pastelink.net Open in urlscan Pro
89.35.29.15 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pastelink.net/6brvsep8
Submission: On December 06 via manual (December 6th 2022, 4:31:16 pm UTC) from US — Scanned from NZ

Summary HTTP 236 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 54 IPs in 10 countries across 67 domains to perform 236 HTTP transactions. The main IP is 89.35.29.15, located in London, United Kingdom and belongs to BANDWIDTH-AS, GB. The main domain is pastelink.net. The Cisco Umbrella rank of the primary domain is 120966.
TLS certificate: Issued by R3 on December 2nd 2022. Valid for: 3 months.

This is the only time pastelink.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
12	89.35.29.15 89.35.29.15	25369 (BANDWIDTH-AS) (BANDWIDTH-AS)
4	74.125.24.95 74.125.24.95	15169 (GOOGLE) (GOOGLE)
1	69.16.175.10 69.16.175.10	20446 (STACKPATH...) (STACKPATH-CDN)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	172.67.202.177 172.67.202.177	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	142.251.12.97 142.251.12.97	15169 (GOOGLE) (GOOGLE)
10	172.217.194.94 172.217.194.94	15169 (GOOGLE) (GOOGLE)
17	142.250.4.154 142.250.4.154	15169 (GOOGLE) (GOOGLE)
1 3	54.192.148.120 54.192.148.120	16509 (AMAZON-02) (AMAZON-02)
1	13.35.18.36 13.35.18.36	16509 (AMAZON-02) (AMAZON-02)
5	142.251.12.138 142.251.12.138	15169 (GOOGLE) (GOOGLE)
1	13.249.136.149 13.249.136.149	16509 (AMAZON-02) (AMAZON-02)
1	74.125.68.154 74.125.68.154	15169 (GOOGLE) (GOOGLE)
1	172.217.194.154 172.217.194.154	15169 (GOOGLE) (GOOGLE)
7	172.217.194.155 172.217.194.155	15169 (GOOGLE) (GOOGLE)
5	142.251.10.132 142.251.10.132	15169 (GOOGLE) (GOOGLE)
1	13.224.250.68 13.224.250.68	16509 (AMAZON-02) (AMAZON-02)
1	172.67.38.106 172.67.38.106	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	142.250.4.132 142.250.4.132	15169 (GOOGLE) (GOOGLE)
5	23.108.101.160 23.108.101.160	59253 (LEASEWEB-...) (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd.)
10	104.65.229.95 104.65.229.95	16625 (AKAMAI-AS) (AKAMAI-AS)
5	142.251.12.157 142.251.12.157	15169 (GOOGLE) (GOOGLE)
2 15	52.46.155.104 52.46.155.104	16509 (AMAZON-02) (AMAZON-02)
13	185.84.60.20 185.84.60.20	198622 (ADFORM) (ADFORM)
2	199.232.46.132 199.232.46.132	54113 (FASTLY) (FASTLY)
1	141.95.33.111 141.95.33.111	16276 (OVH) (OVH)
1	141.95.98.64 141.95.98.64	16276 (OVH) (OVH)
17	185.84.60.57 185.84.60.57	198622 (ADFORM) (ADFORM)
2	18.141.78.38 18.141.78.38	16509 (AMAZON-02) (AMAZON-02)
1	142.250.4.99 142.250.4.99	15169 (GOOGLE) (GOOGLE)
2	23.36.49.189 23.36.49.189	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	18.155.68.72 18.155.68.72	16509 (AMAZON-02) (AMAZON-02)
2 2	35.213.12.39 35.213.12.39	15169 (GOOGLE) (GOOGLE)
2 2	34.83.125.63 34.83.125.63	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	23.36.48.24 23.36.48.24	16625 (AKAMAI-AS) (AKAMAI-AS)
5 5	64.202.112.255 64.202.112.255	23352 (SERVERCEN...) (SERVERCENTRAL)
2 2	23.207.181.216 23.207.181.216	16625 (AKAMAI-AS) (AKAMAI-AS)
4 9	54.254.5.67 54.254.5.67	16509 (AMAZON-02) (AMAZON-02)
2	104.65.228.208 104.65.228.208	16625 (AKAMAI-AS) (AKAMAI-AS)
2	23.9.185.218 23.9.185.218	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	199.187.193.197 199.187.193.197	47043 (SMARTADSE...) (SMARTADSERVER)
2 2	89.207.22.137 89.207.22.137	399104 (CNVR-APAC) (CNVR-APAC)
6	38.133.127.63 38.133.127.63	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	162.19.138.117 162.19.138.117	16276 (OVH) (OVH)
7 7	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
2 2	103.71.26.126 103.71.26.126	132134 (SPOTX-AS-...) (SPOTX-AS-AP SpotXchange)
1	67.199.150.81 67.199.150.81	3257 (GTT-BACKB...) (GTT-BACKBONE GTT)
5 9	69.173.158.64 69.173.158.64	26667 (RUBICONPR...) (RUBICONPROJECT)
2	23.49.60.145 23.49.60.145	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 2	103.229.206.241 103.229.206.241	30419 (MEDIAMATH...) (MEDIAMATH-INC)
5	67.199.150.86 67.199.150.86	3257 (GTT-BACKB...) (GTT-BACKBONE GTT)
5 7	142.251.10.156 142.251.10.156	15169 (GOOGLE) (GOOGLE)
3 5	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
2 2	107.178.254.65 107.178.254.65	15169 (GOOGLE) (GOOGLE)
1 1	34.98.67.3 34.98.67.3	() ()
2	67.199.150.85 67.199.150.85	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	44.238.192.116 44.238.192.116	16509 (AMAZON-02) (AMAZON-02)
2 2	8.43.72.97 8.43.72.97	26667 (RUBICONPR...) (RUBICONPROJECT)
1	52.95.126.160 52.95.126.160	16509 (AMAZON-02) (AMAZON-02)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.33.33.31 13.33.33.31	16509 (AMAZON-02) (AMAZON-02)
2 2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
2 2	104.254.148.252 104.254.148.252	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	54.179.72.137 54.179.72.137	16509 (AMAZON-02) (AMAZON-02)
1	35.79.171.96 35.79.171.96	16509 (AMAZON-02) (AMAZON-02)
1	44.231.207.188 44.231.207.188	16509 (AMAZON-02) (AMAZON-02)
1	35.79.79.30 35.79.79.30	16509 (AMAZON-02) (AMAZON-02)
1	182.161.73.146 182.161.73.146	() ()
2	52.45.196.192 52.45.196.192	() ()
236	54

12 89.35.29.15 (London, United Kingdom)

ASN25369 (BANDWIDTH-AS, GB)
PTR: 15.29.35.89.baremetal.zare.com

pastelink.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 74.125.24.95 (United States)

ASN15169 (GOOGLE, US)
PTR: sf-in-f95.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.16.175.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: tlb.hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.67.202.177 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.adligature.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.12.97 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f97.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 172.217.194.94 (United States)

ASN15169 (GOOGLE, US)
PTR: si-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 142.250.4.154 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f154.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.192.148.120 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-54-192-148-120.sin2.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.18.36 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-18-36.sin5.r.cloudfront.net

d3div1mtym39ic.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.251.12.138 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f138.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.249.136.149 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-249-136-149.ord51.r.cloudfront.net

aax-dtb-cf.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.68.154 (United States)

ASN15169 (GOOGLE, US)
PTR: sc-in-f154.1e100.net

adservice.google.co.nz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.194.154 (United States)

ASN15169 (GOOGLE, US)
PTR: si-in-f154.1e100.net

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.217.194.155 (United States)

ASN15169 (GOOGLE, US)
PTR: si-in-f155.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.251.10.132 (United States)

ASN15169 (GOOGLE, US)
PTR: sd-in-f132.1e100.net

f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.250.68 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-250-68.sin52.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.38.106 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 142.250.4.132 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f132.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.108.101.160 (Singapore, Singapore)

ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG)

b1-sindc1.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b1t-sindc1.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.65.229.95 (Singapore, Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a104-65-229-95.deploy.static.akamaitechnologies.com

widgets.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
widget-pixels.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.251.12.157 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f157.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 52.46.155.104 (Ashburn, United States) 2 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 185.84.60.20 (Denmark)

ASN198622 (ADFORM, DK)

asia.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.232.46.132 (Singapore, Singapore)

ASN54113 (FASTLY, US)

zem.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
odb.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.33.111 (Germany)

ASN16276 (OVH, FR)
PTR: ns3203177.ip-141-95-33.eu

lb.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.98.64 (France)

ASN16276 (OVH, FR)
PTR: ns3216658.ip-141-95-98.eu

lbs.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 185.84.60.57 (Denmark)

ASN198622 (ADFORM, DK)

s2.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.141.78.38 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-141-78-38.ap-southeast-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.4.99 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f99.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.36.49.189 (Singapore, Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-49-189.deploy.static.akamaitechnologies.com

tcheck.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.155.68.72 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-155-68-72.sin52.r.cloudfront.net

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.213.12.39 (Tokyo, Japan) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 39.12.213.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.83.125.63 (The Dalles, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 63.125.83.34.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.36.48.24 (Singapore, Singapore) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-48-24.deploy.static.akamaitechnologies.com

cs.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 64.202.112.255 (United States) 5 redirects

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.207.181.216 (Singapore, Singapore) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-207-181-216.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 54.254.5.67 (Singapore, Singapore) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-254-5-67.ap-southeast-1.compute.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.65.228.208 (Singapore, Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a104-65-228-208.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.9.185.218 (Singapore, Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a23-9-185-218.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.187.193.197 (Canada) 1 redirects

ASN47043 (SMARTADSERVER, CA)

ssbsync-us.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 89.207.22.137 (Singapore, Singapore) 2 redirects

ASN399104 (CNVR-APAC, US)
PTR: sin03-usadmm-ds.dotomi.com

amazon-tam-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 38.133.127.63 (United States)

ASN22075 (AS-OUTBRAIN, US)

log.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mcdp-sadc1.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.138.117 (France)

ASN16276 (OVH, FR)
PTR: ns31533568.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 52.223.40.198 (United States) 7 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.71.26.126 (Singapore, Singapore) 2 redirects

