlWzM5oJTLiAKdHc&sig=Cg0ArKJSzPx7zPD0XSnlEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:00 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
ALLzxvr.5
bk.jampartizan.com/ZXM/OPTR/ Frame 520F
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.5
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1624004160.182849,VS0,VE254
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-cdg20756-CDG
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 08:16:00 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 520F
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 4072
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJkwloId9UZk0C7vcoMUGP-6cXIm7Qk-Dg0fCcWTZ0NEMBxdCx_53i3y4CD-gyWFKFu0MEjSsD78z8-il6Gf71rxK8KxYp5Mk6bKeESCTT8Sq9RrRPFEWvp1JulrxSzWxKHttQUOZBLRDz7P3JM8HMTC612eFThnPE-jxdtT1vomh8hiDPlVohn5GBgODCRXVXVYK-zzCK1deagfWLOqlFVRZvl1O5TREmffmGwPsAFo-YfW-I7LTd_JVe10o4p321pp6N_Y7kTaXYWQMQ9EMQDGE&sai=AMfl-YQReANszU3Mj8IReji9QrcECIh-HGGV0-vmgOXrd7GDrGJgd0WHj6TaKMzyNa8i56mlQ0sshF5i26yJFSDNXcgLkjRU6mn30zrtEt2jK32bxQ33Pxa1X12LHWrK6Jl-&sig=Cg0ArKJSzNil4Hn6NxA3EAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:00 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
ALLzxvr.65
bk.jampartizan.com/ZXM/OPTR/ Frame 4072
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.65
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1624004160.182844,VS0,VE149
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-cdg20756-CDG
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 08:16:00 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 4072
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:00 GMT
truncated
/ Frame 5AFB
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a3c711fa3a16e2c87e35c8dec2508cd38b1cc6e1572f78849b4db0d26f6cc763

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame DBC2
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
59e78d540af7d652e75aa1b3e1e1edf726a3464986679767378259a510b7382f

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame C1C4
217 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7073536d50d0701e1be8fb0bac62d249e951fe41dca62f7bcb8e628a137bcb33

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame C0AD
218 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
36d5786f78c11d8e8ab9cfd09323386ff751378cd1b09c0ad1bb5bcdcef431b8

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 8A3B
218 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3523ed5c7be44fe902d3871fe1ebdd6bbfe820ab570c9982625ddf94d7b203bb

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 9C24
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ada59752057b656a95b5ad8a303dac46c823913c160b8f71a79f5d8a300001a9

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame DE15
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
edf4f2a7bcace6b3c2a9efb1ab0165e108206c3f3ef04bdb8bb28e7833ed7db6

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame A0D9
207 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4922bfef6e6dc4198aeacb06a25066057154c8368b5710915309267837435cca

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 520F
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
262771632a89432eaefe842d9a1789c73be38da2ebb38177a8708345e4ef946b

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 4072
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bd30f4aeca29e98bc22df127f6862fa50e96858931230dfab5ada6191adaf67d

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
ads
googleads.g.doubleclick.net/pagead/ Frame 0621
74 KB
25 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/zxvr.15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2e2fcbd503db66fd9011818cb9b75ba2b70888c9b463ac5606c79b90505ee422
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 08:16:01 GMT
server
cafe
content-length
25378
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame E57A
74 KB
24 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.74
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1ee832bcc86e4326770d68011d8cb5108e607c9a74e3b6dd27138ebc872f7a8c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 08:16:01 GMT
server
cafe
content-length
24966
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame 7F2C
80 KB
25 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.75
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f9cd3210e5bda438b977f8f04623629308aa7deb8535f3544955b3db63f299ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 08:16:00 GMT
server
cafe
content-length
25208
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame ABAF
69 KB
24 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/zxvr.60
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c6042d618193a30519857d6c066ae0d982772cd2e0e0aab6096098a03b272a82
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 08:16:01 GMT
server
cafe
content-length
24476
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame 1794
81 KB
25 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.65
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1609d3b477e2d71d3cf32bf9895e5f63d89214f88999ca45baeccc76a23bfb5d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 08:16:01 GMT
server
cafe
content-length
25791
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame 160A
74 KB
25 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.36
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
00145d064b68e137e2e7f0c13890ff6d917a084d350efb69c788c6ec480c0432
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 08:16:01 GMT
server
cafe
content-length
25264
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame DD6A
58 KB
22 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a306a69ddbfb541a1bdbb224293806ac94d1a9b4f3084ca9f5e82b6dd3f9db44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 08:16:01 GMT
server
cafe
content-length
22886
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame C969
59 KB
23 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
64540d5ecb8e214cc1a1cc4f1f68a7f09d0b6e56a37a456b08ee07d9c85fa9f5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 08:16:01 GMT
server
cafe
content-length
23245
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame 9D37
53 KB
16 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
58027843e9c3f059985dd8b5fe9de822c223e9061c26859b663dc2a43b39e6fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 08:16:01 GMT
server
cafe
content-length
16034
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame 27FA
74 KB
25 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.58
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3c1a4c35a75fcbfbc36f9a5d7253064428905ded79491b35ffbc1d3b25a62bc4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 08:16:01 GMT
server
cafe
content-length
25057
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
optad360.js
serving.stat-rock.com/player/
303 KB
95 KB
Script
General
Full URL
https://serving.stat-rock.com/player/optad360.js
Requested by
Host: get.optad360.io
URL: https://get.optad360.io/sf/0cb56948-cae8-47f8-b292-fbe3862a81d2/plugin.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
144.76.120.254 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
ap15.adplayer.pro
Software
nginx /
Resource Hash
37afcc50aed647983a6e055ccfdcb8ffb5edc9f759d42330a10edb6585f971f7

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:00 GMT
content-encoding
gzip
last-modified
Wed, 12 May 2021 07:13:31 GMT
server
nginx
etag
W/"609b801b-4bbf3"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=600
css
fonts.googleapis.com/ Frame 7F2C
3 KB
674 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 07:54:17 GMT
server
ESF
date
Fri, 18 Jun 2021 08:16:00 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 08:16:00 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 7F2C
1 KB
990 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:13:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
159
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:13:21 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 7F2C
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
74
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:46 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 7F2C
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
117
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:03 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 7F2C
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:01 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 7F2C
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:11:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
279
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:11:21 GMT
37c44ba5c7c2e56e86b2dceff03da5e6.js
www.gstatic.com/mysidia/ Frame 7F2C
25 KB
11 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/37c44ba5c7c2e56e86b2dceff03da5e6.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
754e4f25470d9263afc25125dce868bae633ea3d59f1b7dc8a0e740292fa68a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 13:27:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
154134
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10651
x-xss-protection
0
last-modified
Thu, 10 Jun 2021 06:35:23 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Tue, 14 Sep 2021 13:27:06 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/2320112225184822021/ Frame 7F2C
18 KB
18 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/2320112225184822021/downsize_200k_v1?w=600&h=314
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
45d57471cedd952555402ff456f064ea8cebeb82e0b6c2f783be20c3c0278e04
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 15 Jun 2021 08:39:21 GMT
x-content-type-options
nosniff
age
257799
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18371
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 15:56:09 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 15 Jun 2022 08:39:21 GMT
truncated
/ Frame 7F2C
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame A894
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
83583
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 7F2C
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c5f7f45a6c1506225e5cef11f79b28ae0389422190934e506bb69c3ced839e1d

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 7F2C
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
520517
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 7F2C
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
509253
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
css
fonts.googleapis.com/ Frame 1794
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 07:26:53 GMT
server
ESF
date
Fri, 18 Jun 2021 08:16:01 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 08:16:01 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 1794
1 KB
909 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:13:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
160
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:13:21 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 1794
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:46 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 1794
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
118
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:03 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 1794
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:01 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 1794
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:11:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
280
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:11:21 GMT
37c44ba5c7c2e56e86b2dceff03da5e6.js
www.gstatic.com/mysidia/ Frame 1794
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/37c44ba5c7c2e56e86b2dceff03da5e6.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
754e4f25470d9263afc25125dce868bae633ea3d59f1b7dc8a0e740292fa68a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 13:27:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
154135
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10651
x-xss-protection
0
last-modified
Thu, 10 Jun 2021 06:35:23 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Tue, 14 Sep 2021 13:27:06 GMT
current
dclk-match.dotomi.com/match/bounce/ Frame A894
0
104 B
Image
General
Full URL
https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEDAiuRup2f_setJaPi640oc&google_cver=1&google_push=AYg5qPIIggHkooEMvNPDn8EOh_KOXt8eQq6C82-54or0UC6cB9F_Cc8a_8Q6ChoyC4P4VUSfjGs6gTkDyUHPB63xVKg6_xXRuoI
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:fa8:8806:12::1400 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
cache-control
no-cache, private, max-age=0, no-store
server
nginx
expires
0
pixel
cm.g.doubleclick.net/ Frame A894
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESENwY52Qky20EJeOfjhsz_po&google_cver=1&google_push=AYg5qPK980N-X_kv91M9PUMZF_hTctkOMzQ9_v8uTTziBzS02wd1TufEcPoNRP_EmQ-XY5NwUk3cXiIV7Q2koinU...
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPK980N-X_kv91M9PUMZF_hTctkOMzQ9_v8uTTziBzS02wd1TufEcPoNRP_EmQ-XY5NwUk3cXiIV7Q2koinU0PnW5dm_yA
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPK980N-X_kv91M9PUMZF_hTctkOMzQ9_v8uTTziBzS02wd1TufEcPoNRP_EmQ-XY5NwUk3cXiIV7Q2koinU0PnW5dm_yA
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 08:16:01 GMT
Server
MT3 3759 5f8f15b master zrh-pixel-x25
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPK980N-X_kv91M9PUMZF_hTctkOMzQ9_v8uTTziBzS02wd1TufEcPoNRP_EmQ-XY5NwUk3cXiIV7Q2koinU0PnW5dm_yA
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Fri, 18 Jun 2021 08:16:00 GMT
pixel
cm.g.doubleclick.net/ Frame A894
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESENr99uNDXmzBtbCZ1Lj7boQ&google_cver=1&google_push=AYg5qPLbdLxumFfv7UYdXM36YKdf6YfSVNpdNjPYITkvbZOXzF08JF4XjN8DXdqSMnJd-j2JUjALZd8lY3ze7-...
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTA0NDc2MDA2NzQzODczMw%3D%3D&google_push=AYg5qPLbdLxumFfv7UYdXM36YKdf6YfSVNpdNjPYITkvbZOXzF08JF4XjN8DXdqSMnJd-j2JUjALZd8lY3ze7--yki...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTA0NDc2MDA2NzQzODczMw%3D%3D&google_push=AYg5qPLbdLxumFfv7UYdXM36YKdf6YfSVNpdNjPYITkvbZOXzF08JF4XjN8DXdqSMnJd-j2JUjALZd8lY3ze7--ykitiiy7LP_A
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTA0NDc2MDA2NzQzODczMw%3D%3D&google_push=AYg5qPLbdLxumFfv7UYdXM36YKdf6YfSVNpdNjPYITkvbZOXzF08JF4XjN8DXdqSMnJd-j2JUjALZd8lY3ze7--ykitiiy7LP_A
Date
Fri, 18 Jun 2021 08:16:01 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
pixel
cm.g.doubleclick.net/ Frame A894
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEMo086IeiljYESIbGtu7hCI&google_cver=1&google_push=AYg5qPJ-BkF7lW0HuWu5avacGMkPwLgrMTJmA-CtdLW-6z93NwsOC6Qz3R0FPv9GiwaQP3YfjX6GuwLHrhBPVdsxIh8U...
  • https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEMo086IeiljYESIbGtu7hCI&google_cver=1&google_push=AYg5qPJ-BkF7lW0HuWu5avacGMkPwLgrMTJmA-CtdLW-6z93NwsOC6Qz3R0FPv9GiwaQP3YfjX6GuwLHrhBPVd...
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJ-BkF7lW0HuWu5avacGMkPwLgrMTJmA-CtdLW-6z93NwsOC6Qz3R0FPv9GiwaQP3YfjX6GuwLHrhBPVdsxIh8UA6gkkGQ&google_hm=nn6_oCotQ466icIIl6wXAQ==
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJ-BkF7lW0HuWu5avacGMkPwLgrMTJmA-CtdLW-6z93NwsOC6Qz3R0FPv9GiwaQP3YfjX6GuwLHrhBPVdsxIh8UA6gkkGQ&google_hm=nn6_oCotQ466icIIl6wXAQ==
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
//cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJ-BkF7lW0HuWu5avacGMkPwLgrMTJmA-CtdLW-6z93NwsOC6Qz3R0FPv9GiwaQP3YfjX6GuwLHrhBPVdsxIh8UA6gkkGQ&google_hm=nn6_oCotQ466icIIl6wXAQ==
date
Fri, 18 Jun 2021 08:16:01 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
pixel
cm.g.doubleclick.net/ Frame A894
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDa-SzPKneQ6yKMq_DOsz8Y&google_cver=1&google_push=AYg5qPKXreuy4S_w7As9QQ-gVSFEPwwyYet5DBleRmc001376UtqCnH8gyIZM1pUMRXvCcoM5FO...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVBS04tUy1GSkQ3&google_push=AYg5qPKXreuy4S_w7As9QQ-gVSFEPwwyYet5DBleRmc001376UtqCnH8gyIZM1pUMRXvCcoM5FOk6L2FHxKqGFaZ6MOmHTMELvg
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVBS04tUy1GSkQ3&google_push=AYg5qPKXreuy4S_w7As9QQ-gVSFEPwwyYet5DBleRmc001376UtqCnH8gyIZM1pUMRXvCcoM5FOk6L2FHxKqGFaZ6MOmHTMELvg
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVBS04tUy1GSkQ3&google_push=AYg5qPKXreuy4S_w7As9QQ-gVSFEPwwyYet5DBleRmc001376UtqCnH8gyIZM1pUMRXvCcoM5FOk6L2FHxKqGFaZ6MOmHTMELvg
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
66ef90d06496cfd000aab8206f2b6221
Expires
0
pixel
cm.g.doubleclick.net/ Frame A894
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&googl...
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_push=AY...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBM...
0
0

pixel
cm.g.doubleclick.net/ Frame A894
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEBRDS3qrRMmAFoKE_s6Wb10&google_cver=1&google_push=AYg5qPLuMUnVq7owPN1m6itftkmT9uwvuQsdm2WhZwFSKwHLi3Vze4um4_D1BeuELcQ3ZMgbpKSQp8...
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPLuMUnVq7owPN1m6itftkmT9uwvuQsdm2WhZwFSKwHLi3Vze4um4_D1BeuELcQ3ZMgbpKSQp8_0S2bhWMt2FAwpcDYoWqw&google_hm=NjU0ODI3MTg...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPLuMUnVq7owPN1m6itftkmT9uwvuQsdm2WhZwFSKwHLi3Vze4um4_D1BeuELcQ3ZMgbpKSQp8_0S2bhWMt2FAwpcDYoWqw&google_hm=NjU0ODI3MTg3NzQ0NDE4NjEyNg%3D%3D
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPLuMUnVq7owPN1m6itftkmT9uwvuQsdm2WhZwFSKwHLi3Vze4um4_D1BeuELcQ3ZMgbpKSQp8_0S2bhWMt2FAwpcDYoWqw&google_hm=NjU0ODI3MTg3NzQ0NDE4NjEyNg%3D%3D
date
Fri, 18 Jun 2021 08:16:00 GMT
content-length
0
attr
cm.g.doubleclick.net/pixel/ Frame A894
0
59 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L0yhLxln0Ff8oztf6onKAvVbEhSyUWQhjEVXmHW_rQWSWDnIrd_TgSyeGBVBw-xBVaQRQF
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame C1C4
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssm75kvnDDLycBVK3rIdwOccll2ZrIyoFUrpFkwoNGrOQrhkT-0dZPnlHIK5qO7ArTr4niJYGvfXOMZjXZPML9ldZkx3fJ5q9VkU_6sQTGKIoXEqa4-hHThlfHy-4nlNazHyKfHpVQ-EteXvblGB4R1I2rNeKNY3SC6HfZdrq9FFvea6ZvYCVIss5TTGZ59Y-iaLbhiCY3-oypod-_nL7HPUDQqgtXh8U3Do7D5fBXkSu_bWqqoxrQ421FzhwIFJXtVm0tGM9k9cj6wUvch7T3g2H7MIg&sai=AMfl-YQ3X28OMKyumszX7-mzS6sbXbLH5_a3X9aDk76497WaVB11aMARq6QA3vsLKPTSzixhFzrmQjIMfZp7h_QnuGq_NGpehhWyfKINm0iQAUI--WfWvpwfDdFCf60nXiCI&sig=Cg0ArKJSzE510xLA89v5EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:01 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:01 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/2320112225184822021/ Frame 1794
18 KB
18 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/2320112225184822021/downsize_200k_v1?w=600&h=314
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
45d57471cedd952555402ff456f064ea8cebeb82e0b6c2f783be20c3c0278e04
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 15 Jun 2021 08:39:21 GMT
x-content-type-options
nosniff
age
257800
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18371
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 15:56:09 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 15 Jun 2022 08:39:21 GMT
truncated
/ Frame 1794
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
pagead2.googlesyndication.com/bg/ Frame 8B0F
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6445870033364036
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
450cd8f0848a395dd1c0e329fe4f5444e58cfd576162312a30d74a095d7135f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 20:50:36 GMT
content-encoding
br
x-content-type-options
nosniff
age
41125
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5759
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 17 Jun 2022 20:50:36 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 83D1
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
83583
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 1794
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8a3be7fe8fdea096e0d1ce3a7bd64c50add242f22396b5107a7d46c25095d58e