ASN132134 (SPOTX-AS-AP SpotXchange, Inc, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.199.150.81 (Los Angeles, United States)

ASN3257 (GTT-BACKBONE GTT, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 69.173.158.64 (Singapore, Singapore) 5 redirects

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.49.60.145 (Singapore, Singapore)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-49-60-145.deploy.static.akamaitechnologies.com

code.createjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.229.206.241 (Singapore) 2 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 67.199.150.86 (Los Angeles, United States)

ASN3257 (GTT-BACKBONE GTT, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.251.10.156 (United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: sd-in-f156.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.190.60.146 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.254.65 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.3 (None, ) 1 redirects

ASN- ()

tags.rd.linksynergy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 67.199.150.85 (Los Angeles, United States)

ASN62713 (AS-PUBMATIC, US)

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
simage4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.238.192.116 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-44-238-192-116.us-west-2.compute.amazonaws.com

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 8.43.72.97 (United States) 2 redirects

ASN26667 (RUBICONPROJECT, US)

pixel-us-east.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.95.126.160 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

aax-eu.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.33.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-33-31.sin2.r.cloudfront.net

rock.defybrick.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.254.148.252 (Los Angeles, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.179.72.137 (Singapore, Singapore) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-179-72-137.ap-southeast-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.79.171.96 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-79-171-96.ap-northeast-1.compute.amazonaws.com

sync-jp.im-apps.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.231.207.188 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-231-207-188.us-west-2.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.79.79.30 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-79-79-30.ap-northeast-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 182.161.73.146 (None, )

ASN- ()

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.45.196.192 (None, )

ASN- ()

flint.defybrick.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	adform.net asia.adform.net — Cisco Umbrella Rank: 42946 s2.adform.net — Cisco Umbrella Rank: 5169 c1.adform.net — Cisco Umbrella Rank: 718	463 KB
27	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 109 f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 144	114 KB
24	doubleclick.net 5 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 203 cm.g.doubleclick.net — Cisco Umbrella Rank: 234	211 KB
20	amazon-adsystem.com 3 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 333 aax-dtb-cf.amazon-adsystem.com — Cisco Umbrella Rank: 552 s.amazon-adsystem.com — Cisco Umbrella Rank: 302 aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 1057	17 KB
16	outbrain.com widgets.outbrain.com — Cisco Umbrella Rank: 1408 widget-pixels.outbrain.com — Cisco Umbrella Rank: 3188 odb.outbrain.com — Cisco Umbrella Rank: 1598 mcdp-sadc1.outbrain.com — Cisco Umbrella Rank: 2867 sync.outbrain.com	110 KB
13	rubiconproject.com 7 redirects eus.rubiconproject.com — Cisco Umbrella Rank: 587 token.rubiconproject.com — Cisco Umbrella Rank: 615 pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 1178 pixel.rubiconproject.com — Cisco Umbrella Rank: 351	18 KB
12	pastelink.net pastelink.net — Cisco Umbrella Rank: 120966	221 KB
10	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 533 image6.pubmatic.com — Cisco Umbrella Rank: 734 simage2.pubmatic.com — Cisco Umbrella Rank: 723 image4.pubmatic.com — Cisco Umbrella Rank: 982 image2.pubmatic.com — Cisco Umbrella Rank: 1051 image8.pubmatic.com Failed simage4.pubmatic.com — Cisco Umbrella Rank: 1288	26 KB
10	zemanta.com 5 redirects b1-sindc1.zemanta.com — Cisco Umbrella Rank: 43745 b1t-sindc1.zemanta.com — Cisco Umbrella Rank: 31701 b1sync.zemanta.com — Cisco Umbrella Rank: 617	3 KB
10	gstatic.com fonts.gstatic.com	111 KB
9	sharethrough.com 4 redirects match.sharethrough.com — Cisco Umbrella Rank: 557	3 KB
7	adsrvr.org 7 redirects match.adsrvr.org — Cisco Umbrella Rank: 364	4 KB
5	rlcdn.com 3 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 392 id.rlcdn.com Failed	645 B
5	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 190	234 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 38	20 KB
4	outbrainimg.com zem.outbrainimg.com — Cisco Umbrella Rank: 2734 tcheck.outbrainimg.com — Cisco Umbrella Rank: 9324 log.outbrainimg.com — Cisco Umbrella Rank: 2661 images.outbrainimg.com — Cisco Umbrella Rank: 2417	49 KB
4	adligature.com cdn.adligature.com — Cisco Umbrella Rank: 80526	144 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 51	15 KB
3	defybrick.com rock.defybrick.com — Cisco Umbrella Rank: 10436 flint.defybrick.com	20 KB
3	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 1271 bcp.crwdcntrl.net — Cisco Umbrella Rank: 1050 sync.crwdcntrl.net	11 KB
2	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 222	2 KB
2	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 238	2 KB
2	openx.net 2 redirects us-u.openx.net — Cisco Umbrella Rank: 468	402 B
2	yahoo.com 1 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 495 ups.analytics.yahoo.com Failed	1 KB
2	pippio.com 2 redirects pippio.com — Cisco Umbrella Rank: 788	718 B
2	mathtag.com 2 redirects sync.mathtag.com — Cisco Umbrella Rank: 509	1 KB
2	createjs.com code.createjs.com — Cisco Umbrella Rank: 1435	125 KB
2	spotxchange.com 2 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 620	1 KB
2	dotomi.com 2 redirects amazon-tam-match.dotomi.com — Cisco Umbrella Rank: 5659	655 B
2	bluekai.com 2 redirects stags.bluekai.com — Cisco Umbrella Rank: 579	2 KB
2	simpli.fi 2 redirects um.simpli.fi — Cisco Umbrella Rank: 985	1 KB
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 322	1 KB
2	eu-1-id5-sync.com lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 1209 lbs.eu-1-id5-sync.com — Cisco Umbrella Rank: 1431	680 B
2	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 1107 id5-sync.com — Cisco Umbrella Rank: 476	18 KB
2	google.com adservice.google.com — Cisco Umbrella Rank: 87 www.google.com — Cisco Umbrella Rank: 2	2 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 65	144 KB
1	criteo.com dis.criteo.com	363 B
1	agkn.com aa.agkn.com — Cisco Umbrella Rank: 507	500 B
1	krxd.net beacon.krxd.net — Cisco Umbrella Rank: 601	338 B
1	im-apps.net sync-jp.im-apps.net — Cisco Umbrella Rank: 4411	194 B
1	linkedin.com px.ads.linkedin.com — Cisco Umbrella Rank: 458	573 B
1	linksynergy.com 1 redirects tags.rd.linksynergy.com	390 B
1	smartadserver.com 1 redirects ssbsync-us.smartadserver.com — Cisco Umbrella Rank: 5465 ssbsync.smartadserver.com Failed	329 B
1	media.net 1 redirects cs.media.net — Cisco Umbrella Rank: 1474	665 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 733	530 B
1	google.co.nz adservice.google.co.nz — Cisco Umbrella Rank: 121207	792 B
1	cloudfront.net d3div1mtym39ic.cloudfront.net	39 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 242	1 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 759	31 KB
0	opera.com Failed t.adx.opera.com Failed
0	mediago.io Failed trace.mediago.io Failed
0	contextweb.com Failed bh.contextweb.com Failed
0	quantserve.com Failed cms.quantserve.com Failed
0	sitescout.com Failed pixel-sync.sitescout.com Failed
0	technoratimedia.com Failed sync.technoratimedia.com Failed
0	bing.com Failed c.bing.com Failed
0	360yield.com Failed ice.360yield.com Failed
0	emxdgt.com Failed cs.emxdgt.com Failed
0	casalemedia.com Failed ssum-sec.casalemedia.com Failed
0	creativecdn.com Failed creativecdn.com Failed
0	geistm.com Failed id.geistm.com Failed
0	eyeota.net Failed ps.eyeota.net Failed
0	adition.com Failed dsp.adfarm1.adition.com Failed
0	kargo.com Failed crb.kargo.com Failed
0	tapad.com Failed pixel.tapad.com Failed
0	mfadsrvr.com Failed rtb.mfadsrvr.com Failed
0	ip-api.com Failed pro.ip-api.com Failed
236	67

	Domain	Requested by
17	s2.adform.net	asia.adform.net s2.adform.net pastelink.net f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
17	securepubads.g.doubleclick.net	cdn.adligature.com securepubads.g.doubleclick.net pastelink.net
15	s.amazon-adsystem.com	2 redirects c.amazon-adsystem.com s.amazon-adsystem.com match.sharethrough.com ads.pubmatic.com eus.rubiconproject.com
15	tpc.googlesyndication.com	securepubads.g.doubleclick.net f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com tpc.googlesyndication.com
12	asia.adform.net	f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com s2.adform.net
12	pastelink.net	pastelink.net
10	fonts.gstatic.com	fonts.googleapis.com
9	match.sharethrough.com	4 redirects s.amazon-adsystem.com match.sharethrough.com
9	widgets.outbrain.com	f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com securepubads.g.doubleclick.net widgets.outbrain.com pastelink.net
7	cm.g.doubleclick.net	5 redirects eus.rubiconproject.com
7	match.adsrvr.org	7 redirects
7	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
5	idsync.rlcdn.com	3 redirects ads.pubmatic.com widgets.outbrain.com
5	token.rubiconproject.com	4 redirects eus.rubiconproject.com
5	b1sync.zemanta.com	5 redirects
5	www.googletagservices.com	f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com securepubads.g.doubleclick.net
5	f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	sync.outbrain.com	widgets.outbrain.com
4	pixel.rubiconproject.com	1 redirects eus.rubiconproject.com
4	cdn.adligature.com	pastelink.net cdn.adligature.com
4	fonts.googleapis.com	pastelink.net s2.adform.net
3	image2.pubmatic.com	ads.pubmatic.com
3	b1-sindc1.zemanta.com	pastelink.net
3	c.amazon-adsystem.com	1 redirects c.amazon-adsystem.com
2	flint.defybrick.com	rock.defybrick.com pastelink.net
2	dpm.demdex.net	1 redirects widgets.outbrain.com
2	ib.adnxs.com	2 redirects
2	us-u.openx.net	2 redirects
2	pixel-us-east.rubiconproject.com	2 redirects
2	pr-bh.ybp.yahoo.com	1 redirects ads.pubmatic.com
2	pippio.com	2 redirects
2	simage2.pubmatic.com	ads.pubmatic.com
2	sync.mathtag.com	2 redirects
2	code.createjs.com	s2.adform.net
2	sync.search.spotxchange.com	2 redirects
2	amazon-tam-match.dotomi.com	2 redirects
2	eus.rubiconproject.com	s.amazon-adsystem.com eus.rubiconproject.com
2	ads.pubmatic.com	s.amazon-adsystem.com ads.pubmatic.com
2	stags.bluekai.com	2 redirects
2	um.simpli.fi	2 redirects
2	x.bidswitch.net	2 redirects
2	b1t-sindc1.zemanta.com	f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com widgets.outbrain.com
2	www.googletagmanager.com	pastelink.net www.googletagmanager.com
1	simage4.pubmatic.com	ads.pubmatic.com
1	sync.crwdcntrl.net	widgets.outbrain.com
1	dis.criteo.com	widgets.outbrain.com
1	aa.agkn.com	widgets.outbrain.com
1	beacon.krxd.net	widgets.outbrain.com
1	sync-jp.im-apps.net	widgets.outbrain.com
1	images.outbrainimg.com	pastelink.net
1	rock.defybrick.com	widgets.outbrain.com
1	mcdp-sadc1.outbrain.com	widgets.outbrain.com
1	px.ads.linkedin.com	eus.rubiconproject.com
1	aax-eu.amazon-adsystem.com	eus.rubiconproject.com
1	image4.pubmatic.com	ads.pubmatic.com
1	tags.rd.linksynergy.com	1 redirects
1	c1.adform.net	ads.pubmatic.com
1	image6.pubmatic.com	ads.pubmatic.com
1	odb.outbrain.com	widgets.outbrain.com
1	id5-sync.com	cdn.id5-sync.com widgets.outbrain.com
1	log.outbrainimg.com	widgets.outbrain.com
1	ssbsync-us.smartadserver.com	1 redirects
1	cs.media.net	1 redirects
1	s.ad.smaato.net	1 redirects widgets.outbrain.com
1	widget-pixels.outbrain.com	pastelink.net
1	tcheck.outbrainimg.com	widgets.outbrain.com
1	www.google.com	tpc.googlesyndication.com
1	bcp.crwdcntrl.net	tags.crwdcntrl.net
1	lbs.eu-1-id5-sync.com	cdn.id5-sync.com
1	lb.eu-1-id5-sync.com	cdn.id5-sync.com
1	zem.outbrainimg.com	f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
1	cdn.id5-sync.com	pastelink.net
1	tags.crwdcntrl.net	pastelink.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.co.nz	securepubads.g.doubleclick.net
1	aax-dtb-cf.amazon-adsystem.com	c.amazon-adsystem.com
1	d3div1mtym39ic.cloudfront.net	pastelink.net
1	cdnjs.cloudflare.com	pastelink.net
1	code.jquery.com	pastelink.net
0	t.adx.opera.com Failed	widgets.outbrain.com
0	trace.mediago.io Failed	widgets.outbrain.com
0	bh.contextweb.com Failed	widgets.outbrain.com
0	cms.quantserve.com Failed	widgets.outbrain.com
0	pixel-sync.sitescout.com Failed	widgets.outbrain.com
0	id.rlcdn.com Failed	widgets.outbrain.com
0	sync.technoratimedia.com Failed	widgets.outbrain.com
0	c.bing.com Failed	widgets.outbrain.com
0	ssbsync.smartadserver.com Failed	widgets.outbrain.com
0	ice.360yield.com Failed	widgets.outbrain.com
0	cs.emxdgt.com Failed	widgets.outbrain.com
0	ups.analytics.yahoo.com Failed	widgets.outbrain.com
0	image8.pubmatic.com Failed	widgets.outbrain.com
0	ssum-sec.casalemedia.com Failed	widgets.outbrain.com
0	creativecdn.com Failed	widgets.outbrain.com
0	id.geistm.com Failed	widgets.outbrain.com
0	ps.eyeota.net Failed	widgets.outbrain.com
0	dsp.adfarm1.adition.com Failed	widgets.outbrain.com
0	crb.kargo.com Failed	widgets.outbrain.com
0	pixel.tapad.com Failed	widgets.outbrain.com
0	rtb.mfadsrvr.com Failed	widgets.outbrain.com
0	pro.ip-api.com Failed	cdn.adligature.com
236	102

This site contains links to these domains. Also see Links.

Domain
doyencxbo150.bravesites.com
www.pinterest.com
search.sunbiz.org
www.wikidata.org
www.facebook.com
twitter.com
t.me
api.whatsapp.com
www.reddit.com
www.tumblr.com
www.blogger.com
profitquery.com
www.linkedin.com
share.flipboard.com
social-plugins.line.me
www.meneame.net
diasp.org

Subject Issuer	Validity	Valid
pastelink.net R3	`2022-12-02` - `2023-03-02`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-18`	a year	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon	`2022-06-15` - `2023-06-15`	a year	crt.sh
*.google.co.nz GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.crwdcntrl.net Go Daddy Secure Certificate Authority - G2	`2022-05-01` - `2023-06-02`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.zemanta.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-16` - `2023-09-06`	a year	crt.sh
*.outbrain.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-03` - `2023-04-04`	a year	crt.sh
s.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-21`	a year	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2022-09-20` - `2023-09-20`	a year	crt.sh
*.outbrainimg.com R3	`2022-12-03` - `2023-03-03`	3 months	crt.sh
*.eu-1-id5-sync.com R3	`2022-11-09` - `2023-02-07`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.sharethrough.com Amazon	`2022-10-24` - `2023-11-21`	a year	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2022-02-04` - `2023-02-03`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-17` - `2023-04-04`	a year	crt.sh
*.id5-sync.com R3	`2022-11-09` - `2023-02-07`	3 months	crt.sh
tls.adobe.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-29` - `2023-05-30`	a year	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-11-08` - `2023-05-03`	6 months	crt.sh
aax-eu.amazon-adsystem.com Amazon	`2022-07-20` - `2023-07-19`	a year	crt.sh
rock.defybrick.com Amazon	`2022-05-09` - `2023-06-07`	a year	crt.sh
*.im-apps.net Amazon	`2022-04-25` - `2023-05-24`	a year	crt.sh
beacon.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2022-10-20` - `2023-10-19`	a year	crt.sh
*.agkn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-09-06` - `2023-09-21`	a year	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-10-31` - `2023-01-26`	3 months	crt.sh
*.defybrick.com ZeroSSL ECC Domain Secure Site CA	`2022-11-25` - `2023-02-23`	3 months	crt.sh

This page contains 24 frames:

Primary Page: https://pastelink.net/6brvsep8
Frame ID: A159B1E038B2726E26E23B134524FB27
Requests: 65 HTTP requests in this frame

Frame: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: ECD13B9F4F557C8A9C3C587DCF34ED23
Requests: 1 HTTP requests in this frame

Frame: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: B1203AA2C082B3056A84931798DD1D74
Requests: 15 HTTP requests in this frame

Frame: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: A697D94DEBF8EE4EA1B18AB0466B660F
Requests: 15 HTTP requests in this frame

Frame: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 9A7D42987563265ADEE39AB63251EEAC
Requests: 15 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain&dcc=t
Frame ID: F236C20908A0CDE0BD80564CAE2C16F9
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss_nmu5Jq4JY5gFPHaBBlENWGBihin_XMqC_MoU52oA-OS50OvwtTh-fqMOzW-kQlSkyI0bBVrI3b6HmvaXZmK-xOuDiF6pbQ-j1Ca_GEAGjAe1Z1iPGdwqa0v4poMR3KMPof7ix_eJw4wStgVdhLUh31PuWOtMXeih2vKj0MH5P2haCykh5cQGDylKDQdyvHZOYNLbLchpqV9qRuWr2FoWys_1_AIixb03AqB1UuCpG0p2zVtA0E3ow1YyMEXIXoqFU0ypuLMD9J_c5n1bVX5tqzHhDF95g9iXZ2Y5OiiocZOWqjdhsA_WHxN4o_zhr2nkQKe0mL1XNlF5P2Lv4qE&sai=AMfl-YRnzaTYaPzeoF9F0KU07m-7eEtdD5fqIky2LrefiG7jPZlji0EIVsE1WwVbntp1qc_ycWAxCbgZktwx4sSJsuIbnbO0F0ie1kF_Muj6G3NeJva4ou7Sq_FN9ttb_1YuT0Y16g&sig=Cg0ArKJSzNDH_v-2ml94EAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: 2B854B1742C73F5DA47D8616CA149DE4
Requests: 15 HTTP requests in this frame

Frame: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: C2B033A4099AA39418FD4C7D57670E8E
Requests: 13 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 9186F64E10620F61434EB9C6BF309946
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 4CBC9AC5445F7113F857FB7138786C17
Requests: 2 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Frame ID: 9B6AFDE710E39B9F4C43E6AC4FE935D0
Requests: 6 HTTP requests in this frame

Frame: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Frame ID: 3B255A7C3BE0F037268AC560D324FD8C
Requests: 6 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Frame ID: 91E8AC612FE1EAD5FD5884A496ACDCDE
Requests: 11 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Frame ID: E81BB6E698ABE7C471C7B6639958B5DC
Requests: 12 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4391157641653952304&gdpr=0&gdpr_consent=
Frame ID: AAF391032D2962C2F042A4968246E64E
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAALp5fZQ7v81wM8fcZPAAAAAAA&expiration=1670430671&is_secure=true
Frame ID: E4D1152FEEE44F19871DDDA2D8691DC3
Requests: 1 HTTP requests in this frame

Frame: https://s2.adform.net/Banners/Elements/Files/2111416/11240091/11240091.js?ADFassetID=11240091&bv=513
Frame ID: 8CDD1F07BEBA6E2AB61D74C215774417
Requests: 8 HTTP requests in this frame