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 1794
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
520517
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 1794
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
509253
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
css
fonts.googleapis.com/ Frame 0621
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 07:30:24 GMT
server
ESF
date
Fri, 18 Jun 2021 08:16:01 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 08:16:01 GMT
/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 83D1
Redirect Chain
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESENG1Oa6YSiIl8PP_3h6xdaU&google_cver=1&google_push=AYg5qPLSzb61ZXv89Et_Em8NWycSmi6wrxi-LX3pdrL6koiThRgw6D2SCls4uj8ku3dTr-i3uGeiOq_4P9b4JO29nQ2XmmOaGp2E
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODI5NjQ4ODA0NjA3NDM5ODA0Mw==
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESENG1Oa6YSiIl8PP_3h6xdaU&google_cver=1
43 B
407 B
Image
General
Full URL
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESENG1Oa6YSiIl8PP_3h6xdaU&google_cver=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software
/
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:00 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type
image/gif
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESENG1Oa6YSiIl8PP_3h6xdaU&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 83D1
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cve...
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&goog...
  • https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=alFRVDBTaW4xTFU5RnY1&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cver=1&google_push=AYg5qPKQ6_disJqqFuOWvkcP2ErzFuS6VbOPt6lDdsx_tw7...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=alFRVDBTaW4xTFU5RnY1&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cver=1&google_push=AYg5qPKQ6_disJqqFuOWvkcP2ErzFuS6VbOPt6lDdsx_tw71Bc1ORfw4Hf8hmz-0Dx6xPFauIpwSt3-2os9F9OfGMcgbhB7lRjhh
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 18 Jun 2021 08:16:00 GMT
Server
PingMatch/v2.0.30-655-g6f0fff2#rel-ec2-master i-005da0421d9a8a886@eu-central-1b@dxedge-app-eu-central-1-prod-asg
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=alFRVDBTaW4xTFU5RnY1&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cver=1&google_push=AYg5qPKQ6_disJqqFuOWvkcP2ErzFuS6VbOPt6lDdsx_tw71Bc1ORfw4Hf8hmz-0Dx6xPFauIpwSt3-2os9F9OfGMcgbhB7lRjhh
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 83D1
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESENr99uNDXmzBtbCZ1Lj7boQ&google_cver=1&google_push=AYg5qPLi2fgEnITNctYQ-yBE3FSeiOdtSOWhinR7KSTuqNmCKc3L3ki-MSzU2Vetajk4T7NbZ9P2C7F2hitRkZ...
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTA0NDc2MDA2NzQzODczMw%3D%3D&google_push=AYg5qPLi2fgEnITNctYQ-yBE3FSeiOdtSOWhinR7KSTuqNmCKc3L3ki-MSzU2Vetajk4T7NbZ9P2C7F2hitRkZ67ci...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTA0NDc2MDA2NzQzODczMw%3D%3D&google_push=AYg5qPLi2fgEnITNctYQ-yBE3FSeiOdtSOWhinR7KSTuqNmCKc3L3ki-MSzU2Vetajk4T7NbZ9P2C7F2hitRkZ67cifmG7vgdF8
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTA0NDc2MDA2NzQzODczMw%3D%3D&google_push=AYg5qPLi2fgEnITNctYQ-yBE3FSeiOdtSOWhinR7KSTuqNmCKc3L3ki-MSzU2Vetajk4T7NbZ9P2C7F2hitRkZ67cifmG7vgdF8
Date
Fri, 18 Jun 2021 08:16:01 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
pixel
cm.g.doubleclick.net/ Frame 83D1
Redirect Chain
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESECoDsiULCRA0nEddzXluu70&google_cver=1&google_push=AYg5qPK6JZLhCNeLOpOuJfFS7la5B7hvTScxTMQN4lijxvk5JVZaQuGnnS8wU...
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESECoDsiULCRA0nEddzXluu70&google_cver=1&google_push=AYg5qPK6JZLhCNeLOpOuJfFS7la5B7hvTScxTMQN4lijxvk5JVZaQuGnnS8wU...
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=dOFKKMv9WWPXnbp6ifhjjg&google_push=AYg5qPK6JZLhCNeLOpOuJfFS7la5B7hvTScxTMQN4lijxvk5JVZaQuGnnS8wUboOn84Gc_H_fj4Rdw-ky...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=dOFKKMv9WWPXnbp6ifhjjg&google_push=AYg5qPK6JZLhCNeLOpOuJfFS7la5B7hvTScxTMQN4lijxvk5JVZaQuGnnS8wUboOn84Gc_H_fj4Rdw-kyj4SYvGjo2UNQFslO4Q
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 08:16:01 GMT
Server
nginx
Vary
Accept
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=dOFKKMv9WWPXnbp6ifhjjg&google_push=AYg5qPK6JZLhCNeLOpOuJfFS7la5B7hvTScxTMQN4lijxvk5JVZaQuGnnS8wUboOn84Gc_H_fj4Rdw-kyj4SYvGjo2UNQFslO4Q
Connection
close
Content-Type
text/plain; charset=utf-8
Content-Length
237
pixel
cm.g.doubleclick.net/ Frame 83D1
Redirect Chain
  • https://rtb.openx.net/sync/dds?google_gid=CAESECByOLzEsIUJ0HbACUr9Zxc&google_cver=1&google_push=AYg5qPI2GCIMtTuF_OEXE1DhfWHhF3sUkYvpQ79w7AQl-FrogiQbTQ9b2fG8HMI6GPrEPC2J8fqPVM9NRHBjhgm6jx7xgYGzSYk
  • https://rtb.openx.net/sync/dds?google_gid=CAESECByOLzEsIUJ0HbACUr9Zxc&google_cver=1&google_push=AYg5qPI2GCIMtTuF_OEXE1DhfWHhF3sUkYvpQ79w7AQl-FrogiQbTQ9b2fG8HMI6GPrEPC2J8fqPVM9NRHBjhgm6jx7xgYGzSYk&o...
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI2GCIMtTuF_OEXE1DhfWHhF3sUkYvpQ79w7AQl-FrogiQbTQ9b2fG8HMI6GPrEPC2J8fqPVM9NRHBjhgm6jx7xgYGzSYk&google_hm=gCYJTqg_yR0bWe6kIZ7pjA==
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI2GCIMtTuF_OEXE1DhfWHhF3sUkYvpQ79w7AQl-FrogiQbTQ9b2fG8HMI6GPrEPC2J8fqPVM9NRHBjhgm6jx7xgYGzSYk&google_hm=gCYJTqg_yR0bWe6kIZ7pjA==
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
via
1.1 google
server
Cowboy
access-control-allow-origin
null
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI2GCIMtTuF_OEXE1DhfWHhF3sUkYvpQ79w7AQl-FrogiQbTQ9b2fG8HMI6GPrEPC2J8fqPVM9NRHBjhgm6jx7xgYGzSYk&google_hm=gCYJTqg_yR0bWe6kIZ7pjA==
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
content-length
0
x-request-id
b8l9de5a6iss1gkv5ipe8tlosha6cdtd
pixel
cm.g.doubleclick.net/ Frame 83D1
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDa-SzPKneQ6yKMq_DOsz8Y&google_cver=1&google_push=AYg5qPLxCc00n8gQBHWCDBXqMpp4kESqqckm3mI4el2JX2WggaaGo5Hs_ob82iE4TOvykgWZb5y...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVBTTMtTi1KM1dR&google_push=AYg5qPLxCc00n8gQBHWCDBXqMpp4kESqqckm3mI4el2JX2WggaaGo5Hs_ob82iE4TOvykgWZb5y13oTl-u3e3roa8OFQ-MgWY5_q
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVBTTMtTi1KM1dR&google_push=AYg5qPLxCc00n8gQBHWCDBXqMpp4kESqqckm3mI4el2JX2WggaaGo5Hs_ob82iE4TOvykgWZb5y13oTl-u3e3roa8OFQ-MgWY5_q
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVBTTMtTi1KM1dR&google_push=AYg5qPLxCc00n8gQBHWCDBXqMpp4kESqqckm3mI4el2JX2WggaaGo5Hs_ob82iE4TOvykgWZb5y13oTl-u3e3roa8OFQ-MgWY5_q
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
66ef90d06496cfd000aab8206f2b6221
Expires
0
pixel
cm.g.doubleclick.net/ Frame 83D1
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupB...
0
0

attr
cm.g.doubleclick.net/pixel/ Frame 83D1
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KZudjQMEHSniXA0Tk4uE5AZM6_sqDdhNv4DqB7mQAnJzmcOt5X3G8b2IK8cZzfpFqy7jMt
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame 4072
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuwqa3QRFe2c_Ptl3Fmh5m-x6oEZ7JUupDGUoZeNclGn5rUoNXSWIjdpAOgIiJBt4Nma6t88aP_QYN--tlNzK-yV8GFr60YfF-KP5pPf6ixLbc7N7M6hTPbEEpl2qgm-7Cmscf_lMqViEzYFhr5ThOYRLHwpk-QestDUMSgt3YX02-UOm81oW5ihiHttFzzdZkOe9t7sWa62lBEzYViiK0HSLS-AcntMJOohAyjWd3_WjgD5cNEEpmo3VmQcjIwJySrEmFAeGhdfE9Rf5ESUwgCu1jOXQ&sai=AMfl-YTH25CQstd-TM_fMcGhnkUvGQDQKeDZjICKRNqDOlhbqPbvzvOXMpcXyTCnejxfDVyTALwgePlyUM1I1orAqvZ30QBhPrVP4MrDg4EL90StbFA0h2Z1wz0Pcf649Kxl&sig=Cg0ArKJSzJeaYVA2uXnqEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:01 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:01 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 0621
1 KB
909 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:13:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
160
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:13:21 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 0621
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:46 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 0621
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
118
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:03 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 0621
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:01 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 0621
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:11:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
280
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:11:21 GMT
37c44ba5c7c2e56e86b2dceff03da5e6.js
www.gstatic.com/mysidia/ Frame 0621
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/37c44ba5c7c2e56e86b2dceff03da5e6.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
754e4f25470d9263afc25125dce868bae633ea3d59f1b7dc8a0e740292fa68a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 13:27:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
154135
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10651
x-xss-protection
0
last-modified
Thu, 10 Jun 2021 06:35:23 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Tue, 14 Sep 2021 13:27:06 GMT
RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
pagead2.googlesyndication.com/bg/ Frame 1035
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.26084604914284437
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
450cd8f0848a395dd1c0e329fe4f5444e58cfd576162312a30d74a095d7135f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 20:50:36 GMT
content-encoding
br
x-content-type-options
nosniff
age
41125
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5759
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 17 Jun 2022 20:50:36 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame BFAE
143 B
163 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Fri, 18 Jun 2021 07:51:12 GMT
server
safe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
1489
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 509C
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
83583
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 0621
207 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6a4c9c4692721398ade60707849295e6fdbcf354bd898848a1a3638b99bb9479

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 0621
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
520517
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 0621
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
509253
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
css
fonts.googleapis.com/ Frame E57A
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 07:53:10 GMT
server
ESF
date
Fri, 18 Jun 2021 08:16:01 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 08:16:01 GMT
11326381978402965348
tpc.googlesyndication.com/daca_images/simgad/ Frame C969
98 KB
98 KB
Image
General
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/11326381978402965348
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7f8e23303ba343ec125b4b0b385fc6faf1bf25756596647b0b0658d8d54d35b1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 05:57:24 GMT
x-content-type-options
nosniff
age
526717
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100548
x-xss-protection
0
last-modified
Wed, 21 Apr 2021 05:56:44 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 05:57:24 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame C969
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:46 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame C969
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
118
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:03 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame C969
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:01 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame C969
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:11:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
280
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:11:21 GMT
l
www.google.com/ads/measurement/ Frame C969
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSjSzFwrLUcg9zz8DVcgVnGcuLV1Qm1w5Nizija9rR21CNweZggTs0OUvQmD7pZSSkpsEki8-qxlNz2RFil1N0NEGruEw
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

one_click_handler_one_afma_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame C969
25 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/one_click_handler_one_afma_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7a783598f3cc86a4d73a813cedd5f6cbdf85ab7b95c4d40944a30c833071aa18
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 21:37:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
38315
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10657
x-xss-protection
0
server
cafe
etag
7233769875026612745
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 01 Jul 2021 21:37:26 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame E57A
1 KB
909 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:13:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
160
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:13:21 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame E57A
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:46 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame E57A
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
118
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:03 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame E57A
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:01 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame E57A
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:11:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
280
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:11:21 GMT
l
www.google.com/ads/measurement/ Frame E57A
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQnY_XbIFK2yHWA8zZEqqKx1m6Mv98ytWilxnXMJBg1qPZlO5IpOdo7T2NyXzq_VTBvvBzb5oGndDXdlMwAEmwIEnyAZw
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

37c44ba5c7c2e56e86b2dceff03da5e6.js
www.gstatic.com/mysidia/ Frame E57A
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/37c44ba5c7c2e56e86b2dceff03da5e6.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
754e4f25470d9263afc25125dce868bae633ea3d59f1b7dc8a0e740292fa68a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 13:27:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
154135
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10651
x-xss-protection
0
last-modified
Thu, 10 Jun 2021 06:35:23 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Tue, 14 Sep 2021 13:27:06 GMT
pixel
cm.g.doubleclick.net/ Frame 509C
Redirect Chain
  • https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPIKrVzTOoxGBvey0K-iyrVi2abwlf235bLYUqJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU14V1FRQUFBQmlnY1JrcA&google_push=AYg5qPIKrVzTOoxGBvey0K-iyrVi2abwlf235bLYUqJXIZZ8w-7zFA8nWlO86_E_5eSAa2MU7M9X4ujmdjKuIFwNoK6CP1ZSwT...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU14V1FRQUFBQmlnY1JrcA&google_push=AYg5qPIKrVzTOoxGBvey0K-iyrVi2abwlf235bLYUqJXIZZ8w-7zFA8nWlO86_E_5eSAa2MU7M9X4ujmdjKuIFwNoK6CP1ZSwTvpf1TVAHApMeRRtRNpKUka0tKpyQQF8M_RsXxh-hvU1Uh-
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU14V1FRQUFBQmlnY1JrcA&google_push=AYg5qPIKrVzTOoxGBvey0K-iyrVi2abwlf235bLYUqJXIZZ8w-7zFA8nWlO86_E_5eSAa2MU7M9X4ujmdjKuIFwNoK6CP1ZSwTvpf1TVAHApMeRRtRNpKUka0tKpyQQF8M_RsXxh-hvU1Uh-
Date
Fri, 18 Jun 2021 08:16:01 GMT
Server
Apache
Connection
keep-alive
Content-Length
435
Content-Type
text/html; charset=iso-8859-1
pixel
cm.g.doubleclick.net/ Frame 509C
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESENwY52Qky20EJeOfjhsz_po&google_cver=1&google_push=AYg5qPLXvrcRc_PxaMTwJ2CKhK19-iFklTMhiAR7M5cde6Vyb1RZU3Y_1ydequIrN_oqUsQtXjD1TAj72vv1xYpt...
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=j69gzFZAQQC8AF63M86HXg&google_push=AYg5qPLXvrcRc_PxaMTwJ2CKhK19-iFklTMhiAR7M5cde6Vyb1RZU3Y_1ydequIrN_oqUsQtXjD1TAj72vv1xYptgdV958Zs...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=j69gzFZAQQC8AF63M86HXg&google_push=AYg5qPLXvrcRc_PxaMTwJ2CKhK19-iFklTMhiAR7M5cde6Vyb1RZU3Y_1ydequIrN_oqUsQtXjD1TAj72vv1xYptgdV958ZsuaE-XwSlwdX-LR_iWVIAtVllhYFbyc6tSOLpMI3exe7mi0ff
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 08:16:01 GMT
Server
MT3 3759 5f8f15b master zrh-pixel-x13
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=j69gzFZAQQC8AF63M86HXg&google_push=AYg5qPLXvrcRc_PxaMTwJ2CKhK19-iFklTMhiAR7M5cde6Vyb1RZU3Y_1ydequIrN_oqUsQtXjD1TAj72vv1xYptgdV958ZsuaE-XwSlwdX-LR_iWVIAtVllhYFbyc6tSOLpMI3exe7mi0ff
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Fri, 18 Jun 2021 08:16:00 GMT
i.match
s.tribalfusion.com/z/ Frame 509C
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPI3-yf3xq5qHbFmf924oy1RTwvXgEcNvLxsNYM_q1Atrn_WtWcYV54oOsjpv8ia3dQ0QxNgE8FRdVoe77QFMJA71a7dSXm1C...
  • https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPI3-yf3xq5qHbFmf924oy1RTwvXgEcNvLxsNYM_q1Atrn_WtWcYV54oOsjpv8ia3dQ0QxNgE8FRdVoe77QFMJA71a7dSXm...
43 B
469 B
Image
General
Full URL
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPI3-yf3xq5qHbFmf924oy1RTwvXgEcNvLxsNYM_q1Atrn_WtWcYV54oOsjpv8ia3dQ0QxNgE8FRdVoe77QFMJA71a7dSXm1CJJuGrxX_dio54iu1f-7ERiJwy3ZO3YszdEWfvcXTT0&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPI3-yf3xq5qHbFmf924oy1RTwvXgEcNvLxsNYM_q1Atrn_WtWcYV54oOsjpv8ia3dQ0QxNgE8FRdVoe77QFMJA71a7dSXm1CJJuGrxX_dio54iu1f-7ERiJwy3ZO3YszdEWfvcXTT0%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
661312bbddce1782-FRA
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
content-type
image/gif; charset=utf-8
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
43
cf-request-id
0abfca096300001782e69d9000000001
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
cf-cache-status
DYNAMIC
x-function
206
server
cloudflare
x-reuse-index
563
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
661312b9c9501782-FRA
p3p
CP="NOI DEVo TAIa OUR BUS"
location
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPI3-yf3xq5qHbFmf924oy1RTwvXgEcNvLxsNYM_q1Atrn_WtWcYV54oOsjpv8ia3dQ0QxNgE8FRdVoe77QFMJA71a7dSXm1CJJuGrxX_dio54iu1f-7ERiJwy3ZO3YszdEWfvcXTT0&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPI3-yf3xq5qHbFmf924oy1RTwvXgEcNvLxsNYM_q1Atrn_WtWcYV54oOsjpv8ia3dQ0QxNgE8FRdVoe77QFMJA71a7dSXm1CJJuGrxX_dio54iu1f-7ERiJwy3ZO3YszdEWfvcXTT0%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control
no-cache, private
content-type
text/html
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfca081f00001782c6281000000001
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 509C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEMN5yPTtnG1bfsPeSWMMMkk&google_push=AYg5qPKX4nDpMEnpM3QB6SbGkDxiGjTV1zItsugqrEe4CjVP_rSpZGqqWb...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEMN5yPTtnG1bfsPeSWMMMkk&google_push=AYg5qPKX4nDpMEnpM3QB6SbGkDxiGjTV1zItsugqrEe4CjVP_rSpZGqqWbeaXD3pRUI7-Rvtc3ElJsVsxspzBMfQFhD0ihNeT8HY83kkbbrrbUe9tgnOdfQZ3yMcHW3Evh-QHQk4iWLcIy4
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
via
1.1 varnish
server
Jetty(9.4.35.v20201120)
x-timer
S1624004162.624297,VS0,VE89
x-served-by
cache-fra19164-FRA
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEMN5yPTtnG1bfsPeSWMMMkk&google_push=AYg5qPKX4nDpMEnpM3QB6SbGkDxiGjTV1zItsugqrEe4CjVP_rSpZGqqWbeaXD3pRUI7-Rvtc3ElJsVsxspzBMfQFhD0ihNeT8HY83kkbbrrbUe9tgnOdfQZ3yMcHW3Evh-QHQk4iWLcIy4
cache-control
no-cache
accept-ranges
bytes
access-control-allow-origin
*
content-length
0
x-cache-hits
0
google
pix.impdesk.com/csync/ Frame 509C
0
0