Frame: https://s2.adform.net/Banners/Elements/Files/2111416/11240088/11240088.js?ADFassetID=11240088&bv=513
Frame ID: 9CD06B23E0872A1A59E16299A8DB58A9
Requests: 8 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?party=14&cid=44E18C09-7587-44A4-8BE6-C5026AC544A2&gdpr=0&gdpr_consent=
Frame ID: 8167FB3A09FF1648FC5D9CEAC4250315
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3029638f-6e50-4a00-a015-5da045eeed90&gdpr=0&gdpr_consent=
Frame ID: 1CA214705F60F74789095231083448A5
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID44E18C09-7587-44A4-8BE6-C5026AC544A2
Frame ID: 82960EDF095E3A01A09D3968E3099754
Requests: 1 HTTP requests in this frame

Frame: https://widgets.outbrain.com/nanoWidget/externals/obUserFrame/test.html?lsd=f73d11c3-6579-475d-b002-34b84b12988e
Frame ID: EFCDD59D0444F8A23EF5EFE61FDB6B80
Requests: 1 HTTP requests in this frame

Frame: https://widgets.outbrain.com/nanoWidget/externals/cookie/test.html
Frame ID: 9A8EBEBECCF1462DCD4728118196C968
Requests: 2 HTTP requests in this frame

Frame: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Frame ID: 546D76A3181F754E81BC5D85CCFF40E9
Requests: 36 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Tevfik Arif tips on investing in Turkish real estate - Pastelink.net

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Outbrain (Widgets) Expand

Overall confidence: 100%
Detected patterns

widgets\.outbrain\.com/outbrain\.js

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

/prebid\.js

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

236
Requests

75 %
HTTPS

0 %
IPv6

67
Domains

102
Subdomains

54
IPs

10
Countries

2142 kB
Transfer

5112 kB
Size

73
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: http://doyencxbo150.bravesites.com/
Title: http://doyencxbo150.bravesites.com/

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/pin/359725088988546308/
Title: https://www.pinterest.com/pin/359725088988546308/

Search URL Search Domain Scan URL

URL: http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResults?inquiryType=EntityName&inquiryDirectionType=CurrentList&searchTerm=BAYRON
Title: http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResults?inquiryType=EntityName&inquiryDirectionType=CurrentList&searchTerm=BAYRON

Search URL Search Domain Scan URL

URL: https://www.wikidata.org/wiki/Q28124187
Title: https://www.wikidata.org/wiki/Q28124187

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://pastelink.net/6brvsep8

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=%20https://pastelink.net/6brvsep8

Search URL Search Domain Scan URL

URL: https://t.me/share/url?url=%20%0Ahttps://pastelink.net/6brvsep8

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=%20https://pastelink.net/6brvsep8

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://https://pastelink.net/6brvsep8&title=%20

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/pin/create/button/?url=https://pastelink.net/6brvsep8&description=%20&media=https://pastelink.net/assets/images/pastelink-logo-square.png

Search URL Search Domain Scan URL

URL: http://www.tumblr.com/share?v=3&u=https://pastelink.net/6brvsep8&t=%20&posttype=link

Search URL Search Domain Scan URL

URL: https://www.blogger.com/blog-this.g?u=https://pastelink.net/6brvsep8&n=%20

Search URL Search Domain Scan URL

URL: https://profitquery.com/add-to/livejournal/?url=https://pastelink.net/6brvsep8&title=%20

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https://pastelink.net/6brvsep8

Search URL Search Domain Scan URL

URL: https://share.flipboard.com/bookmarklet/popout?v=2&title=%20&url=https://pastelink.net/6brvsep8

Search URL Search Domain Scan URL

URL: https://social-plugins.line.me/lineit/share?url=https://pastelink.net/6brvsep8&text=%20

Search URL Search Domain Scan URL

URL: https://www.meneame.net/submit?url=https://pastelink.net/6brvsep8

Search URL Search Domain Scan URL

URL: https://diasp.org/bookmarklet?url=https://pastelink.net/6brvsep8&title=%20&jump=doclose

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 31

https://c.amazon-adsystem.com/aax2/apstag.js HTTP 301
https://d3div1mtym39ic.cloudfront.net/aax2/apstag.js

Request Chain 69

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain&dcc=t

Request Chain 113

https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=ae86389a

Request Chain 114

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D HTTP 302
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=471b34de-8dc7-4692-bfae-4535f8d261a3

Request Chain 115

https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D HTTP 302
https://s.amazon-adsystem.com/ecm3?id=2A98FD745A1B4AF8AE7DB3D2EBC1B256&ex=simpli.fi&status=ok

Request Chain 116

https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3133458717443696000V10

Request Chain 117

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__ HTTP 302
https://stags.bluekai.com/site/23178?id=Lwq7BAKDzSlALlB6Qdna&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZSXQY3IMFXGOZJ5MFWWC6TPNZPXIYLNEZUWIPKMO5YTOQSBJNCHUU3MIFGGYQRWKFSG4YI HTTP 302
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZSXQY3IMFXGOZJ5MFWWC6TPNZPXIYLNEZUWIPKMO5YTOQSBJNCHUU3MIFGGYQRWKFSG4YI HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=Lwq7BAKDzSlALlB6Qdna

Request Chain 121

https://ssbsync-us.smartadserver.com/api/sync?callerId=2 HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4391157641653952304&gdpr=0&gdpr_consent=

Request Chain 122

https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D HTTP 302
https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=155d84e820ae1b0e&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAALp5fZQ7v81wM8fcZPAAAAAAA&expiration=1670430671&is_secure=true

Request Chain 135

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1 HTTP 302
https://b1sync.zemanta.com/usersync/sharethrough?gdpr=0&gdpr_consent= HTTP 302
https://stags.bluekai.com/site/23178?id=MHwbB1ok78yc3gqJKnDs&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS63LBORRWQLTTNBQXEZLUNBZG65LHNAXGG33NF5ZXS3TDF53DCP3FPBRWQYLOM5ST243IMFZGK5DIOJXXKZ3IEZTWI4DSHUYCM43POVZGGZK7NFSD2YJXHEZTKMZQGU4DCNDGHBRTKZJSMEZTIYTBGU2CM43POVZGGZK7OVZWK4S7NFSD2TKIO5REEMLPNM3TQ6LDGNTXCSSLNZCHG&gdpr=0 HTTP 302
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS63LBORRWQLTTNBQXEZLUNBZG65LHNAXGG33NF5ZXS3TDF53DCP3FPBRWQYLOM5ST243IMFZGK5DIOJXXKZ3IEZTWI4DSHUYCM43POVZGGZK7NFSD2YJXHEZTKMZQGU4DCNDGHBRTKZJSMEZTIYTBGU2CM43POVZGGZK7OVZWK4S7NFSD2TKIO5REEMLPNM3TQ6LDGNTXCSSLNZCHG HTTP 302
https://match.sharethrough.com/sync/v1?gdpr=0&source_id=a7935305814f8c5e2a34ba54&source_user_id=MHwbB1ok78yc3gqJKnDs

Request Chain 136

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=

Request Chain 137

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=8499&redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3Dk1jJghvBi79yX1NZ2sM5fXrm%26source_user_id%3D%24SPOTX_USER_ID HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=8499&redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3Dk1jJghvBi79yX1NZ2sM5fXrm%26source_user_id%3D%24SPOTX_USER_ID&__user_check__=1&sync_id=65cc15fd-7583-11ed-8059-10e583b00307 HTTP 302
https://match.sharethrough.com/sync/v1?source_id=k1jJghvBi79yX1NZ2sM5fXrm&source_user_id=65cc15b1-7583-11ed-8059-10e583b00307

Request Chain 138

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=deb3cc24-b269-4904-b0b7-618fe5c8ea83&gdpr=0&gdpr_consent=

Request Chain 160

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3029638f-6e50-4a00-a015-5da045eeed90&gdpr=0&gdpr_consent=

Request Chain 162

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=ROGMCXWHRKSL5sUCasVEog%3D%3D&gdpr=0&gdpr_consent= HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

Request Chain 163

https://idsync.rlcdn.com/420486.gif?partner_uid=44E18C09-7587-44A4-8BE6-C5026AC544A2 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJDQ0RTE4QzA5LTc1ODctNDRBNC04QkU2LUM1MDI2QUM1NDRBMhAAGg0I0Ny9nAYSBQjoBxAAQgBKAA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=42a6034dfd996077b9095cfdf12eb2f9ff45ead9e4c6a799e0c1e6c5bdc5e85c791426b5417dce21&_=2 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA0MmE2MDM0ZGZkOTk2MDc3YjkwOTVjZmRmMTJlYjJmOWZmNDVlYWQ5ZTRjNmE3OTllMGMxZTZjNWJkYzVlODVjNzkxNDI2YjU0MTdkY2UyMRAAGgwI0dy9nAYSBAgCEABCAEoA HTTP 302
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA0MmE2MDM0ZGZkOTk2MDc3YjkwOTVjZmRmMTJlYjJmOWZmNDVlYWQ5ZTRjNmE3OTllMGMxZTZjNWJkYzVlODVjNzkxNDI2YjU0MTdkY2UyMRAAGgwI0dy9nAYSBAgCEABCAEoA&google_gid=CAESEKG3N5DySB3ACdyOYzY7Dns&google_cver=1 HTTP 307
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
https://idsync.rlcdn.com/458249.gif?partner_uid=0472ab86-463e-49a2-92cd-a95c05201748

Request Chain 164

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=1104638f-6e50-4200-86b1-632afc2acc2c

Request Chain 165

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NDRFMThDMDktNzU4Ny00NEE0LThCRTYtQzUwMjZBQzU0NEEy&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 166

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK74ruw0sCJbz4uVpDu_dA4&google_cver=1

Request Chain 167

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:2A98FD745A1B4AF8AE7DB3D2EBC1B256

Request Chain 169

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=

Request Chain 170

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=LBCFUPAL-1R-9PLK HTTP 302
https://s.amazon-adsystem.com/ecm3?id=LBCFUPAL-1R-9PLK&ex=d-rubiconproject.com&status=ok

Request Chain 172

https://match.adsrvr.org/track/cmf/rubicon HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=&expires=30