pixel
cm.g.doubleclick.net/ Frame 509C
Redirect Chain
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEIlchgsYrcTYzQj9olwz2Hk&google_cver=1&google_push=AYg5qPI_-jXK1-wPEEW830Ykk_t_pzaGtRfMZCxHkXyOZrSFMnFIxHIp-mNRVkwo-uWVKeAneeYMD-RrcUyBHXt8p...
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEIlchgsYrcTYzQj9olwz2Hk&google_cver=1&google_push=AYg5qPI_-jXK1-wPEEW830Ykk_t_pzaGtRfMZCxHkXyOZrSFMnFIxHIp-mNRVkwo-uWVKeAneeYMD-RrcUyBHXt8p...
  • https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPI_-jXK1-wPEEW830Ykk_t_pzaGtRfMZCxHkXyOZrSFMnFIxHIp-mNRVkwo-uWVKeAneeYMD-RrcUyBHXt8pi51TX-M5RwCk8FDihu8N2MfoZBFXql-yMB0jIubWx8gr...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPI_-jXK1-wPEEW830Ykk_t_pzaGtRfMZCxHkXyOZrSFMnFIxHIp-mNRVkwo-uWVKeAneeYMD-RrcUyBHXt8pi51TX-M5RwCk8FDihu8N2MfoZBFXql-yMB0jIubWx8grYgmTMhdBC0&google_hm=93258c300a564f1ec05f1414
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 08:16:01 GMT
Server
nginx
Location
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPI_-jXK1-wPEEW830Ykk_t_pzaGtRfMZCxHkXyOZrSFMnFIxHIp-mNRVkwo-uWVKeAneeYMD-RrcUyBHXt8pi51TX-M5RwCk8FDihu8N2MfoZBFXql-yMB0jIubWx8grYgmTMhdBC0&google_hm=93258c300a564f1ec05f1414
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap6ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
0
dot.gif
s0.2mdn.net/ Frame 509C
43 B
173 B
Image
General
Full URL
https://s0.2mdn.net/dot.gif?google_gid=CAESEDw6mdVW_0v1zOD_FfheODc&google_cver=1&google_push=AYg5qPJTR1noB1qzYEmW7ntZVRQ2KfSSh_5_n50B9YwkR74O5GrSbVA-BwasM94Cty1LngK3UeCvVw-9DAOwgG05gzrxRu_I6A4eeFqxggRq6UDN0BNflYItFXw-NoJdZfnyLmqywt1wNQOF3A
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
x-content-type-options
nosniff
last-modified
Sun, 01 Feb 2009 08:00:00 GMT
server
sffe
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
expires
Sat, 19 Jun 2021 08:16:01 GMT
attr
cm.g.doubleclick.net/pixel/ Frame 509C
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KjJPGYuhuh5yVDAdllhD9m97zTW202_rnjyUZydBcfrwYy3LOXAeR3ogTOSzdygURizfP_dw
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame DBC2
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsszyjx0umaChIsoU_i1TfiJojWUIcxXhx6pGru74FeQoEN8dJSvM0fbczO5jkRy1XjPZH7P5X9Amfi5Iaa5soYz3DVz4NoQm9aZyBjrRc1PzKgjeZWiMLbHHEVFVrWqThqP8_kTruUf_Bu7fDgLGmxMHFhCnXg1YGVrcd9dddUAgbYuEIqCGByZi5f6yJ-8Tzf7m4UApExbsJimDbNDrgMPJATPB9SlgxGdZL_9-8PPZpYJsUlGf0orbRJI3ONHFxyNCfOUlWnCFKSSJlX_p7inCez94g&sai=AMfl-YSlDkw5OgRgIZiT-F9vbqSEhkvAcEAIGryVyZK3UFsDWcGvGmHucOXBbAqIJ900MHBk6_QmAG67kAGzTamB-71fedOvwwOSo3_Yu6ipkFF6u_Isg_rum3yqgVKWAkI2&sig=Cg0ArKJSzMuK0snPpep0EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:01 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:01 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame 4264
143 B
163 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Fri, 18 Jun 2021 07:51:12 GMT
server
safe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
1489
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame C149
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
83583
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
si
googleads.g.doubleclick.net/pagead/drt/ Frame BFAE
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
16 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:01 GMT
server
safe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Fri, 18-Jun-2021 09:16:01 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Fri, 18 Jun 2021 08:16:01 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:01 GMT
server
safe
content-length
246
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
s
googleads.g.doubleclick.net/pagead/drt/ Frame D31A
143 B
163 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Fri, 18 Jun 2021 07:51:12 GMT
server
safe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
1489
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame F0F3
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
83583
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
pagead2.googlesyndication.com/bg/ Frame CC83
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.28008160708847485
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
450cd8f0848a395dd1c0e329fe4f5444e58cfd576162312a30d74a095d7135f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 20:50:36 GMT
content-encoding
br
x-content-type-options
nosniff
age
41125
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5759
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 17 Jun 2022 20:50:36 GMT
css
fonts.googleapis.com/ Frame ABAF
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 07:16:29 GMT
server
ESF
date
Fri, 18 Jun 2021 08:16:01 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 08:16:01 GMT
truncated
/ Frame C969
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ce203da19c0c708a9d171a7e1ed6322560b8acb38865be983d2ccae870f3b2f6

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame E57A
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0f761fbc9d3fdb285d091360f18753c768700870cb21476d517e7006e2176c78

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame ABAF
1 KB
909 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:13:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
160
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:13:21 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame ABAF
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:46 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame ABAF
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
118
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:03 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame ABAF
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:01 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame ABAF
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:11:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
280
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:11:21 GMT
l
www.google.com/ads/measurement/ Frame ABAF
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ8CIci2JgDGLSymx3S9d3Z7NVfHXtUi6_uhWrenYjjQKXgbaTQpxAuDR7r02b3110FZdJNlA5U4V5h0FayuSh5xNyVfg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

37c44ba5c7c2e56e86b2dceff03da5e6.js
www.gstatic.com/mysidia/ Frame ABAF
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/37c44ba5c7c2e56e86b2dceff03da5e6.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
754e4f25470d9263afc25125dce868bae633ea3d59f1b7dc8a0e740292fa68a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 13:27:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
154135
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10651
x-xss-protection
0
last-modified
Thu, 10 Jun 2021 06:35:23 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Tue, 14 Sep 2021 13:27:06 GMT
css
fonts.googleapis.com/ Frame 9D37
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 07:30:47 GMT
server
ESF
date
Fri, 18 Jun 2021 08:16:01 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 08:16:01 GMT
11326381978402965348
tpc.googlesyndication.com/daca_images/simgad/ Frame DD6A
98 KB
98 KB
Image
General
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/11326381978402965348
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7f8e23303ba343ec125b4b0b385fc6faf1bf25756596647b0b0658d8d54d35b1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 05:57:24 GMT
x-content-type-options
nosniff
age
526717
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100548
x-xss-protection
0
last-modified
Wed, 21 Apr 2021 05:56:44 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 05:57:24 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame DD6A
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:46 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame DD6A
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
118
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:03 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame DD6A
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:01 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame DD6A
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:11:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
280
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:11:21 GMT
l
www.google.com/ads/measurement/ Frame DD6A
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTq68tN7EwAjZAXWvSzJdygF8Zc3Hd-JyJq6ndlZL1MywQAFoB09QR-34VGqxS0yEJWgo6luZFc2zt0AjiESphI3HR7nw
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

one_click_handler_one_afma_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame DD6A
25 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/one_click_handler_one_afma_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7a783598f3cc86a4d73a813cedd5f6cbdf85ab7b95c4d40944a30c833071aa18
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 21:37:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
38315
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10657
x-xss-protection
0
server
cafe
etag
7233769875026612745
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 01 Jul 2021 21:37:26 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 9D37
1 KB
909 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:13:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
160
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:13:21 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 9D37
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:46 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 9D37
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
118
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:03 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 9D37
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:01 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 9D37
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:11:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
280
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:11:21 GMT
l
www.google.com/ads/measurement/ Frame 9D37
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTIUvLgFJ-jgzTRyrva1BTk3Td73eWmhkBGDKGdbqMwHLpq5xsC4CRAYkwC6ii1Eq08AYPusDJXO1dguNiUyDUIhdTl0A
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

37c44ba5c7c2e56e86b2dceff03da5e6.js
www.gstatic.com/mysidia/ Frame 9D37
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/37c44ba5c7c2e56e86b2dceff03da5e6.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
754e4f25470d9263afc25125dce868bae633ea3d59f1b7dc8a0e740292fa68a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 13:27:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
154135
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10651
x-xss-protection
0
last-modified
Thu, 10 Jun 2021 06:35:23 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Tue, 14 Sep 2021 13:27:06 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/7858866382639373275/ Frame 9D37
26 KB
26 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/7858866382639373275/downsize_200k_v1?w=300&h=300
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3edc07e9053e5f74fe42260ea0806366e67dd743ba43370afe0b1a21c3061978
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 11:30:48 GMT
x-content-type-options
nosniff
age
506713
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26713
x-xss-protection
0
last-modified
Tue, 19 Jan 2021 14:01:21 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 11:30:48 GMT
css
fonts.googleapis.com/ Frame 27FA
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 07:32:33 GMT
server
ESF
date
Fri, 18 Jun 2021 08:16:01 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 08:16:01 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame A153
143 B
163 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo; DSID=NO_DATA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Fri, 18 Jun 2021 07:51:12 GMT
server
safe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
1489
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame AF45
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
83583
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
css
fonts.googleapis.com/ Frame 160A
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 07:27:12 GMT
server
ESF
date
Fri, 18 Jun 2021 08:16:01 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 08:16:01 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 27FA
1 KB
909 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:13:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
160
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:13:21 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 27FA
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:46 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 27FA
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
118
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:03 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 27FA
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:01 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 27FA
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:11:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
280
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:11:21 GMT
l
www.google.com/ads/measurement/ Frame 27FA
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSAJltHR296gUCyiIIbjT9WsJZ_5YOuie1QJo5L-YBnHXyDHPk4DTvAQJtYJHX1-muTwFJilq5YOaeAqKmisejQACUolA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

37c44ba5c7c2e56e86b2dceff03da5e6.js
www.gstatic.com/mysidia/ Frame 27FA
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/37c44ba5c7c2e56e86b2dceff03da5e6.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
754e4f25470d9263afc25125dce868bae633ea3d59f1b7dc8a0e740292fa68a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 13:27:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
154135
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10651
x-xss-protection
0
last-modified
Thu, 10 Jun 2021 06:35:23 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Tue, 14 Sep 2021 13:27:06 GMT
truncated
/ Frame ABAF
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
23cf1643d982de3721e3d4b067ade5a4cc81c505a18e093aa659ceaba955dab3

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
s
googleads.g.doubleclick.net/pagead/drt/ Frame 2077
143 B
163 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo; DSID=NO_DATA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Fri, 18 Jun 2021 07:51:12 GMT
server
safe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
1489
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 5E5E
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
83583
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 160A
1 KB
909 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:13:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
160
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:13:21 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 160A
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:46 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 160A
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
118
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:14:03 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 160A
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:01 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 08:16:01 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 160A
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:11:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
280
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 08:11:21 GMT
37c44ba5c7c2e56e86b2dceff03da5e6.js
www.gstatic.com/mysidia/ Frame 160A
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/37c44ba5c7c2e56e86b2dceff03da5e6.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
754e4f25470d9263afc25125dce868bae633ea3d59f1b7dc8a0e740292fa68a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 13:27:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
154135
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10651
x-xss-protection
0
last-modified
Thu, 10 Jun 2021 06:35:23 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Tue, 14 Sep 2021 13:27:06 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame 42C6
143 B
163 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUmManO3MsmSKARTM59c2xKult64skFCIHjUblEN_2beuLxqU4hCkSXbnL_tcHo; DSID=NO_DATA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Fri, 18 Jun 2021 07:51:12 GMT
server
safe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
1489
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 515B
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
83583
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame ABAF
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
520517
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame ABAF
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
509253
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame E57A
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
520517
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame E57A
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
509253
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
truncated
/ Frame DD6A
210 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a84ce178c035768568b9fb0dfb9d1e8b714c072fe13305f4cbfb65d758e1eece

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 9D37
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1bb9bb9566e36644cd95419dd6a743093731496524740525223f62c8d967e70a

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
i.match
s.tribalfusion.com/z/ Frame C149
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPLdF8chLGuxSxKhNjn34_ZXEFFb5BzGXdxvbyNYhSu6M-lmgXNWyxkXTENnVLw9EpnMykipY8a5cQMR5aDQOTMvLhey3Iv83...
  • https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPLdF8chLGuxSxKhNjn34_ZXEFFb5BzGXdxvbyNYhSu6M-lmgXNWyxkXTENnVLw9EpnMykipY8a5cQMR5aDQOTMvLhey3Iv...
43 B
750 B
Image
General
Full URL
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPLdF8chLGuxSxKhNjn34_ZXEFFb5BzGXdxvbyNYhSu6M-lmgXNWyxkXTENnVLw9EpnMykipY8a5cQMR5aDQOTMvLhey3Iv83NHqgBG9d17Zpx57KBzwKqGhusoM_5ArRHbkTmDqMQ&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPLdF8chLGuxSxKhNjn34_ZXEFFb5BzGXdxvbyNYhSu6M-lmgXNWyxkXTENnVLw9EpnMykipY8a5cQMR5aDQOTMvLhey3Iv83NHqgBG9d17Zpx57KBzwKqGhusoM_5ArRHbkTmDqMQ%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
661312beaf86177a-FRA
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
content-type
image/gif; charset=utf-8
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
43
cf-request-id
0abfca0b290000177a16ac9000000001
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
cf-cache-status
DYNAMIC
x-function
206
server
cloudflare
x-reuse-index
89
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
661312bce8041782-FRA
p3p
CP="NOI DEVo TAIa OUR BUS"
location
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPLdF8chLGuxSxKhNjn34_ZXEFFb5BzGXdxvbyNYhSu6M-lmgXNWyxkXTENnVLw9EpnMykipY8a5cQMR5aDQOTMvLhey3Iv83NHqgBG9d17Zpx57KBzwKqGhusoM_5ArRHbkTmDqMQ&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPLdF8chLGuxSxKhNjn34_ZXEFFb5BzGXdxvbyNYhSu6M-lmgXNWyxkXTENnVLw9EpnMykipY8a5cQMR5aDQOTMvLhey3Iv83NHqgBG9d17Zpx57KBzwKqGhusoM_5ArRHbkTmDqMQ%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control
no-cache, private
content-type
text/html
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abfca0a1500001782b5335000000001
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame C149
Redirect Chain
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEF4GIZUvGuaqhdaf0e0J85g&google_cver=1&google_push=AYg5qPIqd_oLapWUD81m40sN73aHmuyAhmzbJoW7tyGX2dAfKAaq8Ns9QUkP2tZtvmP4YI0zTNNl4L1jGCq...
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIqd_oLapWUD81m40sN73aHmuyAhmzbJoW7tyGX2dAfKAaq8Ns9QUkP2tZtvmP4YI0zTNNl4L1jGCqI3C77DDVmkJOlMoVilEU1010H89BsUZGFSHdRYQ6R8BNgQ8x...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIqd_oLapWUD81m40sN73aHmuyAhmzbJoW7tyGX2dAfKAaq8Ns9QUkP2tZtvmP4YI0zTNNl4L1jGCqI3C77DDVmkJOlMoVilEU1010H89BsUZGFSHdRYQ6R8BNgQ8xeOEWRhQsiaw&google_hm=MbVItVZnQrOkvQ7PaW0ZE44
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
via
1.1 google
server
Apache-Coyote/1.1
status
302
p3p
CP="NOI DSP COR NID CUR OUR NOR"
location
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIqd_oLapWUD81m40sN73aHmuyAhmzbJoW7tyGX2dAfKAaq8Ns9QUkP2tZtvmP4YI0zTNNl4L1jGCqI3C77DDVmkJOlMoVilEU1010H89BsUZGFSHdRYQ6R8BNgQ8xeOEWRhQsiaw&google_hm=MbVItVZnQrOkvQ7PaW0ZE44
cache-control
no-cache, must-revalidate
content-type
text/html;charset=UTF-8
alt-svc
clear
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
dot.gif
s0.2mdn.net/ Frame C149
43 B
122 B
Image
General
Full URL
https://s0.2mdn.net/dot.gif?google_gid=CAESEFEWic1FAvZuWlDBfkQNX8g&google_cver=1&google_push=AYg5qPLZxRFVbd36sZbFK1nMGc_0jM2yJAnfdeZ9vcUOTp10mzwBilYIsR7z73wuoVw5PYeEmT_kUwKAr2Xu6SEQi-VScaFW4qRFOtSstr-NaBmCwCM9dCJYU8nd_yeu9o_HioQZxyJrQFA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:02 GMT
x-content-type-options
nosniff
last-modified
Sun, 01 Feb 2009 08:00:00 GMT
server
sffe
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
expires
Sat, 19 Jun 2021 08:16:02 GMT
pixel
cm.g.doubleclick.net/ Frame C149
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&googl...
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_push=AY...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl...
0
0

pixel
cm.g.doubleclick.net/ Frame C149
Redirect Chain
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEIlchgsYrcTYzQj9olwz2Hk&google_cver=1&google_push=AYg5qPIhBYIZU5aHkg8TCYdiGiAjutdqacZC2Eahzwhjy8lN4KwFifnXnmSV0_Rwi73DKy1oaWmmMX2SVrlyCRtr7...
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEIlchgsYrcTYzQj9olwz2Hk&google_cver=1&google_push=AYg5qPIhBYIZU5aHkg8TCYdiGiAjutdqacZC2Eahzwhjy8lN4KwFifnXnmSV0_Rwi73DKy1oaWmmMX2SVrlyCRtr7...
  • https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIhBYIZU5aHkg8TCYdiGiAjutdqacZC2Eahzwhjy8lN4KwFifnXnmSV0_Rwi73DKy1oaWmmMX2SVrlyCRtr7aCJpgnCg2dKIIoh-yZTiEASjqM3MiyE-CCuXsiK6y8lv...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIhBYIZU5aHkg8TCYdiGiAjutdqacZC2Eahzwhjy8lN4KwFifnXnmSV0_Rwi73DKy1oaWmmMX2SVrlyCRtr7aCJpgnCg2dKIIoh-yZTiEASjqM3MiyE-CCuXsiK6y8lveS6tdZPRBU&google_hm=f7f3b239a35b3db6df5213bf
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 08:16:02 GMT
Server
nginx
Location
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIhBYIZU5aHkg8TCYdiGiAjutdqacZC2Eahzwhjy8lN4KwFifnXnmSV0_Rwi73DKy1oaWmmMX2SVrlyCRtr7aCJpgnCg2dKIIoh-yZTiEASjqM3MiyE-CCuXsiK6y8lveS6tdZPRBU&google_hm=f7f3b239a35b3db6df5213bf
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap6ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
0
pixel
cm.g.doubleclick.net/ Frame C149
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJTQVBQZ11dzDqIDKDp6WCU&google_cver=1&google_push=AYg5qPLqW_yWUqLQ7IfffyPfwzdLXOhZUjeWUE8lGv5ozXfvQmcJtQNBp8wgBTrk_5mJ4Gic62...
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJTQVBQZ11dzDqIDKDp6WCU&google_cver=1&google_push=AYg5qPLqW_yWUqLQ7IfffyPfwzdLXOhZUjeWUE8lGv5ozXfvQmcJtQNBp8wgBTrk_5mJ4Gic62...
  • https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1xS0MyNlpoRTJ1RndBM2xCLjVFY1NJNHA2cjlqeVJhLn5B&google_push=AYg5qPLqW_yWUqLQ7IfffyPfwzdLXOhZUjeWUE8lGv5ozXfvQmcJtQNBp...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1xS0MyNlpoRTJ1RndBM2xCLjVFY1NJNHA2cjlqeVJhLn5B&google_push=AYg5qPLqW_yWUqLQ7IfffyPfwzdLXOhZUjeWUE8lGv5ozXfvQmcJtQNBp8wgBTrk_5mJ4Gic62nk7uf6qB8tFBBkvo2QzajGK0UNFGSZCyCLw8Ve3AFp1FZqte_maBJ7fQ-RIWioJTAw8hc_
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 08:16:02 GMT
Server
ATS/7.1.2.128
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1xS0MyNlpoRTJ1RndBM2xCLjVFY1NJNHA2cjlqeVJhLn5B&google_push=AYg5qPLqW_yWUqLQ7IfffyPfwzdLXOhZUjeWUE8lGv5ozXfvQmcJtQNBp8wgBTrk_5mJ4Gic62nk7uf6qB8tFBBkvo2QzajGK0UNFGSZCyCLw8Ve3AFp1FZqte_maBJ7fQ-RIWioJTAw8hc_
Connection
keep-alive
Content-Length
0
dot.gif
s0.2mdn.net/ Frame C149
43 B
99 B
Image
General
Full URL
https://s0.2mdn.net/dot.gif?google_gid=CAESEDw6mdVW_0v1zOD_FfheODc&google_cver=1&google_push=AYg5qPLOZwvfeTRLYbqIlQ6mvI3KIum6SPfefKCXTCW9wCWZnj0wve6VJKofzrFQloFpXRJr8r68n4iIi2jhYJ6vhUjLMs4L4ZFtNKnRqJH7D4-uGTDr4sWMJZiqgot8MuBlWuv8M_ZTeG9C
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:02 GMT
x-content-type-options
nosniff
last-modified
Sun, 01 Feb 2009 08:00:00 GMT
server
sffe
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
expires
Sat, 19 Jun 2021 08:16:02 GMT
attr
cm.g.doubleclick.net/pixel/ Frame C149
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LaQP_Fhn_59UFfbb735CbDrX8DAuLV5FXC0MC02sZRKLA2n_ng_jx_fVaHbFQzKAowBCTj_f4
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame 9C24
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsugV7iIZS1pQlckhysJPEmNdvKtv8p4PaeIe_J-1htthYCXkcY5FEkFq9z0BlMB06sNAjCq0YEGaj262FJAFzfmaN5jbHIcQUHoMQPUjaY4HF1VWRUjtKub02HstuVko2tCa1KcLHkibd98kNLWqQp_I4OjV003-cqqlrtiD6ovwOtBAzB1JxGFmFUT_QdQzdhFFmwg6mlssJdQzzLqvaBuN3fI9F7JGP1JDESVrZVEr6T-bWmhCqudmXrIB7S7Q90ZT6bCIV2OyAgvWnlq7YqZUF6K2AdhP52z&sai=AMfl-YShb-aRxw7jpSFUiYrxpz7OhFn_VpnMHeVKDILgEk9cRRv2h3aecD-QiPTfFtW2kNPRVDOsfL0MTX-PYOoIG6fHUmYIIjBTOUufW17RQk8JG3V6AzCjKiH3CjyuP17-&sig=Cg0ArKJSzFINzezpaO0_EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:02 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:02 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame 7CC7
143 B
226 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Fri, 18 Jun 2021 07:47:15 GMT
server
safe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
1727
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame A77C
1 KB
864 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
83584
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 27FA
207 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b22efff4a0a770a4c43beb7851bffea88a6fb1ca44e743649d5027804c908319

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
pixel
cm.g.doubleclick.net/ Frame F0F3
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESENwY52Qky20EJeOfjhsz_po&google_cver=1&google_push=AYg5qPIbK2FwyvMAaACUVVR3m6l3akesB63k52TMw_8iPX26lKhWMolA_bXRaWkmnQAszmU8PCN8i9tTcDlBfVhy...
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIbK2FwyvMAaACUVVR3m6l3akesB63k52TMw_8iPX26lKhWMolA_bXRaWkmnQAszmU8PCN8i9tTcDlBfVhypSYMFanPPI4
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIbK2FwyvMAaACUVVR3m6l3akesB63k52TMw_8iPX26lKhWMolA_bXRaWkmnQAszmU8PCN8i9tTcDlBfVhypSYMFanPPI4
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 08:16:02 GMT
Server
MT3 3759 5f8f15b master zrh-pixel-x12
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIbK2FwyvMAaACUVVR3m6l3akesB63k52TMw_8iPX26lKhWMolA_bXRaWkmnQAszmU8PCN8i9tTcDlBfVhypSYMFanPPI4
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Fri, 18 Jun 2021 08:16:01 GMT
i.match
a.tribalfusion.com/ Frame F0F3
43 B
423 B
Image
General
Full URL
https://a.tribalfusion.com/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPIYZDsAL7KNbcnfNpVqQPZTXJCdR5aQkTdbUlyuESNL6pOjijouPGCMQmABn0cCYQyTlHlxGMnMkHxZqC0wrtaRgsTg6ok&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPIYZDsAL7KNbcnfNpVqQPZTXJCdR5aQkTdbUlyuESNL6pOjijouPGCMQmABn0cCYQyTlHlxGMnMkHxZqC0wrtaRgsTg6ok%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
661312bd58f11782-FRA
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
content-type
image/gif; charset=utf-8
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
43
cf-request-id
0abfca0a5e00001782be9a1000000001
expires
Thu, 01 Jan 1970 00:00:00 GMT
google
match.adsrvr.org/track/cmf/ Frame F0F3
70 B
265 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/google?google_gid=CAESEBPXAO3JCPxWzslmEJ94V30&google_cver=1&google_push=AYg5qPL0kDVzWkyEW2Gz4HgC5tsNPuhmEcOSb2wbjMwSGL4Spld2TZlwuNKeZqtSS3pPkMKIr4pzdA78VO_9mGEQnj0G38E4kzQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a97adde81b00f2ca4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
match
um.wbtrk.net/doubleclick/user/ Frame F0F3
0
0

pixel
cm.g.doubleclick.net/ Frame F0F3
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDa-SzPKneQ6yKMq_DOsz8Y&google_cver=1&google_push=AYg5qPLdAGIe1JUf4zdmeaDQrAf92AqRwGX58Z1ofAOvuo9yL7l5zJdo3ARfpRcxtkjivUdCfcL...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVCQUwtMUEtMTgxMg==&google_push=AYg5qPLdAGIe1JUf4zdmeaDQrAf92AqRwGX58Z1ofAOvuo9yL7l5zJdo3ARfpRcxtkjivUdCfcLOTX3vM92i1GtWF8x3iOuKzMw
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVCQUwtMUEtMTgxMg==&google_push=AYg5qPLdAGIe1JUf4zdmeaDQrAf92AqRwGX58Z1ofAOvuo9yL7l5zJdo3ARfpRcxtkjivUdCfcLOTX3vM92i1GtWF8x3iOuKzMw
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVCQUwtMUEtMTgxMg==&google_push=AYg5qPLdAGIe1JUf4zdmeaDQrAf92AqRwGX58Z1ofAOvuo9yL7l5zJdo3ARfpRcxtkjivUdCfcLOTX3vM92i1GtWF8x3iOuKzMw
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
66ef90d06496cfd000aab8206f2b6221
Expires
0
pixel
cm.g.doubleclick.net/ Frame F0F3
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONu...
0
0

pixel
cm.g.doubleclick.net/ Frame F0F3
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJTQVBQZ11dzDqIDKDp6WCU&google_cver=1&google_push=AYg5qPIc187KvSq3ANxCMQEYGK3Q1-IYxALRXv7EcyRfbTD2eQ4hrgPX_f6WAM85wjl0jkQjd0...
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJTQVBQZ11dzDqIDKDp6WCU&google_cver=1&google_push=AYg5qPIc187KvSq3ANxCMQEYGK3Q1-IYxALRXv7EcyRfbTD2eQ4hrgPX_f6WAM85wjl0jkQjd0...
  • https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1xS0MyNlpoRTJ1RndBM2xCLjVFY1NJNHA2cjlqeVJhLn5B&google_push=AYg5qPIc187KvSq3ANxCMQEYGK3Q1-IYxALRXv7EcyRfbTD2eQ4hrgPX_...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1xS0MyNlpoRTJ1RndBM2xCLjVFY1NJNHA2cjlqeVJhLn5B&google_push=AYg5qPIc187KvSq3ANxCMQEYGK3Q1-IYxALRXv7EcyRfbTD2eQ4hrgPX_f6WAM85wjl0jkQjd03WaYdsxADZiQylENCHb-KY3Gv7
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 08:16:02 GMT
Server
ATS/7.1.2.128
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1xS0MyNlpoRTJ1RndBM2xCLjVFY1NJNHA2cjlqeVJhLn5B&google_push=AYg5qPIc187KvSq3ANxCMQEYGK3Q1-IYxALRXv7EcyRfbTD2eQ4hrgPX_f6WAM85wjl0jkQjd03WaYdsxADZiQylENCHb-KY3Gv7
Connection
keep-alive
Content-Length
0
attr
cm.g.doubleclick.net/pixel/ Frame F0F3
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IyeMvShGcGN0FGfmw5VWESYXpi1i1iDt3Qk6EiWHgCDf6_IkEx5tZjn1Dy38TtfSW3tK8hNA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame DE15
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssFr53wrLJdrlX5cILrLmX2HVz6tTyVBUBusXrMC2z2YiH1eGxxsEqgM4VR_hb6efebBvq5ybpVMOeNZDnQElMRXeklR6ZwfnOxHs_a0NJwixDQp6bR0JIwXgFnCwznujnSXchAhj1k9PXeAuiQjirIledi_bYKq8t0459zDQRjRmy67R9GdZDokZPPLUqxlIy-WfxiS3JHcW7IkH7Sp7PNocSksCdKJoe8UT6TI1vF0llhiTLizp6fNejPYpE1VAKyhUXcy27p2FHwCuPrKNIXVRNiNw&sai=AMfl-YQbr8dFhyDdYdMJoCbwHquMAceOy92EJm0aXgD4m356TQv6SPpdkCOOsRKgy4CbN7t-tp4AkVXPqbDoC11B1nW2KT1CDgSxEY8Tje_eVGXnRnYV2mAd6APy5NKtNcXT&sig=Cg0ArKJSzL4yRrQ_8Bz9EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:02 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:02 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame F6A0
143 B
163 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Fri, 18 Jun 2021 07:51:12 GMT
server
safe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
1490
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 4C39
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
83584
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 160A
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ca74132e6cf69c727fa56ec6af4a7552c16faf39ba84797f376829dc704bca2a