Request Chain 174

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
https://pr-bh.ybp.yahoo.com/sync/rubicon/ekWRCk-6GdE-CWazLSZhucn5EUdSAgOZEtemQ7w0kco?csrc= HTTP 302
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-P3aCGyNE2oIytHPJPAbzNvV8qCp92yrYROPRLQ--~A

Request Chain 175

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEOH9oClomGk9tk3f1RJ8jp0&google_cver=1

Request Chain 176

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id= HTTP 302
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=hzSbOGDbQWWiqBmROx7ddQ&rk=usync-na HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=hzSbOGDbQWWiqBmROx7ddQ

Request Chain 177

https://token.rubiconproject.com/token?pid=36584 HTTP 302
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LBCFUPAL-1R-9PLK

Request Chain 178

https://token.rubiconproject.com/token?pid=25470 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJDRlVQQUwtMVItOVBMSw==

Request Chain 179

https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=Y2EyYzRiZmVkNjhkZjMwOTUzNWNmNDBhYjEzZTZiMzA5YmU0NWRjNg

Request Chain 195

https://idsync.rlcdn.com/420046.gif?partner_uid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp HTTP 307
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=ffad39a4-649b-4770-a6da-94d43dcda307

Request Chain 196

https://b1sync.zemanta.com/usersync/outbrain/?puid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
https://sync.outbrain.com/cookie-sync?p=zemanta&uid=MHwbB1ok78yc3gqJKnDs&gdpr=0&us_privacy=1---

Request Chain 197

https://ib.adnxs.com/getuid?https://sync.outbrain.com/cookie-sync?p=appnexus&uid=$UID&obUid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dappnexus%26uid%3D%24UID%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1--- HTTP 302
https://sync.outbrain.com/cookie-sync?p=appnexus&uid=7175809292421391107&obUid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_consent=&us_privacy=1---

Request Chain 198

https://dpm.demdex.net/ibs:dpid=133726&dpuuid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_pd=1&gdpr_consent= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=133726&dpuuid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_pd=1&gdpr_consent=

Request Chain 200

https://match.adsrvr.org/track/cmf/generic?ttd_pid=icco6m5&ttd_tpi=1 HTTP 302
https://sync.outbrain.com/cookie-sync?p=ttd&uid=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=

Request Chain 203

https://rtb.mfadsrvr.com/sync?ssp=outbrain&ssp_user_id=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp HTTP 302
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=outbrain&ssp_user_id=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp

Request Chain 204

https://x.bidswitch.net/sync?ssp=outbrain&user_id=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&us_privacy=1---&gdpr=0&gdpr_pd=1&gdpr_consent= HTTP 302
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=471b34de-8dc7-4692-bfae-4535f8d261a3&ssp=outbrain&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10525897493553347199&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.visitorid%3D%24%7BTA_DEVICE_ID%7D%26ssp%3Doutbrain%26gdpr_consent%3D%26gdpr%3D0 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2910&partner_device_id=10525897493553347199&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.visitorid%3D%24%7BTA_DEVICE_ID%7D%26ssp%3Doutbrain%26gdpr_consent%3D%26gdpr%3D0

Request Chain 206

https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&google_dbm HTTP 302
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEMvkmYtYoEh4mew1eSWVChg&google_cver=1 HTTP 302
https://crb.kargo.com/api/v1/bswsync?bsw_uuid=471b34de-8dc7-4692-bfae-4535f8d261a3&dsp_uuid=&dsp_id=&krg_ids=&gdpr=&gdpr_consent=&us_privacy=

Request Chain 211

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=15268&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LBCFUPAL-1R-9PLK&gdpr=0&us_privacy=1---

Request Chain 215

https://u.openx.net/w/1.0/cm?id=00df9f64-6f67-4cae-aeb2-d951da52047c&r=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dopenx%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26uid%3D HTTP 302
https://sync.outbrain.com/cookie-sync?p=openx&gdpr=0&gdpr_consent=&us_privacy=1---&obUid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&uid=1a7a6fc5-d632-4cec-9acc-468abced05f4

236 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 6brvsep8 Show response
pastelink.net/ 31 KB
9 KB 1583ms
790ms Document
text/html 89.35.29.15
BANDWIDTH-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pastelink.net/6brvsep8

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.35.29.15 London, United Kingdom, ASN25369 (BANDWIDTH-AS, GB),

Reverse DNS

15.29.35.89.baremetal.zare.com

Software

nginx /

Resource Hash

e30755c35ef5e6aa6c1e81940e87a921fbab522717f5989f7f8131ef78357605

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 06 Dec 2022 16:31:02 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: SAMEORIGIN

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
773 B 879ms
335ms Stylesheet
text/css 74.125.24.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap

Requested by

Host: pastelink.net
URL: https://pastelink.net/6brvsep8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f95.1e100.net

Software

ESF /

Resource Hash

ebfd96030683611d9ed054682f1ddf8b9098bc7d10105602b338605b0ae82a9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Dec 2022 16:31:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 06 Dec 2022 16:31:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Dec 2022 16:31:03 GMT

GET
H2 200 styles.css
pastelink.net/assets/css/ 121 KB
121 KB 397ms
395ms Stylesheet
text/css 89.35.29.15
BANDWIDTH-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pastelink.net/assets/css/styles.css?q=35

Requested by

Host: pastelink.net
URL: https://pastelink.net/6brvsep8

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.35.29.15 London, United Kingdom, ASN25369 (BANDWIDTH-AS, GB),

Reverse DNS

15.29.35.89.baremetal.zare.com

Software

nginx /

Resource Hash

2d54d98b7aadd5155567c320319c92983229bf9efc7388f5abee37784d0879e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/6brvsep8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 17 Nov 2022 12:00:15 GMT
server: nginx
etag: "6376224f-1e29e"
content-type: text/css
accept-ranges: bytes
content-length: 123550

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
31 KB 838ms
276ms Script
application/javascript 69.16.175.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: tlb.hwcdn.net
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: https://pastelink.net/
Origin: https://pastelink.net
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:03 GMT
content-encoding: gzip
x-sp-metadata: HS256.CNf4vZwGEogBCiQ4NGUwYjlkZC0yNWQxLTRkZDktYTE4OC05YWUwYzFlZjBjMGYQ+OiCoKvU+wIaBgjH3L2cBiINMTE2LjkwLjc0LjE5NiiMhAMwAzgEQhZUTFNfQUVTXzEyOF9HQ01fU0hBMjU2WiAzZTliMjA2MTAwOThiNmM5YmZmOTUzODU2ZTU4MDE2YRosCAESJGY3NDgyYjY5LTg1ZWEtNDIzNi04MjU2LTk0YjI4OTcwY2FkNxib8QE=.2seeHTqrtRZt9FobeH6JEZy2osCEYCf6mavtex64QWE=
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-15d9d"
vary: Accept-Encoding
x-hw: 1670344263.dop108.la3.t,1670344263.cds215.la3.hn,1670344263.cds267.la3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H2 200 script.min.js Show response
pastelink.net/assets/js/ 41 KB
41 KB 395ms
395ms Script
application/javascript 89.35.29.15
BANDWIDTH-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pastelink.net/assets/js/script.min.js?q=35

Requested by

Host: pastelink.net
URL: https://pastelink.net/6brvsep8

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.35.29.15 London, United Kingdom, ASN25369 (BANDWIDTH-AS, GB),

Reverse DNS

15.29.35.89.baremetal.zare.com

Software

nginx /

Resource Hash

190d542d8e593c755fd16e67ca62583e183957829dfb69cc2e00c7bf67df237d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/6brvsep8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 17 Nov 2022 12:00:15 GMT
server: nginx
etag: "6376224f-a225"
content-type: application/javascript
accept-ranges: bytes
content-length: 41509

GET
H2 200 js.cookie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/js-cookie/latest/ 2 KB
1 KB 440ms
150ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/js-cookie/latest/js.cookie.min.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/6brvsep8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b6d244a569a8befc0b901e3dca8e82f19b188e2d3e76f7c62fce96935ed6311

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:03 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 4739193
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 772
last-modified: Mon, 04 May 2020 16:11:49 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec5-6d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OQG9C15bcMQM8G22pKCRvbERPxdDFHEw5bNJMCbtVykdpzN6JVatZJ2i13rfLUHSmP4nu6%2FL4228fJymnR6liMNaupmiNgp8Ro96KAog%2FxREjL6sOo5AQ1jTbEg65%2B%2BdBxZ2zFwo"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 775668dc3e97a979-SYD
expires: Sun, 26 Nov 2023 16:31:03 GMT

GET
H2 200 rules.js Show response
cdn.adligature.com/pl/prod/ 18 KB
5 KB 439ms
149ms Script
application/javascript 172.67.202.177
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/pl/prod/rules.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.202.177 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 95b79ad7efde1e0051f941e69fa5dfbc0e6fbb86fc6dc40f9dc534a56f394371

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:03 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 537
cf-polished: origSize=30189
x-guploader-uploadid: ADPycduJTkcWj-mucqwxDwlnhF-4B5pem2rR8buSSrcfho5M6PlV2hdWabAffNM4pYFHnNt288vt1q7tTSeP9-6NrWgCyQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 11 Nov 2022 14:54:18 GMT
server: cloudflare
etag: W/"c1add06674d8ee3c323c3b5f066404f6"
vary: Accept-Encoding
x-goog-generation: 1668178458192164
content-type: application/javascript
x-goog-hash: crc32c=6DZcRA==, md5=wa3QZnTY7jwyPDtfBmQE9g==
cache-control: public, max-age=1800, s-maxage=600, must-revalidate
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qknWObed%2FpR8QaBbTCBHzi0%2FFy0T0TH0R%2FwItDPhHMVwaDgYJIzWIEKK0XZXgSWxKF7vP08Y%2FERF9kViT4qJMV%2FPQVrDkth351AxvY5%2FShD%2FOurXRUC%2BQT4rQwuGCAhBwShWVbw%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 30189
cf-ray: 775668dc3815a961-SYD
expires: Tue, 06 Dec 2022 16:32:06 GMT

GET
H2 200 css2
fonts.googleapis.com/ 54 KB
13 KB 821ms
279ms Stylesheet
text/css 74.125.24.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Single+Day:wght@400&display=swap

Requested by

Host: pastelink.net
URL: https://pastelink.net/6brvsep8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f95.1e100.net