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
si
googleads.g.doubleclick.net/pagead/drt/ Frame 4264
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
16 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si?st=NO_DATA
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:02 GMT
server
safe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Fri, 18-Jun-2021 09:16:02 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:02 GMT
server
safe
content-length
257
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
pagead2.googlesyndication.com/bg/ Frame EE14
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5480773734719757
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
450cd8f0848a395dd1c0e329fe4f5444e58cfd576162312a30d74a095d7135f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 20:50:36 GMT
content-encoding
br
x-content-type-options
nosniff
age
41126
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5759
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 17 Jun 2022 20:50:36 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame D31A
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
16 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:02 GMT
server
safe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Fri, 18-Jun-2021 09:16:02 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:02 GMT
server
safe
content-length
246
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
pagead2.googlesyndication.com/bg/ Frame 92FB
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.040260101349480326
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
450cd8f0848a395dd1c0e329fe4f5444e58cfd576162312a30d74a095d7135f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 20:50:36 GMT
content-encoding
br
x-content-type-options
nosniff
age
41126
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5759
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 17 Jun 2022 20:50:36 GMT
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 160A
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
520518
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 160A
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
509254
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 9D37
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
520518
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 9D37
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
509254
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
dpixel
cms.quantserve.com/ Frame AF45
35 B
463 B
Image
General
Full URL
https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESED16djXEDmtnj-qPyy2yGTg&google_cver=1&google_push=AYg5qPJX93BqP943xPbq2rbaI75h2isp7FXrOkNahAziDGJLC4V9uGacgDJcdkOPPTPkMwLXip9U1i2jGqfhgxdmSMm_VlPuWLw
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
pixelSync
pixel-sync.sitescout.com/dmp/ Frame AF45
0
191 B
Image
General
Full URL
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEJapf5Ol4smrNzhcOAIeNUU&google_cver=1&google_push=AYg5qPLXSCytIaIT1dasNVnMnMJv8lQmCgQF8-jc0Y_QPZ_WpOAnJcihWuLnpfOtCkCrI_agz2fXfPRbnlLephx7v0sS-VH4qQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
66.155.71.149 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
cache-control
max-age=0,no-cache,no-store
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires
Tue, 11 Oct 1977 12:34:56 GMT
pixel
cm.g.doubleclick.net/ Frame AF45
Redirect Chain
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEF4GIZUvGuaqhdaf0e0J85g&google_cver=1&google_push=AYg5qPLXVqRRFycv4f9Bje0TOOj3niVFnMYQlQvK37P-qQ9kQ_zzzk2k5HQkqOyvPZFbT7CKVCZR28_PawF...
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPLXVqRRFycv4f9Bje0TOOj3niVFnMYQlQvK37P-qQ9kQ_zzzk2k5HQkqOyvPZFbT7CKVCZR28_PawFfeKict8E1BeY_9rw&google_hm=MbVItVZnQrOkvQ7PaW0ZE44
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPLXVqRRFycv4f9Bje0TOOj3niVFnMYQlQvK37P-qQ9kQ_zzzk2k5HQkqOyvPZFbT7CKVCZR28_PawFfeKict8E1BeY_9rw&google_hm=MbVItVZnQrOkvQ7PaW0ZE44
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
via
1.1 google
server
Apache-Coyote/1.1
status
302
p3p
CP="NOI DSP COR NID CUR OUR NOR"
location
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPLXVqRRFycv4f9Bje0TOOj3niVFnMYQlQvK37P-qQ9kQ_zzzk2k5HQkqOyvPZFbT7CKVCZR28_PawFfeKict8E1BeY_9rw&google_hm=MbVItVZnQrOkvQ7PaW0ZE44
cache-control
no-cache, must-revalidate
content-type
text/html;charset=UTF-8
alt-svc
clear
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame AF45
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEMo086IeiljYESIbGtu7hCI&google_cver=1&google_push=AYg5qPI2rWWzxDmtoMUb_yc6h6BXi5SVvRoCDmamnoEAchZl60hAxZt8A--TqfFP2-x8AH2LmDKte8JnlGt2otrhFT2Q...
  • https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEMo086IeiljYESIbGtu7hCI&google_cver=1&google_push=AYg5qPI2rWWzxDmtoMUb_yc6h6BXi5SVvRoCDmamnoEAchZl60hAxZt8A--TqfFP2-x8AH2LmDKte8JnlGt2ot...
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=google
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=2159827871749741986&expires=30&ssp=google
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPI2rWWzxDmtoMUb_yc6h6BXi5SVvRoCDmamnoEAchZl60hAxZt8A--TqfFP2-x8AH2LmDKte8JnlGt2otrhFT2QviPBmPE&google_hm=Ca-Auw5ESbaZmgIe0IgKbA==
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPI2rWWzxDmtoMUb_yc6h6BXi5SVvRoCDmamnoEAchZl60hAxZt8A--TqfFP2-x8AH2LmDKte8JnlGt2otrhFT2QviPBmPE&google_hm=Ca-Auw5ESbaZmgIe0IgKbA==
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
//cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPI2rWWzxDmtoMUb_yc6h6BXi5SVvRoCDmamnoEAchZl60hAxZt8A--TqfFP2-x8AH2LmDKte8JnlGt2otrhFT2QviPBmPE&google_hm=Ca-Auw5ESbaZmgIe0IgKbA==
date
Fri, 18 Jun 2021 08:16:03 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
pixel
cm.g.doubleclick.net/ Frame AF45
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECDHcZU6r37gbQIA91KFDtc&google_cver=1&google_push=AYg5qPI44DR7cfDvIJKqeU7AxMDm8lpkriUnWnHI0LxC_Ep8W2MiMndm6DLHSqX86rVefJjEQMRR4wANxQV0ZrgA_fgaBwc...
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPI44DR7cfDvIJKqeU7AxMDm8lpkriUnWnHI0LxC_Ep8W2MiMndm6DLHSqX86rVefJjEQMRR4wANxQV0ZrgA_fgaBwcFEj4&google_hm=NzE5OTgxMzk1NDMzNzE0OTM...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPI44DR7cfDvIJKqeU7AxMDm8lpkriUnWnHI0LxC_Ep8W2MiMndm6DLHSqX86rVefJjEQMRR4wANxQV0ZrgA_fgaBwcFEj4&google_hm=NzE5OTgxMzk1NDMzNzE0OTM4NQ%3D%3D
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 18 Jun 2021 08:16:02 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPI44DR7cfDvIJKqeU7AxMDm8lpkriUnWnHI0LxC_Ep8W2MiMndm6DLHSqX86rVefJjEQMRR4wANxQV0ZrgA_fgaBwcFEj4&google_hm=NzE5OTgxMzk1NDMzNzE0OTM4NQ%3D%3D
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame AF45
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESENrBjr9dqI0kLIkkp_Ih20M&google_cver=1&google_push=AYg5qPI-dq6Mqb7SdP70x8nx9kO8R-MnNw807_WAMjR2AZ_fqmxU2HlWFU7OqCtLi5puuJS-Zxz_y-0Gqtg_MKAvhwp6aow1lA
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPI-dq6Mqb7SdP70x8nx9kO8R-MnNw807_WAMjR2AZ_fqmxU2HlWFU7OqCtLi5puuJS-Zxz_y-0Gqtg_MKAvhwp6aow1lA&google...
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NTI5NTEwMzM3MDM2NDQxMzAyNQ%3D%3D&google_push=AYg5qPI-dq6Mqb7SdP70x8nx9kO8R-MnNw807_WAMjR2AZ_fqmxU2HlWFU7O...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NTI5NTEwMzM3MDM2NDQxMzAyNQ%3D%3D&google_push=AYg5qPI-dq6Mqb7SdP70x8nx9kO8R-MnNw807_WAMjR2AZ_fqmxU2HlWFU7OqCtLi5puuJS-Zxz_y-0Gqtg_MKAvhwp6aow1lA
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NTI5NTEwMzM3MDM2NDQxMzAyNQ%3D%3D&google_push=AYg5qPI-dq6Mqb7SdP70x8nx9kO8R-MnNw807_WAMjR2AZ_fqmxU2HlWFU7OqCtLi5puuJS-Zxz_y-0Gqtg_MKAvhwp6aow1lA
date
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
pixel
cm.g.doubleclick.net/ Frame AF45
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEBRDS3qrRMmAFoKE_s6Wb10&google_cver=1&google_push=AYg5qPICQoO_sX2D5ormD1j3o2YzfVhuWu1PhItcYsJ2VQyQHU6Lj5Czgeheyt6P0AH8IRIHHQAjwx...
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPICQoO_sX2D5ormD1j3o2YzfVhuWu1PhItcYsJ2VQyQHU6Lj5Czgeheyt6P0AH8IRIHHQAjwxVnQdNFp3qSEWPV-VdX0KA&google_hm=NTM0MDE1Njk...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPICQoO_sX2D5ormD1j3o2YzfVhuWu1PhItcYsJ2VQyQHU6Lj5Czgeheyt6P0AH8IRIHHQAjwxVnQdNFp3qSEWPV-VdX0KA&google_hm=NTM0MDE1NjkwOTUzMDQ0MDE5
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPICQoO_sX2D5ormD1j3o2YzfVhuWu1PhItcYsJ2VQyQHU6Lj5Czgeheyt6P0AH8IRIHHQAjwxVnQdNFp3qSEWPV-VdX0KA&google_hm=NTM0MDE1NjkwOTUzMDQ0MDE5
date
Fri, 18 Jun 2021 08:16:01 GMT
content-length
0
attr
cm.g.doubleclick.net/pixel/ Frame AF45
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KOk3NLbA4Oegv3TWRx9VLKTA90KcVyw-m069_c2TTzSbBcSruMo5az-_WK7paktWIjXo3c
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame C0AD
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvtq813ZJPMjXx50cj5M_qit3YVi9PHmTLmTrFlKI1d_B67rkO93Njc7dQkzNWb8NENSckWW0ptJnZKpXOba5qMxyf-OIgCwPOeJz3PVShfWzW_-ZyviB4UGoaFxDz1AlA24trWWIWcbt8bGy48P_gopkiHq6mCIFMIpmCKNDeeuI1I5gtZchlx91erbF2wV4szP2EYZ6XZwGenjUgCxVUFahAjNn8y5NkdjSH56W1_WeVbSmDjKdaYzNspLSu306LF7vYjnqskiX8ilE_5XzzKzdUKuQ&sai=AMfl-YQEWdQqVdTwF0LqDNOQL9a4uqot0GANsFRzXdy380mfANm9leFHrHqxyaieC6FUtza8qmJKCeTuOpkAihiPgm71UC5oJaiUeBEgM9VoQFPsuUH0F4R9X8Wk8z8mMX8&sig=Cg0ArKJSzOCqz964jg_3EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:02 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:02 GMT
/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 5E5E
Redirect Chain
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESENG1Oa6YSiIl8PP_3h6xdaU&google_cver=1&google_push=AYg5qPL9Tx_RReg6KH3J6kQUD5EgDy-L6nEPWxtNU1Gd7oXGrSAgjzxuHBzwlTtLtTY7-fVtAoXwsYHKBUoYXFsq6PysIKpClmxg
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODQ2MzEyMTIzMjI4NzEwNjM5NQ==
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEFTkfxTOooSg7x5UA4Ic3D4&google_cver=1
43 B
407 B
Image
General
Full URL
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEFTkfxTOooSg7x5UA4Ic3D4&google_cver=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software
/
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type
image/gif
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEFTkfxTOooSg7x5UA4Ic3D4&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 5E5E
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEMN5yPTtnG1bfsPeSWMMMkk&google_push=AYg5qPKrMB9e-O7ZUtMOp6s-jKa3bd6Ktj2dlF5g1AkCbYOQsV-l8DCgM9...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEMN5yPTtnG1bfsPeSWMMMkk&google_push=AYg5qPKrMB9e-O7ZUtMOp6s-jKa3bd6Ktj2dlF5g1AkCbYOQsV-l8DCgM92xgJSHBa72pae1OeOd9goq4VYYFvkFaqGl8UmLdTZ5
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
via
1.1 varnish
server
Jetty(9.4.35.v20201120)
x-timer
S1624004162.444737,VS0,VE92
x-served-by
cache-fra19164-FRA
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEMN5yPTtnG1bfsPeSWMMMkk&google_push=AYg5qPKrMB9e-O7ZUtMOp6s-jKa3bd6Ktj2dlF5g1AkCbYOQsV-l8DCgM92xgJSHBa72pae1OeOd9goq4VYYFvkFaqGl8UmLdTZ5
cache-control
no-cache
accept-ranges
bytes
access-control-allow-origin
*
content-length
0
x-cache-hits
0
pixel
cm.g.doubleclick.net/ Frame 5E5E
Redirect Chain
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESECoDsiULCRA0nEddzXluu70&google_cver=1&google_push=AYg5qPJH-3RaOYlrF9msdWa12vImJ0jxrG7kN7sTfyE4aOqlHVnLSYCzLBPHh...
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESECoDsiULCRA0nEddzXluu70&google_cver=1&google_push=AYg5qPJH-3RaOYlrF9msdWa12vImJ0jxrG7kN7sTfyE4aOqlHVnLSYCzLBPHh...
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=rBMEGhGoTArOwhCIVaUxWA&google_push=AYg5qPJH-3RaOYlrF9msdWa12vImJ0jxrG7kN7sTfyE4aOqlHVnLSYCzLBPHhNc0oHAHQGUZxLsDRja3s...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=rBMEGhGoTArOwhCIVaUxWA&google_push=AYg5qPJH-3RaOYlrF9msdWa12vImJ0jxrG7kN7sTfyE4aOqlHVnLSYCzLBPHhNc0oHAHQGUZxLsDRja3sSN_hjocr2q5E-fX3lU-
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 08:16:02 GMT
Server
nginx
Vary
Accept
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=rBMEGhGoTArOwhCIVaUxWA&google_push=AYg5qPJH-3RaOYlrF9msdWa12vImJ0jxrG7kN7sTfyE4aOqlHVnLSYCzLBPHhNc0oHAHQGUZxLsDRja3sSN_hjocr2q5E-fX3lU-
Connection
close
Content-Type
text/plain; charset=utf-8
Content-Length
238
pixel
cm.g.doubleclick.net/ Frame 5E5E
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDa-SzPKneQ6yKMq_DOsz8Y&google_cver=1&google_push=AYg5qPIGHaElpjcrSyrlxrgYDdtDI2RvV_k0W1o8SupexFda0_gjiE8IAw0mhAuhir2zDlnbR6u...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVCSVEtMUEtN1hG&google_push=AYg5qPIGHaElpjcrSyrlxrgYDdtDI2RvV_k0W1o8SupexFda0_gjiE8IAw0mhAuhir2zDlnbR6uoSFePhevefVGH7eCEidHOJcZO
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVCSVEtMUEtN1hG&google_push=AYg5qPIGHaElpjcrSyrlxrgYDdtDI2RvV_k0W1o8SupexFda0_gjiE8IAw0mhAuhir2zDlnbR6uoSFePhevefVGH7eCEidHOJcZO
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVCSVEtMUEtN1hG&google_push=AYg5qPIGHaElpjcrSyrlxrgYDdtDI2RvV_k0W1o8SupexFda0_gjiE8IAw0mhAuhir2zDlnbR6uoSFePhevefVGH7eCEidHOJcZO
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
66ef90d06496cfd000aab8206f2b6221
Expires
0
pixel
cm.g.doubleclick.net/ Frame 5E5E
Redirect Chain
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEOhqQGO4KfqrATm_j5JINjY&google_cver=1&google_push=AYg5qPIgNlIpQqHLvqB2IZiQzdjCnezXYZbshdfVOCQUUUwEb9kJEP8o0k0BzL1wscqfXYae6n_XTDpd1zLdwAHf...
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPIgNlIpQqHLvqB2IZiQzdjCnezXYZbshdfVOCQUUUwEb9kJEP8o0k0BzL1wscqfXYae6n_XTDpd1zLdwAHfC3Y-v709AHk
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPIgNlIpQqHLvqB2IZiQzdjCnezXYZbshdfVOCQUUUwEb9kJEP8o0k0BzL1wscqfXYae6n_XTDpd1zLdwAHfC3Y-v709AHk
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 18 Jun 2021 08:16:02 GMT
via
1.1 f1944380c787841c28b16df91c1ec34e.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
VIE50-C1
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPIgNlIpQqHLvqB2IZiQzdjCnezXYZbshdfVOCQUUUwEb9kJEP8o0k0BzL1wscqfXYae6n_XTDpd1zLdwAHfC3Y-v709AHk
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
dEJIYTcbLHj9BUROQFcknftK4bxMbnSOiB7nSGNt9ppvfaVSbMoogA==
pixel
cm.g.doubleclick.net/ Frame 5E5E
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESENrBjr9dqI0kLIkkp_Ih20M&google_cver=1&google_push=AYg5qPISDww0w3EFpEyH7ICuL20lMW4RgtbmzoalbkSFoD3XvDQlTKXbVy2etyi_kOUFoWIjtnA74LGtUWhbbDV4zE-fhDncD3dC
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPISDww0w3EFpEyH7ICuL20lMW4RgtbmzoalbkSFoD3XvDQlTKXbVy2etyi_kOUFoWIjtnA74LGtUWhbbDV4zE-fhDncD3dC&goog...
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NTI5NTEwMzM3MDM2NDQxMzAyNQ%3D%3D&google_push=AYg5qPISDww0w3EFpEyH7ICuL20lMW4RgtbmzoalbkSFoD3XvDQlTKXbVy2e...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NTI5NTEwMzM3MDM2NDQxMzAyNQ%3D%3D&google_push=AYg5qPISDww0w3EFpEyH7ICuL20lMW4RgtbmzoalbkSFoD3XvDQlTKXbVy2etyi_kOUFoWIjtnA74LGtUWhbbDV4zE-fhDncD3dC
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NTI5NTEwMzM3MDM2NDQxMzAyNQ%3D%3D&google_push=AYg5qPISDww0w3EFpEyH7ICuL20lMW4RgtbmzoalbkSFoD3XvDQlTKXbVy2etyi_kOUFoWIjtnA74LGtUWhbbDV4zE-fhDncD3dC
date
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
pixel
cm.g.doubleclick.net/ Frame 5E5E
Redirect Chain
  • https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESED4R2aliifiM0_ib6UxrfvM&google_cver=1&google_push=AYg5qPLA-_Hx-vKhSvpnsc63wUWsf91wF_f-HJ0_ZKYQbbYq_qZ3ni6n...
  • https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESED4R2aliifiM0_ib6UxrfvM&google_cver=1&google_push=AYg5qPLA-_Hx-vKhSvpnsc63wUWsf91wF_f-HJ0_ZKYQbbYq_qZ3ni6n...
  • https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESED4R2aliifiM0_ib6UxrfvM&google_cver=1&google_push=AYg5qPLA-_Hx-vKhSvpnsc63wUWsf91wF_f-HJ0_ZKYQbbYq_qZ3ni...
  • https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA2YmI5MjU4NS1kMDBkLTExZWItYTkxZi0wMmNmNWMwNzY5NzY%3D&google_push=AYg5qPLA-_Hx-vKhSvpnsc63wUWsf91wF_f-HJ0_ZKYQbbYq_qZ3ni6n4HRa3bLknT...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA2YmI5MjU4NS1kMDBkLTExZWItYTkxZi0wMmNmNWMwNzY5NzY%3D&google_push=AYg5qPLA-_Hx-vKhSvpnsc63wUWsf91wF_f-HJ0_ZKYQbbYq_qZ3ni6n4HRa3bLknT-7sNIpMtR3N5QcH5t57r0wOL49tJvdtRHTbw
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 08:16:02 GMT
Server
ATS/7.1.2.128
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA2YmI5MjU4NS1kMDBkLTExZWItYTkxZi0wMmNmNWMwNzY5NzY%3D&google_push=AYg5qPLA-_Hx-vKhSvpnsc63wUWsf91wF_f-HJ0_ZKYQbbYq_qZ3ni6n4HRa3bLknT-7sNIpMtR3N5QcH5t57r0wOL49tJvdtRHTbw
Connection
keep-alive
Content-Length
0
attr
cm.g.doubleclick.net/pixel/ Frame 5E5E
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J0pXNT485oidJWhYjVrdonQV5egJdBj-kyNAnrIn8N098cVwLjRCBX6d3r9IguQihYwhe-WQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame 8A3B
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss3C9DhkLoQb9c4vwqyrFnhoH5PxcSvnET-jSlHi-O1MOiLwnk3C4cZF5IN02Uo0V3mAZnFfrG8DZug8UgTGKxTycjoWQuaImngQR0X3dY3Gro7NZaVHrNZv0XGRunikvceyl3imJ8TD7iyw4RzpmfkYm5oY70Ih5x44iXvqIGRnU7GQ91sr6BLCt10dafKRnh0AOZ-iSm0eHlu6HaWULNTR-U4lxvmhJHtplrEVq6Nm8-dwnDrylT4ALSOqG40yX8uZD6Ya63pjUlEmYZuR22bfZ5Kew&sai=AMfl-YQ3w8pd7l3fF9Wd81hNeHRc8M1JzeXw7EqbGl6Id6taPDX3pt88kkkkhrDs73NjJtoEFWmMNGzN9uXQFYxukSuq-h_4HfXNPsOdMVTwiOzEfh5U3RZenepph5G3uCQy&sig=Cg0ArKJSzOkoUKRX0ay_EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:02 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:02 GMT
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 27FA
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
520518
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 27FA
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
509254
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame A153
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
16 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:02 GMT
server
safe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Fri, 18-Jun-2021 09:16:02 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:02 GMT
server
safe
content-length
246
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
pagead2.googlesyndication.com/bg/ Frame A29D
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3175647194265494
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
450cd8f0848a395dd1c0e329fe4f5444e58cfd576162312a30d74a095d7135f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 20:50:36 GMT
content-encoding
br
x-content-type-options
nosniff
age
41126
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5759
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 17 Jun 2022 20:50:36 GMT
pixel
cm.g.doubleclick.net/ Frame 515B
Redirect Chain
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESED16djXEDmtnj-qPyy2yGTg&google_cver=1&google_push=AYg5qPJm8Drq0KDsv2DOCzsRcfU8wQwMacKR0IvXbPpg8ETQ8MQTiuQ2RS...
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJm8Drq0KDsv2DOCzsRcfU8wQwMacKR0IvXbPpg8ETQ8MQTiuQ2RSQ1U9CBrZ6LHm7uW976hCmZlV9FLwRW9Vtj4hJP82w&google_hm=bwgcKwy...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJm8Drq0KDsv2DOCzsRcfU8wQwMacKR0IvXbPpg8ETQ8MQTiuQ2RSQ1U9CBrZ6LHm7uW976hCmZlV9FLwRW9Vtj4hJP82w&google_hm=bwgcKwy_w_-gGEY5ZpImeA
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJm8Drq0KDsv2DOCzsRcfU8wQwMacKR0IvXbPpg8ETQ8MQTiuQ2RSQ1U9CBrZ6LHm7uW976hCmZlV9FLwRW9Vtj4hJP82w&google_hm=bwgcKwy_w_-gGEY5ZpImeA
pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
strict-transport-security
max-age=86400
expires
Fri, 04 Aug 1978 12:00:00 GMT
i.match
a.tribalfusion.com/ Frame 515B
43 B
713 B
Image
General
Full URL
https://a.tribalfusion.com/i.match?p=b6&u=CAESELZQl_m4Dnzdgce6BYy-6_0&google_cver=1&google_push=AYg5qPLof-z6VyHaCMs-Q4-XUGz1X8Xd337bSDG3M-dX-dHdKeWfjTNOTDgWS8MnucDdhv-oGCthqt_af9mRDqDqReP5HMKSFTM&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPLof-z6VyHaCMs-Q4-XUGz1X8Xd337bSDG3M-dX-dHdKeWfjTNOTDgWS8MnucDdhv-oGCthqt_af9mRDqDqReP5HMKSFTM%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
661312bf68ce177a-FRA
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
content-type
image/gif; charset=utf-8
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
43
cf-request-id
0abfca0ba00000177ae497d000000001
expires
Thu, 01 Jan 1970 00:00:00 GMT
match
um.wbtrk.net/doubleclick/user/ Frame 515B
0
0

pixel
cm.g.doubleclick.net/ Frame 515B
Redirect Chain
  • https://rtb.openx.net/sync/dds?google_gid=CAESECByOLzEsIUJ0HbACUr9Zxc&google_cver=1&google_push=AYg5qPI-fdDh7P3d6g32b4fqj-avdTymh1lEBuM9ct5XgPfS3BYGG58h4N3yv2k5G8JwBEKw96KXApgJ-FDnYj-DLaToZKN93Qs
  • https://rtb.openx.net/sync/dds?google_gid=CAESECByOLzEsIUJ0HbACUr9Zxc&google_cver=1&google_push=AYg5qPI-fdDh7P3d6g32b4fqj-avdTymh1lEBuM9ct5XgPfS3BYGG58h4N3yv2k5G8JwBEKw96KXApgJ-FDnYj-DLaToZKN93Qs&o...
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI-fdDh7P3d6g32b4fqj-avdTymh1lEBuM9ct5XgPfS3BYGG58h4N3yv2k5G8JwBEKw96KXApgJ-FDnYj-DLaToZKN93Qs&google_hm=MsGjoOZZwgoeZkZvW_V7wg==
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI-fdDh7P3d6g32b4fqj-avdTymh1lEBuM9ct5XgPfS3BYGG58h4N3yv2k5G8JwBEKw96KXApgJ-FDnYj-DLaToZKN93Qs&google_hm=MsGjoOZZwgoeZkZvW_V7wg==
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
via
1.1 google
server
Cowboy
access-control-allow-origin
null
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI-fdDh7P3d6g32b4fqj-avdTymh1lEBuM9ct5XgPfS3BYGG58h4N3yv2k5G8JwBEKw96KXApgJ-FDnYj-DLaToZKN93Qs&google_hm=MsGjoOZZwgoeZkZvW_V7wg==
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
content-length
0
x-request-id
7fqon5vh8dvgog0mnedai4t10msef7a6
pixel
cm.g.doubleclick.net/ Frame 515B
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=fwnFHZ5XS-mNmrhrqBUHUA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=fwnFHZ5XS-mNmrhrqBUHUA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJlmo6D1Kdw4Z8dThRWFNcVp_FGmrNKvYNIpSQ3ilk3A6H6Dbu31xqGcWnM059_xqW0831u-w1AvAMGDTD6zQefys04FXA
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=fwnFHZ5XS-mNmrhrqBUHUA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJlmo6D1Kdw4Z8dThRWFNcVp_FGmrNKvYNIpSQ3ilk3A6H6Dbu31xqGcWnM059_xqW0831u-w1AvAMGDTD6zQefys04FXA
date
Fri, 18 Jun 2021 08:16:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame 515B
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDa-SzPKneQ6yKMq_DOsz8Y&google_cver=1&google_push=AYg5qPJvGZfJVgJ4ULdLj84JKKjZlyKrfGAcvo1sEDEziN7UJSnZBSQDG9igoPGMT0FA5yA67a4...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVCTVEtVC01MUlL&google_push=AYg5qPJvGZfJVgJ4ULdLj84JKKjZlyKrfGAcvo1sEDEziN7UJSnZBSQDG9igoPGMT0FA5yA67a42WXdicVyybo1RAVDc5YxGKv0
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVCTVEtVC01MUlL&google_push=AYg5qPJvGZfJVgJ4ULdLj84JKKjZlyKrfGAcvo1sEDEziN7UJSnZBSQDG9igoPGMT0FA5yA67a42WXdicVyybo1RAVDc5YxGKv0
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1EyMjVCTVEtVC01MUlL&google_push=AYg5qPJvGZfJVgJ4ULdLj84JKKjZlyKrfGAcvo1sEDEziN7UJSnZBSQDG9igoPGMT0FA5yA67a42WXdicVyybo1RAVDc5YxGKv0
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
66ef90d06496cfd000aab8206f2b6221
Expires
0
pixel
cm.g.doubleclick.net/ Frame 515B
Redirect Chain
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEOhqQGO4KfqrATm_j5JINjY&google_cver=1&google_push=AYg5qPJiip_8_tsJTAHeWGxkcqAulZOly7aDTkQqfSoYdLvP2a_uwgs2lpvHDGK0-AwT1s_Mq6RTtbTkteIslbw5...
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJiip_8_tsJTAHeWGxkcqAulZOly7aDTkQqfSoYdLvP2a_uwgs2lpvHDGK0-AwT1s_Mq6RTtbTkteIslbw53CjajEA5Di4
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJiip_8_tsJTAHeWGxkcqAulZOly7aDTkQqfSoYdLvP2a_uwgs2lpvHDGK0-AwT1s_Mq6RTtbTkteIslbw53CjajEA5Di4
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 18 Jun 2021 08:16:02 GMT
via
1.1 f1944380c787841c28b16df91c1ec34e.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
VIE50-C1
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJiip_8_tsJTAHeWGxkcqAulZOly7aDTkQqfSoYdLvP2a_uwgs2lpvHDGK0-AwT1s_Mq6RTtbTkteIslbw53CjajEA5Di4
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
ZzHaWCn0iMpAfAjF5WoFU2rBWMpUeRqu1jYPMPn28AMOH8CjCW5d2Q==
attr
cm.g.doubleclick.net/pixel/ Frame 515B
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IOS-eip3JivaosQCMw2Qq9GXiF9_f0HPrRDwymLyFCjEEY4EJvgYXqdZuCTlje1_JJSQdb
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame 520F
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuLJShWlw0JXh8FuGIPJyWmDF0AsK0nm-JqIA7IA6Fe9jjmM776ctDm-FbFPDAGk0bfWhBQh-j7JtO4KRfu-cZBD9KjS0np9r2B0YWXaR_5lKfq0FlREeqAAKuJq91ueEm7gLyHE8BzqWnLY2vEHsIIYowh3e32cEPi3k3p028xHjq_sPLiX6qOuQhVZItC8Vv0zUiFRhNw9P8oZ8YTW1l2_tufDyE3VqC3eOmkNqfUus0LN62rBq-B31Sk7lHVh87QUT6DpkZl8cmULkEvs51QPO-HHHfdV_VX&sai=AMfl-YQRvHlHdYEKyIB01S35EkEr0LiNm1h0WSeCxTnxVMdi7EDVuXV6Gqq8VIdJSZ9144bzUOYPUUXtMrldOjXYLYqg0Ly1UqgGkM81F0bPxaxFpm-DXHOop2AAq7i3w7E&sig=Cg0ArKJSzPDXs6mDbG8SEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:02 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:02 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame 2077
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
16 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:02 GMT
server
safe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Fri, 18-Jun-2021 09:16:02 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:02 GMT
server
safe
content-length
246
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
pagead2.googlesyndication.com/bg/ Frame 875B
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.37861406379712337
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
450cd8f0848a395dd1c0e329fe4f5444e58cfd576162312a30d74a095d7135f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 20:50:36 GMT
content-encoding
br
x-content-type-options
nosniff
age
41126
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5759
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 17 Jun 2022 20:50:36 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame 42C6
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
16 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09456299768667975
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
DSID=NO_DATA; IDE=AHWqTUmYsHh24USWM8ZmH4E4O8Y0JvQYSlFDy4IfazI0fMZsLEQIr-mthAkI15-roqo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:02 GMT
server
safe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Fri, 18-Jun-2021 09:16:02 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:02 GMT
server
safe
content-length
246
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
activeview
pagead2.googlesyndication.com/pcs/ Frame 0621
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuTS3oiiize2rg1rhUIotR2EIvCmleHzYQ_dE2YDPH1QzGt_C5B-wf3BJhBvicxjj9-mAe0TzSmdZh2hAOkByJH53-PVcSqpH2BTaYKyGk7viUl0QF_zPb2ELYJDw&sai=AMfl-YR-ErdrfLzTNAA4sbzFmY1N0V4doGD_0SB75IAZOptrY86iNeh_ZFydTvxKgmSYNNUrdQ0KnIaFoqLbUo9pLB2zHMG0NwrYbQY&sig=Cg0ArKJSzAorE8kw5xbOEAE&cid=CAASF-Ro8S1HpscShavz1mpE8ytSowtlp2gt&id=lidar2&mcvt=1045&p=0,0,250,970&mtos=1045,1045,1045,1045,1045&tos=1045,0,0,0,0&v=20210616&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=3986104005&rs=5&met=mue&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&r=v
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame DBC2
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss6_JmONfZ_j1eVndb5DUKj59G7WVmOLTXNk5DkqpkYqOuIKcu8TmEKq6nFQ_6gzG3wcj52Les6p7Ua1HjUAAbeEaafQGyupgO-YS3RG_0&sig=Cg0ArKJSzCLCd0MoKJD4EAE&id=lidar2&mcvt=1047&p=348,315,598,1285&mtos=1047,1047,1047,1047,1047&tos=1047,0,0,0,0&v=20210616&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=3270891412&rs=4&met=ce&la=1&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1624004160082&dlt=0&rpt=328&isd=0&msd=0&r=v
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
google
match.adsrvr.org/track/cmf/ Frame A77C
70 B
264 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/google?google_gid=CAESEBPXAO3JCPxWzslmEJ94V30&google_cver=1&google_push=AYg5qPIkT2S6lD5XVdFjbeYFoKr5WfcvpDn0gMsM15wkpkBPOJlAXzG6r-G1KA9V6yO6hDialNGN_TXx1HRAFZDXEg7yddBFqCI
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a97adde81b00f2ca4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixelSync
pixel-sync.sitescout.com/dmp/ Frame A77C
0
191 B
Image
General
Full URL
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEJapf5Ol4smrNzhcOAIeNUU&google_cver=1&google_push=AYg5qPI-iiyK09yH6oHu7FLRqLUYGibion0vefuBOp_ZR1UtYM_IM9krDRhMtYMr1j3e59e6yvyCFp4ivv8G_LrLXtkj_PIGNp4i
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
66.155.71.149 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:01 GMT
cache-control
max-age=0,no-cache,no-store
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires
Tue, 11 Oct 1977 12:34:56 GMT
pixel
cm.g.doubleclick.net/ Frame A77C
Redirect Chain
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEF4GIZUvGuaqhdaf0e0J85g&google_cver=1&google_push=AYg5qPJI1Dho6GkZ5m_zrk34HZKVJoCGSIVhaCjhToXu1Z-FAmvNgaFNyIIJQpJmMyxX8cV00f2kIRw_-KT...
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPJI1Dho6GkZ5m_zrk34HZKVJoCGSIVhaCjhToXu1Z-FAmvNgaFNyIIJQpJmMyxX8cV00f2kIRw_-KTdXelshwn3jDv0b24s&google_hm=MbVItVZnQrOkvQ7PaW0ZE44
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPJI1Dho6GkZ5m_zrk34HZKVJoCGSIVhaCjhToXu1Z-FAmvNgaFNyIIJQpJmMyxX8cV00f2kIRw_-KTdXelshwn3jDv0b24s&google_hm=MbVItVZnQrOkvQ7PaW0ZE44
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
via
1.1 google
server
Apache-Coyote/1.1
status
302
p3p
CP="NOI DSP COR NID CUR OUR NOR"
location
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPJI1Dho6GkZ5m_zrk34HZKVJoCGSIVhaCjhToXu1Z-FAmvNgaFNyIIJQpJmMyxX8cV00f2kIRw_-KTdXelshwn3jDv0b24s&google_hm=MbVItVZnQrOkvQ7PaW0ZE44
cache-control
no-cache, must-revalidate
content-type
text/html;charset=UTF-8
alt-svc
clear
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame A77C
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECDHcZU6r37gbQIA91KFDtc&google_cver=1&google_push=AYg5qPL9dAf8aqF1SUv99-7sVT2wjxmHbxMB3QCCzHpJZmNeG2famqJPVIz9a98WEhYylDT7DcexD9Mek34rjFMnrWSRY0F...
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPL9dAf8aqF1SUv99-7sVT2wjxmHbxMB3QCCzHpJZmNeG2famqJPVIz9a98WEhYylDT7DcexD9Mek34rjFMnrWSRY0FFgNc_&google_hm=NzE5OTgxMzk1NDMzNzE0OT...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPL9dAf8aqF1SUv99-7sVT2wjxmHbxMB3QCCzHpJZmNeG2famqJPVIz9a98WEhYylDT7DcexD9Mek34rjFMnrWSRY0FFgNc_&google_hm=NzE5OTgxMzk1NDMzNzE0OTM4NQ%3D%3D
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 18 Jun 2021 08:16:02 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPL9dAf8aqF1SUv99-7sVT2wjxmHbxMB3QCCzHpJZmNeG2famqJPVIz9a98WEhYylDT7DcexD9Mek34rjFMnrWSRY0FFgNc_&google_hm=NzE5OTgxMzk1NDMzNzE0OTM4NQ%3D%3D
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame A77C
Redirect Chain
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEBYmjzLfJuUb3MPVd7arEBE&google_cver=1&google_push=AYg5qPIX7wkErA6PRsPdExYy5_olyoMe0aBnXWp87MxE5qswTCGYLcOglYRBcWtbUgI7zGJQBx4r4Pez...
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEBYmjzLfJuUb3MPVd7arEBE&google_cver=1&google_push=AYg5qPIX7wkErA6PRsPdExYy5_olyoMe0aBnXWp87MxE5qswTCGYLcOglYRBcWtbUgI7zGJQBx4...
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzc1ODAwODY4NDEyNjgxNjkyMg&google_push=AYg5qPIX7wkErA6PRsPdExYy5_olyoMe0aBnXWp87MxE5qswTCGYLcOglYRBcWtbUgI7zGJQBx4r4P...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzc1ODAwODY4NDEyNjgxNjkyMg&google_push=AYg5qPIX7wkErA6PRsPdExYy5_olyoMe0aBnXWp87MxE5qswTCGYLcOglYRBcWtbUgI7zGJQBx4r4PezbQUU2w70hegyb-vTdqoi
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
nginx
location
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzc1ODAwODY4NDEyNjgxNjkyMg&google_push=AYg5qPIX7wkErA6PRsPdExYy5_olyoMe0aBnXWp87MxE5qswTCGYLcOglYRBcWtbUgI7zGJQBx4r4PezbQUU2w70hegyb-vTdqoi
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
pixel
cm.g.doubleclick.net/ Frame A77C
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEBRDS3qrRMmAFoKE_s6Wb10&google_cver=1&google_push=AYg5qPIZvoRSDwcrtqWtLS1DXLSkRzPMfGfwH5WvTmOmguilBhvKvt8ddRMg4OlE1Z2KoBKuQzTvf0...
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPIZvoRSDwcrtqWtLS1DXLSkRzPMfGfwH5WvTmOmguilBhvKvt8ddRMg4OlE1Z2KoBKuQzTvf06wyZiO3blJxrx-kCqzIkw&google_hm=NTM0MDE1Njk...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPIZvoRSDwcrtqWtLS1DXLSkRzPMfGfwH5WvTmOmguilBhvKvt8ddRMg4OlE1Z2KoBKuQzTvf06wyZiO3blJxrx-kCqzIkw&google_hm=NTM0MDE1NjkwOTUzMDQ0MDE5
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPIZvoRSDwcrtqWtLS1DXLSkRzPMfGfwH5WvTmOmguilBhvKvt8ddRMg4OlE1Z2KoBKuQzTvf06wyZiO3blJxrx-kCqzIkw&google_hm=NTM0MDE1NjkwOTUzMDQ0MDE5
date
Fri, 18 Jun 2021 08:16:02 GMT
content-length
0
pixel
cm.g.doubleclick.net/ Frame A77C
Redirect Chain
  • https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESED4R2aliifiM0_ib6UxrfvM&google_cver=1&google_push=AYg5qPImWGIw2sY3rjnQYlVcja3dJn4QYN-JIbtDPpzq0gQG-poZOJT5...
  • https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESED4R2aliifiM0_ib6UxrfvM&google_cver=1&google_push=AYg5qPImWGIw2sY3rjnQYlVcja3dJn4QYN-JIbtDPpzq0gQG-poZOJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA2YmI5MjU4NS1kMDBkLTExZWItYTkxZi0wMmNmNWMwNzY5NzY%3D&google_push=AYg5qPImWGIw2sY3rjnQYlVcja3dJn4QYN-JIbtDPpzq0gQG-poZOJT5sQeIVkabXD...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA2YmI5MjU4NS1kMDBkLTExZWItYTkxZi0wMmNmNWMwNzY5NzY%3D&google_push=AYg5qPImWGIw2sY3rjnQYlVcja3dJn4QYN-JIbtDPpzq0gQG-poZOJT5sQeIVkabXD_BS1WSjUfXvTACoJ6wh-NQLt-yZaj_HlVzLg
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 08:16:03 GMT
Server
ATS/7.1.2.128
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA2YmI5MjU4NS1kMDBkLTExZWItYTkxZi0wMmNmNWMwNzY5NzY%3D&google_push=AYg5qPImWGIw2sY3rjnQYlVcja3dJn4QYN-JIbtDPpzq0gQG-poZOJT5sQeIVkabXD_BS1WSjUfXvTACoJ6wh-NQLt-yZaj_HlVzLg
Connection
keep-alive
Content-Length
0
attr
cm.g.doubleclick.net/pixel/ Frame A77C
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Imnnabr43Mr8k-jnwVv3jr6ImOGvL9mGiv_440ypKwOojewhx141b5S0GLcvLzpz4qXi_26Q
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame 5AFB
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstueneCzJvXi2ps7dssucuzA2PE9JMSYzdg0uhpWwILKzm-lLl2gpuHxEvJHcI7M1dmtvOhrAw1BEqOGDd4D90GymaYPzwwNmC2Y5oK4t_wzLSWbBzYTOWKnau545c1rymewlGb57vKdhwmzUAD2IDLNWzaLjKk5yp0T5yKs1Yo9U1e01wdBcRA1x6U6VZXjOwMQSZJE27T1yVWUhmsvANXuUa9WRG-SLbmGBqA_MVXuvvdKYLk_4q3f06t5mQWV3Goqb7rmnaQ5cjvBdB3PrJNMgCwE5laWSF4&sai=AMfl-YS9AB_3IS6p_8f6i7ahg8xVC-uPDCUHHe2WtvuJYQ79_YH9LFPiZiywTH0i01UfARBNnbjNqVXV8r5PhBw8Wf0w30CL0vrZ9KsF9RD4LFzcsh3I8nLr-CJyuwPK06gg&sig=Cg0ArKJSzHUHsoCOc23TEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:02 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:02 GMT
/
google2waycm.netmng.com/cm/ Frame 4C39
0
0