Software

ESF /

Resource Hash

478d590680c83e235e3b56c0367d122fbf91dbdd91e2bf8da6af1941cfe102a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Dec 2022 16:31:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 06 Dec 2022 16:31:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Dec 2022 16:31:03 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 192 KB
68 KB 820ms
278ms Script
application/javascript 142.251.12.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ

Requested by

Host: pastelink.net
URL: https://pastelink.net/6brvsep8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

a05c0edb8d72254cffbbdada7eacc1f32e43794f1c7d5fc817be19a147bb4207

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69582
x-xss-protection: 0
last-modified: Tue, 06 Dec 2022 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 06 Dec 2022 16:31:04 GMT

GET
H2 200 advally-5.0.0.js Show response
cdn.adligature.com/rules.js/ 104 KB
28 KB 154ms
154ms Script
application/javascript 172.67.202.177
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/rules.js/advally-5.0.0.js
Requested by: Host: cdn.adligature.com
URL: https://cdn.adligature.com/pl/prod/rules.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.202.177 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a29a65e75a48d9c432611eb70d0377c8610f1874474b65df01aa72fed0235e3

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:04 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4393
cf-polished: origSize=171037
x-guploader-uploadid: ADPycdvdAWAvvuQtlKRMSi2KJ-urgo-fqNWgyjU5AqjMDerQ9jppYNzdwtmtfbotaqP69jJhIqvoVucKaG-_E8DLNFzQV4avxRkz
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 07 Nov 2022 13:53:08 GMT
server: cloudflare
etag: W/"7b1394d4b04bfcbf82f0d4de7ba5a58d"
vary: Accept-Encoding
x-goog-generation: 1667829188108909
content-type: application/javascript
x-goog-hash: crc32c=/7AOYQ==, md5=exOU1LBL/L+C8NTee6WljQ==
cache-control: public, max-age=7200, s-maxage=7200, must-revalidate
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4rR2Q%2B7K5QzkJtHvdNQTRlRrtgHw8Tm10TjKhuBO%2BDRZsfRhw3tWR5H4TBKtM2UwN0HBUOYTeZgJAd60bwRzkSmA9%2F%2FagMpDua98djGq2YKfsU2N%2FolRC%2BQWD6bTnHobJGN1VRw%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 171037
cf-ray: 775668e1eb58a961-SYD
expires: Tue, 06 Dec 2022 16:28:28 GMT

GET
H2 200 rules.css
cdn.adligature.com/pl/prod/ 148 B
624 B 152ms
151ms Stylesheet
application/javascript 172.67.202.177
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/pl/prod/rules.css
Requested by: Host: cdn.adligature.com
URL: https://cdn.adligature.com/pl/prod/rules.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.202.177 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd8e217991e65be206db184ca55d6673115a4579c6673739203181999150547b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:03 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 535
cf-polished: origSize=294
x-guploader-uploadid: ADPycduCwKAVckGFAscW1QFf32Yh5nT-zKBlEwe23BUIWg9y3rfiVpiJx4jC-Z2plKig1zX3bH3kXZE2svDyKOz2OCPLQw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 11 Nov 2022 14:54:17 GMT
server: cloudflare
etag: W/"53b5e5bc4c7d7cf111b728f22d660fdd"
vary: Accept-Encoding
x-goog-generation: 1668178456885584
content-type: application/javascript
x-goog-hash: crc32c=F8i4jg==, md5=U7XlvEx9fPERtyjyLWYP3Q==
cache-control: public, max-age=1800, s-maxage=600, must-revalidate
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hzhQpuL8nhsdJ6An4DMU6BDas0ZvorEo566ZP3KEH%2FZYELYFz0DkCykTyO%2FOkwdlXWaKNFf%2B2%2FV0QVh90LrOI7cly07WHXNeblj5h35N6MxF2yZsOe%2FakzgWBQUbAXsVUz%2BmPjg%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 294
cf-ray: 775668e1eb57a961-SYD
expires: Tue, 06 Dec 2022 16:32:08 GMT

GET
H2 200 debut_light.png
pastelink.net/assets/images/ 4 KB
4 KB 395ms
394ms Image
image/png 89.35.29.15
BANDWIDTH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/debut_light.png

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.35.29.15 London, United Kingdom, ASN25369 (BANDWIDTH-AS, GB),

Reverse DNS

15.29.35.89.baremetal.zare.com

Software

nginx /

Resource Hash

c24ccee9a35eef9e74411eac871935bdff6bcb895cce80b754b66d3e4292a3ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 13 Oct 2022 11:31:15 GMT
server: nginx
etag: "6347f703-10c8"
content-type: image/png
accept-ranges: bytes
content-length: 4296

GET
H2 200 pastelink-logo.svg
pastelink.net/assets/images/logo/ 3 KB
3 KB 395ms
395ms Image
image/svg+xml 89.35.29.15
BANDWIDTH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/logo/pastelink-logo.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.35.29.15 London, United Kingdom, ASN25369 (BANDWIDTH-AS, GB),

Reverse DNS

15.29.35.89.baremetal.zare.com

Software

nginx /

Resource Hash

01408f8061623faa6d2c0f015cd23483c3aa363c095e152f613ed94c87a5803d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 13 Oct 2022 11:31:15 GMT
server: nginx
etag: "6347f703-d3d"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 3389

GET
DATA 200
OK truncated
/ 16 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 13100cd3879e5c1385581d7c88153e60cd7c3e4b0578fe2838daa56da689769b

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 arrow-down-blue.svg
pastelink.net/assets/images/ 239 B
409 B 394ms
394ms Image
image/svg+xml 89.35.29.15
BANDWIDTH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/arrow-down-blue.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.35.29.15 London, United Kingdom, ASN25369 (BANDWIDTH-AS, GB),

Reverse DNS

15.29.35.89.baremetal.zare.com

Software

nginx /

Resource Hash

50a60e5e5f2e8f10a2f8685031ec9849ba8faff613139f3a402e89f25ccbbabc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 13 Oct 2022 11:31:15 GMT
server: nginx
etag: "6347f703-ef"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 239

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 827ms
271ms Font
font/woff2 172.217.194.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f94.1e100.net

Software

sffe /

Resource Hash

7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 04 Dec 2022 00:55:06 GMT
x-content-type-options: nosniff
age: 228958
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7884
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 17:03:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Dec 2023 00:55:06 GMT

GET
H2 200 moon.svg
pastelink.net/assets/images/ 2 KB
2 KB 396ms
396ms Image
image/svg+xml 89.35.29.15
BANDWIDTH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/moon.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.35.29.15 London, United Kingdom, ASN25369 (BANDWIDTH-AS, GB),

Reverse DNS

15.29.35.89.baremetal.zare.com

Software

nginx /

Resource Hash

ed6cd01c384db70bedbe24986aa85b0745f994ad71b7e5712f8a60e1ff457d7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 13 Oct 2022 11:31:15 GMT
server: nginx
etag: "6347f703-62e"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 1582

GET
H2 200 public-black.svg
pastelink.net/assets/images/ 578 B
749 B 396ms
395ms Image
image/svg+xml 89.35.29.15
BANDWIDTH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/public-black.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.35.29.15 London, United Kingdom, ASN25369 (BANDWIDTH-AS, GB),

Reverse DNS

15.29.35.89.baremetal.zare.com

Software

nginx /

Resource Hash

57226adbc32c91a8cd4ec9ee08e4f155f3450e79256731c04f81709a58c4c1fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 13 Oct 2022 11:31:15 GMT
server: nginx
etag: "6347f703-242"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 578

GET
H2 200 social-spritesheet.png
pastelink.net/assets/images/ 28 KB
28 KB 395ms
395ms Image
image/png 89.35.29.15
BANDWIDTH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/social-spritesheet.png

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.35.29.15 London, United Kingdom, ASN25369 (BANDWIDTH-AS, GB),

Reverse DNS

15.29.35.89.baremetal.zare.com

Software

nginx /

Resource Hash

8af24d7350dbdc8eea22e4737deaa35a795b19b0560d7173113bec7e8a3effb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 13 Oct 2022 11:31:15 GMT
server: nginx
etag: "6347f703-70de"
content-type: image/png
accept-ranges: bytes
content-length: 28894

GET
H2 200 logo-bg-90-tl.svg
pastelink.net/assets/images/ 2 KB
2 KB 396ms
395ms Image
image/svg+xml 89.35.29.15
BANDWIDTH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/logo-bg-90-tl.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.35.29.15 London, United Kingdom, ASN25369 (BANDWIDTH-AS, GB),

Reverse DNS

15.29.35.89.baremetal.zare.com

Software

nginx /

Resource Hash

1c9e4c65f9d921b1c0829958cc7b2f307a3e22ac7a23e8315b6db4c0954e1107

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 13 Oct 2022 11:31:15 GMT
server: nginx
etag: "6347f703-933"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 2355

GET
H2 200 pastelink-logo-contrast.svg
pastelink.net/assets/images/logo/ 4 KB
4 KB 395ms
394ms Image
image/svg+xml 89.35.29.15
BANDWIDTH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/logo/pastelink-logo-contrast.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.35.29.15 London, United Kingdom, ASN25369 (BANDWIDTH-AS, GB),

Reverse DNS

15.29.35.89.baremetal.zare.com

Software

nginx /

Resource Hash

3a73b36061944ebbb33696553917d393280f796e212afcd09057b441c1168606

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 13 Oct 2022 11:31:15 GMT
server: nginx
etag: "6347f703-e31"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 3633

GET
H2 200 logo-symbol-non-white-bg.svg
pastelink.net/assets/images/ 4 KB
5 KB 396ms
395ms Image
image/svg+xml 89.35.29.15
BANDWIDTH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/logo-symbol-non-white-bg.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.35.29.15 London, United Kingdom, ASN25369 (BANDWIDTH-AS, GB),

Reverse DNS

15.29.35.89.baremetal.zare.com

Software

nginx /

Resource Hash

15f20e02ef301e62ed325d633f971c506dcf1be3458c2371b849b505bb8673dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 13 Oct 2022 11:31:15 GMT
server: nginx
etag: "6347f703-11c0"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 4544