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 4C39
Redirect Chain
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESENG1Oa6YSiIl8PP_3h6xdaU&google_cver=1&google_push=AYg5qPL16GFvoLJobaIuOlceJL4dfS6E5mackW6h359CwhZUXaFn25lNLRRFRtF_pAUPor3fz121zx83Jnhmr8s3D8kEcKhBcDaKz...
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODQ2MzEyMTIzMjI4NzEwNjM5NQ==
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEFTkfxTOooSg7x5UA4Ic3D4&google_cver=1
43 B
407 B
Image
General
Full URL
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEFTkfxTOooSg7x5UA4Ic3D4&google_cver=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software
/
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type
image/gif
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEFTkfxTOooSg7x5UA4Ic3D4&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 4C39
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cve...
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&goog...
  • https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RUJhVExsQkgxTFU5Rnc1&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cver=1&google_push=AYg5qPLnEcT3SUmKuH3NvGV3n3QixXEWapVNHkqrfx46ZIA...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RUJhVExsQkgxTFU5Rnc1&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cver=1&google_push=AYg5qPLnEcT3SUmKuH3NvGV3n3QixXEWapVNHkqrfx46ZIAoqOan-ucT71jCPUYWwqollmD5JowqWQ-_lCkx6wKIH9WPxSNOZxE-ArJmHEjQQ3DQAHSTRfSTcd9btChDr6mkf64ArfqRupwL
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 18 Jun 2021 08:16:02 GMT
Server
PingMatch/v2.0.30-655-g6f0fff2#rel-ec2-master i-005da0421d9a8a886@eu-central-1b@dxedge-app-eu-central-1-prod-asg
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RUJhVExsQkgxTFU5Rnc1&google_gid=CAESEOL4P-K8VoM-2OqD2uvCAO0&google_cver=1&google_push=AYg5qPLnEcT3SUmKuH3NvGV3n3QixXEWapVNHkqrfx46ZIAoqOan-ucT71jCPUYWwqollmD5JowqWQ-_lCkx6wKIH9WPxSNOZxE-ArJmHEjQQ3DQAHSTRfSTcd9btChDr6mkf64ArfqRupwL
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
google
match.adsrvr.org/track/cmf/ Frame 4C39
70 B
264 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/google?google_gid=CAESEBPXAO3JCPxWzslmEJ94V30&google_cver=1&google_push=AYg5qPJvhUG5qOf6zB6bY7lZ4iB3F73mILj1sCJhFIkWgEQRuJh_tUEkTx4paYOqQXW1Yvs1ejYYliWURBYvcE4zWM7h_OhFCJ6UfpaLIrgHJbyJFvTpmMffr6COTw0k6ySPaK91u9uHvF6b
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a97adde81b00f2ca4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 4C39
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESENr99uNDXmzBtbCZ1Lj7boQ&google_cver=1&google_push=AYg5qPJpySQ-iudyc8CK6bUtXhGte2ilfb6DHoH1GTOkTJvLo_j9LThOCZ09n-nDQMXehA-9foopcLff6UPhQ6...
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTA0NDc2NDM3NjQzMDczMw%3D%3D&google_push=AYg5qPJpySQ-iudyc8CK6bUtXhGte2ilfb6DHoH1GTOkTJvLo_j9LThOCZ09n-nDQMXehA-9foopcLff6UPhQ6EcwO...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTA0NDc2NDM3NjQzMDczMw%3D%3D&google_push=AYg5qPJpySQ-iudyc8CK6bUtXhGte2ilfb6DHoH1GTOkTJvLo_j9LThOCZ09n-nDQMXehA-9foopcLff6UPhQ6EcwOz3INFqEZ2GO9rnJD1KUnqvkE2CpGCygazVAvbXKZecM7qmAtc6W-7l
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTA0NDc2NDM3NjQzMDczMw%3D%3D&google_push=AYg5qPJpySQ-iudyc8CK6bUtXhGte2ilfb6DHoH1GTOkTJvLo_j9LThOCZ09n-nDQMXehA-9foopcLff6UPhQ6EcwOz3INFqEZ2GO9rnJD1KUnqvkE2CpGCygazVAvbXKZecM7qmAtc6W-7l
Date
Fri, 18 Jun 2021 08:16:02 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
pixel
cm.g.doubleclick.net/ Frame 4C39
Redirect Chain
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEBYmjzLfJuUb3MPVd7arEBE&google_cver=1&google_push=AYg5qPJqjTx2SBtBPfuhwiLb1sr_KJ-XSroblnzKGrq2qIZc4oFdKWS-EPGCQt-KMKIHhmYPThRFBMiQ...
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEBYmjzLfJuUb3MPVd7arEBE&google_cver=1&google_push=AYg5qPJqjTx2SBtBPfuhwiLb1sr_KJ-XSroblnzKGrq2qIZc4oFdKWS-EPGCQt-KMKIHhmYPThR...
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njk3NzMwNDMxMTc4NzMwNzYwMQ&google_push=AYg5qPJqjTx2SBtBPfuhwiLb1sr_KJ-XSroblnzKGrq2qIZc4oFdKWS-EPGCQt-KMKIHhmYPThRFBM...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njk3NzMwNDMxMTc4NzMwNzYwMQ&google_push=AYg5qPJqjTx2SBtBPfuhwiLb1sr_KJ-XSroblnzKGrq2qIZc4oFdKWS-EPGCQt-KMKIHhmYPThRFBMiQKth7Md4lLLpVFhJY3ZKxG2ldlEMv_tURVB6ZRHSQtvMJ6LgZSqMFki1koZ3bV1M
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
nginx
location
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Njk3NzMwNDMxMTc4NzMwNzYwMQ&google_push=AYg5qPJqjTx2SBtBPfuhwiLb1sr_KJ-XSroblnzKGrq2qIZc4oFdKWS-EPGCQt-KMKIHhmYPThRFBMiQKth7Md4lLLpVFhJY3ZKxG2ldlEMv_tURVB6ZRHSQtvMJ6LgZSqMFki1koZ3bV1M
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
pixel
cm.g.doubleclick.net/ Frame 4C39
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEM...
  • https://sync.targeting.unrulymedia.com/csync/RX-1ee0d14d-1714-470e-a824-1be06a4d5606-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAYg5qPJYJD2VfoF3ePk-nohjy...
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJYJD2VfoF3ePk-nohjyl98EFRHhZCS7-mNLxHXm-ctK4rPkAiXe2KZI0_K2CTuXgpsF7JumKeKwR3h4bYeD-h5G3A2LU0R6c7QWbg-NyocmaBTe0G5Lr_1KkURVV-GGW-0...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJYJD2VfoF3ePk-nohjyl98EFRHhZCS7-mNLxHXm-ctK4rPkAiXe2KZI0_K2CTuXgpsF7JumKeKwR3h4bYeD-h5G3A2LU0R6c7QWbg-NyocmaBTe0G5Lr_1KkURVV-GGW-0fX4oxbDn&google_hm=Ax7g0U0XFEcOqCQb4GpNVgY
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 08:16:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJYJD2VfoF3ePk-nohjyl98EFRHhZCS7-mNLxHXm-ctK4rPkAiXe2KZI0_K2CTuXgpsF7JumKeKwR3h4bYeD-h5G3A2LU0R6c7QWbg-NyocmaBTe0G5Lr_1KkURVV-GGW-0fX4oxbDn&google_hm=Ax7g0U0XFEcOqCQb4GpNVgY
date
Fri, 18 Jun 2021 08:16:03 GMT
server
Tengine
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RX1ee0d14d1714470ea8241be06a4d5606003
content-type
text/html
attr
cm.g.doubleclick.net/pixel/ Frame 4C39
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JWsIpQbjUMO18wkDGmmVCTMdD-bEfU0kST1N-lNC-8v6Th65z6hjbak29FbBDvWsmSwth-
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 08:16:02 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame A0D9
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsucW3jy4vHU28MJ578KFgDw724E6z5PQ7jq_HiVuHYw3KPsCB1ZVZHmE9JLYNkSc9XUaD_AWy8EgsyAgY5H-XgBkAS0YF7Rm_MuFfH7gubC-p_IgeYRAkTTdW-M_g0RmFcpUQCi3RcNWmO-td6AtVDLrTsUKhlZICqdO0khaF62cxPFjNt1sYIt3H8B7t-mikrvifSVilhv18x_zuIABA5yjtPAndpD7IOpl0a34kz_GWv_QscG2cBo_fiHmDhzVxiJoIqy1a86SJmm_1Ya54YBmXYyqg&sai=AMfl-YSJyUi-gFSzjDL9epUJOPFjgcBKiqESP9QOHS6aaXLiYqclL-Srvnco_-P87S38gCs1raM_M2pWSnbo20ettxlgSdLVKD4T9cp2Tx2FYrV6wJXtIGK0WrCdemjq1nk&sig=Cg0ArKJSzPBJrvliV4hbEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 08:16:02 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 08:16:02 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame 7CC7
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
16 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
DSID=NO_DATA; IDE=AHWqTUmYsHh24USWM8ZmH4E4O8Y0JvQYSlFDy4IfazI0fMZsLEQIr-mthAkI15-roqo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:02 GMT
server
safe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Fri, 18-Jun-2021 09:16:02 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Fri, 18 Jun 2021 08:16:02 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:02 GMT
server
safe
content-length
246
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
pagead2.googlesyndication.com/bg/ Frame 59EE
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.6785909509169328
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
450cd8f0848a395dd1c0e329fe4f5444e58cfd576162312a30d74a095d7135f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 20:50:36 GMT
content-encoding
br
x-content-type-options
nosniff
age
41126
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5759
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 17 Jun 2022 20:50:36 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame F6A0
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
16 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
DSID=NO_DATA; IDE=AHWqTUmYsHh24USWM8ZmH4E4O8Y0JvQYSlFDy4IfazI0fMZsLEQIr-mthAkI15-roqo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:03 GMT
server
safe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Fri, 18-Jun-2021 09:16:03 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Fri, 18 Jun 2021 08:16:03 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 08:16:03 GMT
server
safe
content-length
246
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
pagead2.googlesyndication.com/bg/ Frame DE53
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/RQzY8ISKOV3RwOMp_k9UROWM_VdhYjEqMNdKCV1xNfI.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.33667233559130305
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
450cd8f0848a395dd1c0e329fe4f5444e58cfd576162312a30d74a095d7135f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 20:50:36 GMT
content-encoding
br
x-content-type-options
nosniff
age
41127
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5759
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 17 Jun 2022 20:50:36 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPIxKLkdE7AEYqNMoUEl3WeNa2pNu6TRf0TugzoNf3Lotyl-mQDrThy1w4XF6ZpDUIqZwCxaXe_qZHBbxt_EBMzX_XDG&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1&google_tc=
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQXwJXMuDmJZjKE05dQAABIYAAAAB&google_push=AYg5qPI-VomABqNFwbeSTtpSp3y8nIh3IY31xTbYuB4ryN0ZpsgYXYnvPyPkFlmDbDhc0m_JNkVgz4_vkvC_sxlupBn-77Kg-Lbl&google_cver=1&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_tc=
Domain
pix.impdesk.com
URL
https://pix.impdesk.com/csync/google?google_gid=CAESEPSLuRI9rp56wSa5V49SrRs&google_cver=1&google_push=AYg5qPKaFNknBTMhRrlIXid5dXiHHZIkorX5QxfbXmG7v7wN_zelxpadF8n5x06bp09w9P7vNih0vjAVyFAsmNgEuSurYEuGOF-NX2HCiye_cyYw0YQPo9SyE2TMhtus5hPRaGsLCBNbwGCN
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPLquCPUTd-r8XhPwp7fRpQ_FUUOj9tOqsC9seEv1A3KSk1WAzxckFSw4tS6jaD67IuxhPbTWGbgfXMQMUe1Nl97FrkwgdCnZa-a1145HMQHVFmzoho6TFAfUqwdBMwn_e-83KhSh8w&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1
Domain
um.wbtrk.net
URL
https://um.wbtrk.net/doubleclick/user/match?google_gid=CAESEO-Y363ZxCW4RuC-IkvFtYE&google_cver=1&google_push=AYg5qPKO4hS7IwELMstWNbnLx5_tQgBXfgCwuh0q16FnG-79AJCNXrNDknNw8TaePtzLMdkqxmimE8zIoPYOuBCJfl5dCWWbegU
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxWQhJ5PK0fl3gSP_5zrQAABJkAAAIB&google_push=AYg5qPIaaRPitA5r38ph0Sq4vHxJGy-m8pSUyTX9WUoF13Hdx6L8NIgqUQ8RRynH_6LVnsCecAhBDnJcIiqjTG7ONuNLY9yL3A&google_gid=CAESEH032H7itsl-Yrm-hfx886U&google_cver=1
Domain
um.wbtrk.net
URL
https://um.wbtrk.net/doubleclick/user/match?google_gid=CAESEO-Y363ZxCW4RuC-IkvFtYE&google_cver=1&google_push=AYg5qPJYgOWVcprozjaI-NtM3rjbNMu89FX89IA6mV6Y032TfqF02pW5D3iMEwCgKHuCkLxTOMYhM_jEztJOApk7ffrk8-S5to8
Domain
google2waycm.netmng.com
URL
https://google2waycm.netmng.com/cm/?google_gid=CAESENt7ntr4vJM5WLPRdPGODSU&google_cver=1&google_push=AYg5qPJNLMYmFZWZXVAzO1diX_PFU36Ffky2Mslpk0fdyzw3xw9yApZF5jcbD-vPpP5727aH5_LEugjB1zQJPKkZBPczNyi1cWAEbk5tgxjfOSyFWEfJy5Uq07liLprk3g6bR9SlBqoP8zFF

Verdicts & Comments Add Verdict or Comment

163 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| ym function| setCookie function| getCookie function| createGeoRestrictionCookie undefined| $ function| jQuery object| Sk object| google_js_reporting_queue number| google_srt object| google_logging_queue object| google_ad_modifications object| ggeac boolean| google_measure_js_timing object| google_reactive_ads_global_state boolean| _gfp_a_ object| adsbygoogle string| google_user_agent_client_hint object| regeneratorRuntime object| googletag object| pbjs325474 object| AdSlotCollection function| setImmediate function| clearImmediate boolean| engineLoadOnce boolean| __isGoogleAllowed object| __isFromEUPromise object| Ya object| yaCounter68669068 function| EventEmitter object| eventie function| imagesLoaded function| getStyleProperty function| getSize function| docReady function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry function| cookie object| jQuery112407600461731514783 function| Froogaloop function| $f object| html5 object| Modernizr function| yepnope object| _0xbd59 number| zxadflg_rich_stat boolean| cs_flg string| zxmngname_ext string| yamId string| zx_domaine_ext string| zxadblockmng_ext number| zx_ad_flg boolean| zx_flgCap number| zx_gcWrk boolean| zx_flgOverlay boolean| zx_flgNative function| ZxStartMainModule string| zx_type_ad string| zxadpartner_ext object| __ZXNT number| zxCheckAbsStart object| t object| e object| __ZXCONSENT object| ajax_btn_str object| ajax_c object| App string| fixed_nav object| rubik_instagram_col string| rubik_tabs_more object| justified_ids object| wp string| MyJSStringVar object| cookieconsent function| pbjs325474Chunk object| _pbjsGlobals function| JSEncrypt object| ADAGIO function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter object| googleToken object| googleIMState function| processGoogleToken number| __google_ad_urls_id number| google_unique_id object| gaGlobal number| zxCheckAbs number| zxConsentEnabled number| ZxConsentFlg number| OaCmpEnabledflg object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired object| ampInaboxIframes object| ampInaboxPendingMessages function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| GoogleGcLKhOms object| google_image_requests object| ZXNT string| slot_ext string| zxadblock_ext string| domen string| site_topdomen number| prtintstlprocent string| zxAdUnit77 string| zx_network_prefix string| zx_ad_slot_default object| adx_dfp_bloks string| zx_banner_w_default string| zx_banner_h_default string| BannerSize_default number| flg_dfp object| t2 object| e2 string| url1 string| url2 string| url3 string| zx_ad_place number| zx_ad_width number| zx_ad_height string| zx_ad_slot string| zx_ad_id string| ins_targets number| cw number| ch object| tt98 string| txt98 string| txt99 string| stl98 string| BannerSize function| AdPlayerPro object| DMVAST function| playerPro function| getCs object| ed

6 Cookies

Domain/Path Name / Value
.ncmhcso.org/ Name: _ym_d
Value: 1624004157
.doubleclick.net/ Name: IDE
Value: AHWqTUnCub_SAQVEMRTYsKgCAP7SteA6E4N-a_M02qKP-ePkiCNRuT0FPBxmuYlG
.ncmhcso.org/ Name: __gads
Value: ID=27f29165f6500e74-227da75265c8004e:T=1624004157:S=ALNI_MacQE-D4eYiXJAcKBQn0HtNKaOvQA
.ncmhcso.org/ Name: _ym_isad
Value: 2
.ncmhcso.org/ Name: _ym_uid
Value: 1624004157775488931
ncmhcso.org/ Name: __oagr
Value: true

18 Console Messages

Source Level URL
Text
console-api log URL: https://ncmhcso.org/template/rubik/js/jquery-migrate.min.js?ver=1.4.1(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1
console-api error URL: https://ro3.biz/?pu=g5qtmmzqme5ha3ddf4ztonrr(Line 174)
Message:
Error: Browser is not suitable for subscriptions
console-api info URL: https://cst.cstwpush.com/static/adManager.js(Line 1)
Message:
%c [AdManager] - color:cyan version 2.1.4
console-api info URL: https://cst.cstwpush.com/static/adManager.js(Line 1)
Message:
%c [AdManager] - color:cyan run tag spots
console-api info URL: https://cst.cstwpush.com/static/adManager.js(Line 1)
Message:
%c [AdManager] - color:cyan init spot [object Object]
console-api log URL: https://cdn.zx-adnet.com/adx/smrcp_19121001.js(Line 2)
Message:
zxnt->page abuse -> Restricted demand
console-api log URL: https://cdn.zx-adnet.com/adx/smrcp_19121001.js(Line 2)
Message:
zx->gdpr & oa detected ->start without cmp (2000)
console-api log URL: https://cdn.zx-adnet.com/adx/smrcp_19121001.js(Line 2)
Message:
zxnt native v.1.1
console-api log (Line 17)
Message:
v2 sfr zxm ad 580|400
console-api log (Line 10)
Message:
sfr zxm ad 970|250
console-api log (Line 17)
Message:
v2 sfr zxm ad 580|400
console-api log (Line 10)
Message:
sfr zxm ad 970|250
console-api log (Line 17)
Message:
v2 sfr zxm ad 300|600
console-api log (Line 17)
Message:
v2 sfr zxm ad 300|600
console-api log (Line 17)
Message:
v2 sfr zxm ad 300|600
console-api log (Line 17)
Message:
v2 sfr zxm ad 580|400
console-api log (Line 17)
Message:
v2 sfr zxm ad 300|600
console-api log (Line 17)
Message:
v2 sfr zxm ad 580|400

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.tribalfusion.com
ad.turn.com
adservice.google.com
adservice.google.fr
allthebestsofts.com
ap.lijit.com
bk.jampartizan.com
c1.adform.net
cdn.jsdelivr.net
cdn.zx-adnet.com
cf64e8301612e4ef9e57c6aeaed628e9.safeframe.googlesyndication.com
cm.g.doubleclick.net
cmp.optad360.io
cms.quantserve.com
cst.cstwpush.com
dclk-match.dotomi.com
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
eb2.3lift.com
fonts.googleapis.com
fonts.gstatic.com
gcm.ctnsnet.com
get.optad360.io
google2waycm.netmng.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
image6.pubmatic.com
js.wpushsdk.com
match.adsrvr.org
mc.yandex.com
mc.yandex.ru
na.nawpush.com
ncmhcso.org
p.rfihub.com
pagead2.googlesyndication.com
pix.impdesk.com
pixel-sync.sitescout.com
pixel.advertising.com
pixel.everesttech.net
pixel.rubiconproject.com
pm.w55c.net
pr-bh.ybp.yahoo.com
r.turn.com
ro3.biz
rtb.openx.net
s.ad.smaato.net
s.tribalfusion.com
s0.2mdn.net
securepubads.g.doubleclick.net
serving.stat-rock.com
ssbsync.smartadserver.com
stat.optad360.mgr.consensu.org
sync-tm.everesttech.net
sync.1rx.io
sync.mathtag.com
sync.targeting.unrulymedia.com
tpc.googlesyndication.com
tracking.m6r.eu
um.wbtrk.net
ups.analytics.yahoo.com
www.google.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
cm.g.doubleclick.net
google2waycm.netmng.com
pix.impdesk.com
um.wbtrk.net
142.250.186.66
143.198.248.63
144.76.120.254
151.101.14.49
151.101.65.195
172.217.23.98
18.159.175.104
18.193.131.224
18.196.233.38
18.197.47.23
185.29.132.68
185.64.189.115
185.86.138.131
193.0.160.129
198.54.121.248
2001:678:cb4:bbbb::11
205.185.216.42
213.174.135.25
213.19.147.44
213.19.147.45
216.52.2.30
216.58.212.162
23.218.208.246
2600:9000:206e:3a00:11:a4de:2580:93a1
2600:9000:21f3:cc00:6:b871:4f00:93a1
2606:4700:3030::6815:233f
2606:4700::6810:5714
2606:4700::6812:d05
2620:116:800d:21:5a23:9c4e:e774:96c1
2a00:1288:110:c305::8000
2a00:1450:4001:800::2004
2a00:1450:4001:802::2003
2a00:1450:4001:802::200a
2a00:1450:4001:808::2002
2a00:1450:4001:808::2006
2a00:1450:4001:80f::2004
2a00:1450:4001:810::2002
2a00:1450:4001:812::2002
2a00:1450:4001:827::2001
2a00:1450:4001:82a::2002
2a00:1450:4001:831::2003
2a02:6b8::1:119
2a02:fa8:8806:12::1400
3.126.56.137
35.158.9.168
35.186.193.173
35.227.252.103
37.157.3.29
37.252.172.38
66.155.71.149
69.173.144.138
72.251.244.142
76.223.111.131
85.114.159.118
99.80.199.35
99.86.242.104
00145d064b68e137e2e7f0c13890ff6d917a084d350efb69c788c6ec480c0432
01ca50b063b0ce958f45b7469c3cd70f734dfb115ab6c1940a6e9c9ba1ad0d7c
084c3ffb87ac836cfbea178e0b9a7496ad13ddc7102c6b2d6d2cc0c541a4fcd0
097cb55ac0307c25d1545a83582c26efb8a0081cfa56b46b16d41b74795cd590
09961140c12f8d7e4b768fe77f20560945ccf4b92be9ca816369d51f502af9cf
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0dc4093b6b9286ebfc6c728ddd3a70812a726d79d6f41d60a506fd5b93c4929c
0e62d60477b5e0d08d646f6d2ddfceccd5c42390f2eb952a64c3d4c7e3d45eb0
0f761fbc9d3fdb285d091360f18753c768700870cb21476d517e7006e2176c78
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
1609d3b477e2d71d3cf32bf9895e5f63d89214f88999ca45baeccc76a23bfb5d
16726b76043e97235cf0b1f6cc92e799194b324647636f5da5867e9641e422bd
1698abe528bb1f8e76991814a09aacb0ec7247d421ed2e4ff8f00e3fb1275712
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
19991510333e02070e2fd3ebb17c5bd13754996a7f7384a522944ed3f1f904c0
1bb9bb9566e36644cd95419dd6a743093731496524740525223f62c8d967e70a
1be611c7de2c8b87a8bf4b7a57bb94ce4dbadebe377354669e5f2f696ac7ef0c
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
1ee832bcc86e4326770d68011d8cb5108e607c9a74e3b6dd27138ebc872f7a8c
20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
239028d83453a0539d6ebf5af82bd089b9de53a498381195e8ce692c614456fa
23cf1643d982de3721e3d4b067ade5a4cc81c505a18e093aa659ceaba955dab3
240f2fa6d9c547702519223d888610d5517255aa52ad0c04d86f0ec6d0ab76d6
245a83b9565ae54ec44de7b48debafe08ff8884319ac1ca738923701703e0b85
246adef29fe1329a53847079c91950a159407881774e15b5d5df2e8cb276534c
262771632a89432eaefe842d9a1789c73be38da2ebb38177a8708345e4ef946b
26a5a8e9c29d59d397c641ab9923d92272fe2e0130f1e5b63e8f2ac4a17e9278
299b497f434737f5831af8b11f754f854a050fb9e6355a9bfb020be1679dec44
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b51b115bd237a8ddd57dfcba97289c21e011e73888f1bbff4dfc7a6046ea245
2ca57650e9d1881e382bd324039937317b18e44fd5fadab6d09018d426a2622a
2d1affae24db39c09d9df7afaa24f8c1fcbcad374d03acbc8d273744ba985252
2e2fcbd503db66fd9011818cb9b75ba2b70888c9b463ac5606c79b90505ee422
2f83b3380950504ef92c86cd293a94bcd4168734a16e4a0511e904e040e2698c
2f962292f54a0af7d847fd22b0287247b1631dab1d64e789ccc66a4cf554ba6f
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
3320c0d7115359837e0643f49b0828132df3424cedbb4b32428297dde2cf6c66
3523ed5c7be44fe902d3871fe1ebdd6bbfe820ab570c9982625ddf94d7b203bb
36d5786f78c11d8e8ab9cfd09323386ff751378cd1b09c0ad1bb5bcdcef431b8
3701da754cd5a0bc28caf5540c9d07c59164f08cfc5a3fb57ffc4864ce97abe5
3796cf12ca9b6f5f93255046f5bf7d70a82c6b389698ed6c007903940c17c5ad
37afcc50aed647983a6e055ccfdcb8ffb5edc9f759d42330a10edb6585f971f7
38a448e9e03a9f64e7611b19af4bb8ec97fde2c708dc57ebbc7701be7ae3af08
3ad2fcb328295f1199d593adaba909f3eea790f695554ac3c1da7aa009fc0e0d
3c1a4c35a75fcbfbc36f9a5d7253064428905ded79491b35ffbc1d3b25a62bc4
3ca3e467b7d4d6b403aa4619019d9250b11449c8ee9c91c90bcbc9acdd64fea2
3edc07e9053e5f74fe42260ea0806366e67dd743ba43370afe0b1a21c3061978
4006b64a6ddf4849049fe8693771c52302c97b3e88d3aa35ac5865313e048b51
408abc3a5bedff37056ecb1ba4872225de8a269ffe9aa04fd8fd38a7e7ec5116
41a7157117502a4074fa3928da88baa0f854ce20204ad2cfe56d1ec7cb0d1516
429f6b7a5802c15145bddd69b400dae34b814eebd42ea1a32934c9a55a159391
42e63bc8fb7c61c18051e1fd20d3f65135c0ac491c3923c4d23463eb6c4196ab
4433ff0f49844a27a31acc576d573f17fcff11480ff4c8abf0d17576dc4ffa17
450cd8f0848a395dd1c0e329fe4f5444e58cfd576162312a30d74a095d7135f2
45d57471cedd952555402ff456f064ea8cebeb82e0b6c2f783be20c3c0278e04
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4922bfef6e6dc4198aeacb06a25066057154c8368b5710915309267837435cca
49894b52d15fdca5393109cc22008f85b6eaba81d87686597e602a466932f71a
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4ef35581d56516af9c0a792f09316bda2494a5f497edf5de30e6ab74052bc380
4f7b6c826559e7a9fdd87aa3dab65d9032e27f9677e2c894bf8add376af093e6
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
544d363da5e7a8c242b864594ef42271591a1023a3840867f28209289d2ef3dd
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
56d33482c52294fd6906af2608a0c331809db4831160351c91054c53001a923c
58027843e9c3f059985dd8b5fe9de822c223e9061c26859b663dc2a43b39e6fd
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
59e78d540af7d652e75aa1b3e1e1edf726a3464986679767378259a510b7382f
5c64aa5391ddf404691dbca4d6bca2ba97eea185f6dad6ad34501109b1991a8f
5d7cc259e704335896d08543304ae31eeaf36f735cdf5e0767d4a4e78e62e0ec
5fb666fd52dd0d79bf7fffcacac8e560df56ed197509545f314269c7d44d4183
64540d5ecb8e214cc1a1cc4f1f68a7f09d0b6e56a37a456b08ee07d9c85fa9f5
6a4c9c4692721398ade60707849295e6fdbcf354bd898848a1a3638b99bb9479
7073536d50d0701e1be8fb0bac62d249e951fe41dca62f7bcb8e628a137bcb33
754e4f25470d9263afc25125dce868bae633ea3d59f1b7dc8a0e740292fa68a5
7733e901ce4639c446a06c89071cca31e57b494ca45e1b25ef1c523caf6e4083
77b54e7aac64e99a511ff05adeeae0a9bb8c1e35b344b922457e42b1c229dc88
7a5dd1c2ec3bd61e7f09f4eea6318c74c8f4eb1d53ba5922cb266531a8c7351f
7a783598f3cc86a4d73a813cedd5f6cbdf85ab7b95c4d40944a30c833071aa18
7d3ed5e7e4c4aafe8c1f5d004e7eee33b5887117d2125848352a2cda86dd7ed0
7dfdeeab3d7d536feca8c4d4ba7c7487eb380ae350cb6df273f88047519c404a
7f8e23303ba343ec125b4b0b385fc6faf1bf25756596647b0b0658d8d54d35b1
7fc68afd08e0a5f7a38236190b44cd54bdfb867e688110e83f03e9fa76e3c9de
801b9fd504871ed3dbc4fdf09891f075e172345dc9cfdea77e938aecce1d6267
8254c9521e087388e9bf4ffe934db413d93a10140e77e7931595fa191bd4aed7
83620fc89fc1d579db7168aab01b0b8ad43bc46590a2de59d7fda09e8564f9cf
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
850ebe5afa86a299ed655f0dd371f0bb4c80e38b73d855edf5139c3475f0d7f0
854d677b850907cd851eac7e3f02f05a1e056f05bd5563199c5d93044ff16840
8705434f588b28f46f84404752aed93c8c07749f28999cac226b8cc031bed100
895322ddf04461eb90de9cd679a2623c0b1338229177c8bc6371f0af9ca48099
8a3be7fe8fdea096e0d1ce3a7bd64c50add242f22396b5107a7d46c25095d58e
8c6be205177c18200172a6c008cd6ff719ecc96f0cab72db76bda2e6775cc521
8c9f3ee23b6ae0b36483139ef7ce1248148795f0a30b2ce63f86f42a9fe646b5
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e721fdaed85657fea7e22eff33717764bbdd7249181ed3184a6eb3215f14d15
8f9c0f2a66f6b525d673234d1a154cbab6e8e818444ae3dbcdcdc1e363447541
9066d3560e4855d5ad6b44ce3e5413931c24bcd03921ece8f582a947d632194d
92effbe8a78dd9230be215e6677310241baa9add26361c38a476df719bad79fe
92f37bb02bae4c1d3b4538e432614ae81f4eb82746255b10592885cd6591fa52
9315547869e07ac733a6bce355b07e2afe531de40dc338cea1f3afb52f147fce
933acc052f712423ce964b9648e9d031889426baca88265d65a84482c48eff40
936567bc744e199e02bfc3c33fe2bc9c862999e0d479e2a694aa7485460a3960
94ca88ba84d96801a5f13ad3aa207d4556782d77d275a82c6953e1acd771b868
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9be45d830a633e050edaa82361e4ecac3cc189b3a3975a41aa01ae3cb4e4120b
9bea616a0517194b82d3a49a36f05d82fbcd8fe5336f3a822a83abf6587b87be
9e5baf1d366ed7dc7fce4e7dbca6245c0b7ef74e8d3a6cd6ae7641e725c5024e
9e7a1412730fc4c5b0f5722472d217ec2e106e0756fe6d97a37b0ea89db35960
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a02543a271a2e93a371359389f7f0829c41c043b199a62fd3b16aca9e8be6bed
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0d5f91a5430829df5638fa69b85a6e361876d5499744cc724d01c342d944a75
a306a69ddbfb541a1bdbb224293806ac94d1a9b4f3084ca9f5e82b6dd3f9db44
a32f044efea4645c07446e220297106cd3ff3bda357e599a0238ac8dceccb4e4
a3c711fa3a16e2c87e35c8dec2508cd38b1cc6e1572f78849b4db0d26f6cc763
a47d09528b6740e7828e18f5470ea66ef6aa372da68ac0ae9d1f62e6b31cb295
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a6fca8abada4b5bde38f5d9112e464068b2b763f0dce2471f3e8cdf10b36a3ac
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a7b066e3aa45dc331dacc74fa884c5c588a031fa19dcc6a79834ee4ed03fcf9e
a7cc10d6b929d18973c7eda0205c914669edbd44cad3e656a5737d3dde64ad0f
a84ce178c035768568b9fb0dfb9d1e8b714c072fe13305f4cbfb65d758e1eece
aa7ad08dddb3da63c9512897e1918a62f8fa96268d92fa1c3c2b4edbf4014686
ab9df2bccffeb373df3ec6f8c10d1e229a7a05770637875f018673cc9318d3ac
ada59752057b656a95b5ad8a303dac46c823913c160b8f71a79f5d8a300001a9
adedd54a65a2ced28df706dea11f8a13cf8aff484e2338b2ed94c6d06fd15051
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b22efff4a0a770a4c43beb7851bffea88a6fb1ca44e743649d5027804c908319
b6828dcd79d5e4080a40bbaa202534607024537cfda9e006bd8a6bd3070eea32
b7e17926b30342edecee8b3a93029ac51462e2b479277d8e077ba57173eb1900
b8187fba06b7cd142d9c8b8577b3502214812c37eb1d01b8bb71c27ee4820b30
b961bb522a21c8710fa523ee1b97d3ae8880606088e221a08525621d54b014ca
bbde0ea9c50274448afdee811988867d3579169daff16b64bcb99ad1ee10905f
bc621afdf972c39066502aeed507c2cd0752f0cec9c932224fae97cc2a1d10a5
bd30f4aeca29e98bc22df127f6862fa50e96858931230dfab5ada6191adaf67d
bd7680f0d4768bf17b38b5834d7671e6e456d9655b4ae3cb39186d1fcd93f5c2
beae13f90f6a20b41296f5f4ff5338c50888e9bd36b804e01cff003023b5b27f
bee9b5df45533db9b11564b2edeb77fcb7aa91f086ca8c2ceb1e73b3ad4ff56a
c2e606e1fc82ea3a554aad5d0520e25d2677b89a891dc5c49e7ace08fce92e25
c51eca1adbb140a91c274a0fd9b205446c4adbc15741cdd0335bae69c31ef194
c5f7f45a6c1506225e5cef11f79b28ae0389422190934e506bb69c3ced839e1d
c6042d618193a30519857d6c066ae0d982772cd2e0e0aab6096098a03b272a82
c6754c3241a18169afee078352f5e11c9c8eec97b9e2fb173f541ce2d07dd210
c8d3e97c51668aa293da7ad2451f86fb288758f33961da09f8f89293894c39b0
ca74132e6cf69c727fa56ec6af4a7552c16faf39ba84797f376829dc704bca2a
cc7cc67c9a20cdb365cee019afd88e150a17a99f8984fe2ab6be0aa10e031ebd
cd0d0b6e50ff01ff2f3a9a70d7cfb66a7c6cb9acf7a566325568be6d3bd31fc4
ce203da19c0c708a9d171a7e1ed6322560b8acb38865be983d2ccae870f3b2f6
cf34e1b87bbfd9d9b185dec994924a496e279d8dc9387ad8d35bc0110134c4d3
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfb0125cd267872096f73d3252a8d8136c764a8f221e0c03be47675ee4b92d87
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
d2935547d3f71917ad204c10123bc6c14bc037d3814b760d50a7540cc0ef6734
d6299ceb6ce9c971a58efb0bd1fe66a5eb96317a0dd675a608d7a1c12ec11fc7
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc
dfdbae14960ab90f96810eb628e6115a85d20927e6c487007b5c1dff13a4268c
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
e0ce2127e2b4b945b4b6a14941f8a1b4eaeea5efa1bfee9f282a3644e2101a38
e1561a2d50a0156bcf1398c94e7ea6bd7aec40f3bc68a887307994c2f5a4f7ff
e285b95c09593f6e5c9ef91738ede73e7a026ff8eb683321aaab031c1cf94939
e2cd509924855071489aa3b65f460a2a2206dd104c4a9e6e6292420286c935f1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d2fb5e2edecc03632d4232f8956dfc6cea25557cdd082cab892d00f2769bc4
e548abcd8734bfcf8b4ebbbca1af98f9e8ae1e0ff884c0971f29498a4fc108f4
e55842a856a6d829feca3c3ad736c136b6c7549e9247274f78aa296259e06e24
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e6085301708c5091aa3bd00ca313d09f08a1ea02926745978796ce6b433b03ba
e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb
e88ec9e3c949c9efe4d81c17fb0210396b658c7a72c6a248211a26f65007946b
e9d8b1f9682086a46a9c2dd9c81e7fb1930b990b7b55c220045d143cf74c4d41
eb2eef2b6b36030d9ccee4fc669d3a400e9a53dc9b7aee9105e36f3879ce430e
edf4f2a7bcace6b3c2a9efb1ab0165e108206c3f3ef04bdb8bb28e7833ed7db6
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef391572f9fbb7bab7fef6ce2c4fc92ad68a8c148889a79cb9f9b1452d851fab
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
f670bb4075e685a118d47b2a729af67b3f9916d93f8e2a74db953f3ce4336f36
f6819d771c21878ae3342bb2b9a33b695659e77824c9394be7c882b8debc63f2
f781adfea30c3876a3540cbe92d910804408a1926b4140345f13f5ece75dc1a7
f9cd3210e5bda438b977f8f04623629308aa7deb8535f3544955b3db63f299ff
fac79d344dd7977a5a36a889b7edbbf425edf3d849ee295f6fdf7abef47bdaf8
fc46f44565a092c856a6d70471d942caca57598049a85ce80366c1c5831d0f3e
fdc8bdecda1ab3aedaa5bb67da798f0fcdc20dca26b280dafc3da7006db0c90b
fed9797c6cf467d34177d2661e16d74c396764883bcdafc50c9969fbe4f8b241
fef8f00d7ff361898d09f4b65d83bb2099ffaf35a94346aaf9be9e04194c86a6