GET
H2 200 pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 841ms
298ms Font
font/woff2 172.217.194.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f94.1e100.net

Software

sffe /

Resource Hash

9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 13:13:23 GMT
x-content-type-options: nosniff
age: 11861
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7816
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:11:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Dec 2023 13:13:23 GMT

GET
H2 200 LYjHdGDjlEgoAcF95EI5jV9tRtXRM_vAklfi4DzhOchwatn58A.119.woff2
fonts.gstatic.com/s/singleday/v15/ 14 KB
14 KB 1277ms
735ms Font
font/woff2 172.217.194.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/singleday/v15/LYjHdGDjlEgoAcF95EI5jV9tRtXRM_vAklfi4DzhOchwatn58A.119.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Single+Day:wght@400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f94.1e100.net

Software

sffe /

Resource Hash

255c0c3d3ef9fa80db0d0bc4d4f63e65febc5d22ac325ae365821b35cc64b045

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Dec 2022 14:36:59 GMT
x-content-type-options: nosniff
age: 438845
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14512
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 15:50:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Dec 2023 14:36:59 GMT

GET
H2 200 pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 876ms
334ms Font
font/woff2 172.217.194.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f94.1e100.net

Software

sffe /

Resource Hash

cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 01:02:30 GMT
x-content-type-options: nosniff
age: 314914
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7748
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:21:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 03 Dec 2023 01:02:30 GMT

GET
H2 200 LYjHdGDjlEgoAcF95EI5jV9tRtXRM_vAklfi4DzhOchwatn58A.118.woff2
fonts.gstatic.com/s/singleday/v15/ 11 KB
11 KB 1081ms
544ms Font
font/woff2 172.217.194.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/singleday/v15/LYjHdGDjlEgoAcF95EI5jV9tRtXRM_vAklfi4DzhOchwatn58A.118.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Single+Day:wght@400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f94.1e100.net

Software

sffe /

Resource Hash

6aaab99d28a54897a3d01ceb1ff705cf5ae6a16599c3756d9878bd444ae41def

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 04:55:53 GMT
x-content-type-options: nosniff
age: 300911
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11288
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 15:50:17 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 03 Dec 2023 04:55:53 GMT

GET
H2 200 LYjHdGDjlEgoAcF95EI5jV9tRtXRM_vAklfi4DzhOchwatn58A.117.woff2
fonts.gstatic.com/s/singleday/v15/ 12 KB
12 KB 1133ms
598ms Font
font/woff2 172.217.194.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/singleday/v15/LYjHdGDjlEgoAcF95EI5jV9tRtXRM_vAklfi4DzhOchwatn58A.117.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Single+Day:wght@400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f94.1e100.net

Software

sffe /

Resource Hash

6c5348affb6ccfeb05ed71c4499647db8a79e559992be9d13e1a47c4d508d294

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 23:05:44 GMT
x-content-type-options: nosniff
age: 62720
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12296
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 15:50:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Dec 2023 23:05:44 GMT

GET
H2 200 LYjHdGDjlEgoAcF95EI5jV9tRtXRM_vAklfi4DzhOchwatn58A.116.woff2
fonts.gstatic.com/s/singleday/v15/ 12 KB
12 KB 1344ms
812ms Font
font/woff2 172.217.194.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/singleday/v15/LYjHdGDjlEgoAcF95EI5jV9tRtXRM_vAklfi4DzhOchwatn58A.116.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Single+Day:wght@400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f94.1e100.net

Software

sffe /

Resource Hash

8a821650737b505849bb96e321884fdca8a52aaf7962a89a1f58a72e46db72ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 00:57:51 GMT
x-content-type-options: nosniff
age: 315193
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12612
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 15:50:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 03 Dec 2023 00:57:51 GMT

GET
H2 200 LYjHdGDjlEgoAcF95EI5jV9tRtXRM_vAklfi4DzhOchwatn58A.114.woff2
fonts.gstatic.com/s/singleday/v15/ 12 KB
12 KB 1203ms
671ms Font
font/woff2 172.217.194.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/singleday/v15/LYjHdGDjlEgoAcF95EI5jV9tRtXRM_vAklfi4DzhOchwatn58A.114.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Single+Day:wght@400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f94.1e100.net

Software

sffe /

Resource Hash

c8c3971e803e2beb66d215c23f6a76aa643e7399043d6bec480a935cc8050c8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 00:57:58 GMT
x-content-type-options: nosniff
age: 142386
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12488
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 15:50:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Dec 2023 00:57:58 GMT

GET /
pro.ip-api.com/json/ 0
0

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
27 KB 826ms
277ms Script
text/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.adligature.com
URL: https://cdn.adligature.com/rules.js/advally-5.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

sffe /

Resource Hash

db55a0aad2bb9ca1048674248e25d2df7b79e3dc771b56f5550f0518bb23142f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27550
x-xss-protection: 0
server: sffe
etag: "1413 / 264 of 1000 / last-modified: 1670328320"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 06 Dec 2022 16:31:05 GMT

GET
H3 200 prebid.js Show response
cdn.adligature.com/pl/prod/ 350 KB
111 KB 165ms
164ms Script
application/javascript 172.67.202.177
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/pl/prod/prebid.js
Requested by: Host: cdn.adligature.com
URL: https://cdn.adligature.com/rules.js/advally-5.0.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.177 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c5bdcb449fb1bfe6c2b49f5dfc6f627c599d795d41bc72cf194b55c619b2f13

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:05 GMT
content-encoding: br
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=359160
x-guploader-uploadid: ADPycdv37PmeUitRnSgW8VH2I1gifcWGMEicfm88CyQUJff0QDO44IY4k8fga5I3J-OLJHGsTcCZG3ey7lVQiu0EXKuRdQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 11 Nov 2022 14:54:15 GMT
server: cloudflare
etag: W/"f97facbb0a8715dfd020c1c728e23c44"
vary: Accept-Encoding
x-goog-generation: 1668178455689352
content-type: application/javascript
x-goog-hash: crc32c=Dp8FQA==, md5=+X+suwqHFd/QIMHHKOI8RA==
cache-control: public, max-age=900, s-maxage=300, must-revalidate
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bb0akYf2dyfOmoeh88cp2bgmXNXjuWfg1CP1s%2BbOeYhn9nClzVbGADY2CWV6iSsogFy1nqSmMtA%2FIAxlYguTuV4t9cTUb4sLKZ3cORSNgLV1oxRyYPe2zTycivK0YglQKY%2Bvp1c%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 359160
cf-ray: 775668ea8a0aa8b9-SYD
expires: Tue, 06 Dec 2022 16:33:53 GMT

GET
H2

200

apstag.js Show response
d3div1mtym39ic.cloudfront.net/aax2/
Redirect Chain

https://c.amazon-adsystem.com/aax2/apstag.js
https://d3div1mtym39ic.cloudfront.net/aax2/apstag.js

178 KB
39 KB

716ms
236ms

Script
application/javascript

13.35.18.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3div1mtym39ic.cloudfront.net/aax2/apstag.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H2
Server: 13.35.18.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-18-36.sin5.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c77c73031f12ad805be49f065989e35ee84cdeaba71e1b64c650732c921409df

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 15:43:45 GMT
content-encoding: br
via: 1.1 23632109ecb3eb8245f17822f97fa88e.cloudfront.net (CloudFront)
last-modified: Wed, 09 Nov 2022 20:51:50 GMT
server: AmazonS3
x-amz-cf-pop: SIN5-C1
age: 2842
x-amz-server-side-encryption: AES256
etag: W/"fa24fe2b94a2fc864b1ec67f32e8db32"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: h3Bafp07MJHdGLlNdXYGTuI8WK-LF1NKQQgbkByRZdGjgs1chD_cyQ==

Redirect headers

date: Mon, 05 Dec 2022 20:08:00 GMT
via: 1.1 2da7d450deef501f4b6eb466e3a79f4a.cloudfront.net (CloudFront), 1.1 c795828dd110eb9881b0d985e479eaac.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: SIN2-P2, SIN2-C1
age: 73385
x-cache: Hit from cloudfront
content-type: text/html
location: https://d3div1mtym39ic.cloudfront.net/aax2/apstag.js
content-length: 167
x-amz-cf-id: VF-2gHOqxi-9PfRldYB0NuWj6dB9rAO0sKrjbhqnJRW5Lty_H7isyg==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 811ms
269ms Script
text/javascript 142.251.12.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 06 Dec 2022 15:59:13 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 1912
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Tue, 06 Dec 2022 17:59:13 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 219 KB
76 KB 573ms
271ms Script
application/javascript 142.251.12.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

b34d9a0bf8daa16eb72f37574ce795006f339c6342f9838bfcc6323948aef5cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 77610
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 06 Dec 2022 16:31:05 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
169 B 572ms
271ms Ping
text/plain 142.251.12.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-S3DKHVPF03&gtm=2oebu0&_p=29185637&cid=850373404.1670344266&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1670344266&sct=1&seg=0&dl=https%3A%2F%2Fpastelink.net%2F6brvsep8&dt=Tevfik%20Arif%20tips%20on%20investing%20in%20Turkish%20real%20estate%20-%20Pastelink.net&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.12.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f138.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
91 B 571ms
270ms XHR
text/plain 142.251.12.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=29185637&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2F6brvsep8&ul=en-us&de=UTF-8&dt=Tevfik%20Arif%20tips%20on%20investing%20in%20Turkish%20real%20estate%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=900410240&gjid=2051780983&cid=850373404.1670344266&tid=UA-55088947-2&_gid=1961607046.1670344266&_r=1&gtm=2wgbu055WHPWQ&z=933739946

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pastelink.net/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_2022120101.js Show response
securepubads.g.doubleclick.net/gpt/ 384 KB
130 KB 574ms
273ms Script
text/javascript 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

sffe /

Resource Hash

c0b59c362ae740c391e742fa4517d90b9461b416b9bec855d14c04603dbaf71c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Dec 2022 12:19:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 447106
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133241
x-xss-protection: 0
last-modified: Thu, 01 Dec 2022 09:36:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 01 Dec 2023 12:19:20 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 73 B
84 B 822ms
275ms XHR
application/json 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

cafe /

Resource Hash

c64cda3c1c7c935b57b27894caec3b370b98d70011c8e5ea2f31691be13c8fe7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60
x-xss-protection: 0
expires: Tue, 06 Dec 2022 16:31:07 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 707ms
235ms XHR
application/javascript 54.192.148.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.148.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-148-120.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: vkCJAv2LVCiDvkjoOZrS5s9fefeFFUOq
content-encoding: gzip
via: 1.1 57f07f5d6af70b966deb083e1354f6f8.cloudfront.net (CloudFront)
date: Tue, 06 Dec 2022 11:10:41 GMT
x-amz-cf-pop: SIN2-C1
age: 27908
x-cache: Hit from cloudfront
last-modified: Fri, 18 Nov 2022 03:05:15 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: wu4msuSeFHpweKfyDevfjVG6JSXQixDDWKHACRzUiR23YgT47MQ2YQ==

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 271ms
271ms XHR
text/plain 142.251.12.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&aip=1&a=29185637&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2F6brvsep8&ul=en-us&de=UTF-8&dt=Tevfik%20Arif%20tips%20on%20investing%20in%20Turkish%20real%20estate%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABAAAAACAAI~&jid=1154419361&gjid=1592492224&cid=850373404.1670344266&tid=UA-197326395-9&_gid=1961607046.1670344266&_r=1&_slc=1&z=1920639225

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pastelink.net/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 1 KB
1 KB 238ms
238ms XHR
application/json 54.192.148.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpastelink.net&pubid=7e29cf92-dbd2-479a-865a-9cb3658a40f8
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.148.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-148-120.sin2.r.cloudfront.net
Software: Server /
Resource Hash: 59b0485c1fec4f53ce71bbf2805f19215f6651cc406e6ff66548444594eebc7b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 11:27:52 GMT
via: 1.1 c795828dd110eb9881b0d985e479eaac.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN2-C1
age: 18194
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 1071
x-amz-cf-id: ZyOkoJ0LBn50R6FShuCfMipysblaj-lRgK8D8iYDj62GHMXwGBrFVg==

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aa68e17fb13028f96c0d5b38fcf7006182894eb694625f9dedf5824d5066a5f0

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bid Show response
aax-dtb-cf.amazon-adsystem.com/e/dtb/ 184 B
621 B 999ms
357ms XHR
text/javascript 13.249.136.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax-dtb-cf.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpastelink.net%2F6brvsep8&pid=s1gtYfDB5im9w&cb=0&ws=1600x1200&v=22.1107.1609&t=1500&slots=%5B%7B%22sd%22%3A%22advally-adhesion-slot%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FBottom_adhesion_banner%22%7D%2C%7B%22sd%22%3A%22Top_leaderboard%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FTop_leaderboard%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-1%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-2%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-3%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-4%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-5%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-6%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22Sidebar_MPU%22%2C%22s%22%3A%5B%22160x600%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FSidebar_MPU%22%7D%5D&schain=1.0%2C1!advally.com%2CP58S175%2C1%2C%2C%2C&pubid=7e29cf92-dbd2-479a-865a-9cb3658a40f8&gdprl=%7B%22status%22%3A%22no-cmp%22%2C%22cmpTimeout%22%3A2000%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.249.136.149 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-249-136-149.ord51.r.cloudfront.net

Software

Server /

Resource Hash

f899d555f9a558f859689a3db4c68d2a352ca91452022c4576d40baea89cb0c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:08 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 c0098ca8d6549ce8db6f28ee0b22a4ce.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: ORD51-C1
x-amz-rid: JAQW0GDC8M3M8QGNPQ9H
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://pastelink.net
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 184
x-amz-cf-id: oaI3dqlJ6ycpci3bwrf4Q7ZRojIT4hcic-zxKq6aiesZ768S77OdMw==

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ 107 B
792 B 815ms
272ms Script
application/javascript 74.125.68.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f154.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 824ms
276ms Script
application/javascript 172.217.194.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f154.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 26 KB
11 KB 492ms
492ms XHR
text/plain 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3206157806165007&correlator=2865034015938268&eid=31070873%2C31071157&output=ldjh&gdfp_req=1&vrg=2022120101&ptt=17&impl=fif&iu_parts=22405481091%2Cpastelink.net%2CBottom_adhesion_banner&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90&ifi=1&adks=759513158&sfv=1-0-40&prev_scp=rand_key%3D8&eri=1&cust_params=refid%3D2%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&abxe=1&dt=1670344267616&lmt=1670344267&dlt=1670344262709&idt=4808&adxs=436&adys=1105&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fpastelink.net%2F6brvsep8&frm=20&vis=1&psz=728x-1&msz=728x-1&fws=516&ohw=1600&ga_vid=850373404.1670344266&ga_sid=1670344268&ga_hid=29185637&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

cafe /

Resource Hash

c4981116b070f9f9c625c705f353775ef7bf2cfd7c80437140bc0b6bb4201172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:07 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11406
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 25 KB
10 KB 893ms
890ms XHR
text/plain 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3206157806165007&correlator=2865034015938268&eid=31070873%2C31071157&output=ldjh&gdfp_req=1&vrg=2022120101&ptt=17&impl=fif&iu_parts=22405481091%2Cpastelink.net%2CTop_leaderboard&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C300x250&fluid=height&ifi=2&adks=2603746535&sfv=1-0-40&prev_scp=rand_key%3D8&eri=1&cust_params=refid%3D2%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&abxe=1&dt=1670344267622&lmt=1670344267&dlt=1670344262709&idt=4808&adxs=310&adys=308&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fpastelink.net%2F6brvsep8&frm=20&vis=1&psz=705x147&msz=705x0&fws=4&ohw=1600&ga_vid=850373404.1670344266&ga_sid=1670344268&ga_hid=29185637&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

cafe /

Resource Hash

669a2350cbeb19863e254dfd68333ca6d76e730cd8ad983dc261e16dab276ea7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10470
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 25 KB
10 KB 670ms
667ms XHR
text/plain 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3206157806165007&correlator=2865034015938268&eid=31070873%2C31071157&output=ldjh&gdfp_req=1&vrg=2022120101&ptt=17&impl=fif&iu_parts=22405481091%2Cpastelink.net%2CInline_banner&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&ifi=3&adks=3770940712&sfv=1-0-40&prev_scp=rand_key%3D8&eri=1&cust_params=refid%3D2%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&abxe=1&dt=1670344267624&lmt=1670344267&dlt=1670344262709&idt=4808&adxs=513&adys=550&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fpastelink.net%2F6brvsep8&frm=20&vis=1&psz=665x250&msz=300x-1&fws=4&ohw=1600&ga_vid=850373404.1670344266&ga_sid=1670344268&ga_hid=29185637&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

cafe /

Resource Hash

3c94a9e5f3cf7e07756f46c1ef5546b3e44eb2c7e7f302e8d96819d65bbe22ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10457
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 20 KB
9 KB 1080ms
1076ms XHR
text/plain 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3206157806165007&correlator=2865034015938268&eid=31070873%2C31071157&output=ldjh&gdfp_req=1&vrg=2022120101&ptt=17&impl=fif&iu_parts=22405481091%2Cpastelink.net%2CInline_banner&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&ifi=4&adks=3575723800&sfv=1-0-40&prev_scp=rand_key%3D8&eri=1&cust_params=refid%3D2%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&abxe=1&dt=1670344267627&lmt=1670344267&dlt=1670344262709&idt=4808&adxs=513&adys=1016&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fpastelink.net%2F6brvsep8&frm=20&vis=1&psz=665x250&msz=300x-1&fws=4&ohw=1600&ga_vid=850373404.1670344266&ga_sid=1670344268&ga_hid=29185637&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

cafe /

Resource Hash

3bcbf0d14efcfe1b28f35f517920d4acb7b26dda2d4b17fdbe40b7d646146f38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:08 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9400
x-xss-protection: 0
google-lineitem-id: 6050546567
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138395899325
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 550 B
310 B 1432ms
1428ms XHR
text/plain 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3206157806165007&correlator=2865034015938268&eid=31070873%2C31071157&output=ldjh&gdfp_req=1&vrg=2022120101&ptt=17&impl=fif&iu_parts=22405481091%2Cpastelink.net%2CInline_banner&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&ifi=5&adks=375354995&sfv=1-0-40&prev_scp=rand_key%3D8&eri=1&cust_params=refid%3D2%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&abxe=1&dt=1670344267628&lmt=1670344267&dlt=1670344262709&idt=4808&adxs=513&adys=1509&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fpastelink.net%2F6brvsep8&frm=20&vis=1&psz=665x250&msz=300x-1&fws=4&ohw=1600&ga_vid=850373404.1670344266&ga_sid=1670344268&ga_hid=29185637&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

cafe /

Resource Hash

3bdae3547fa83e0bac443c9d3ecefff8fd1d98eb6fdb3f43155eee51804ec860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:08 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 280
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 550 B
309 B 1976ms
1972ms XHR
text/plain 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3206157806165007&correlator=2865034015938268&eid=31070873%2C31071157&output=ldjh&gdfp_req=1&vrg=2022120101&ptt=17&impl=fif&iu_parts=22405481091%2Cpastelink.net%2CInline_banner&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&ifi=6&adks=3771912056&sfv=1-0-40&prev_scp=rand_key%3D8&eri=1&cust_params=refid%3D2%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&abxe=1&dt=1670344267632&lmt=1670344267&dlt=1670344262709&idt=4808&adxs=513&adys=1955&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fpastelink.net%2F6brvsep8&frm=20&vis=1&psz=665x250&msz=300x-1&fws=4&ohw=1600&ga_vid=850373404.1670344266&ga_sid=1670344268&ga_hid=29185637&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

cafe /

Resource Hash

38d4c098bbff0b25d7527632da6157e9ab6bedccd0502d6a146f29154fbe5f1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:09 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 279
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 550 B
308 B 1780ms
1776ms XHR
text/plain 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3206157806165007&correlator=2865034015938268&eid=31070873%2C31071157&output=ldjh&gdfp_req=1&vrg=2022120101&ptt=17&impl=fif&iu_parts=22405481091%2Cpastelink.net%2CInline_banner&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&ifi=7&adks=3537739154&sfv=1-0-40&prev_scp=rand_key%3D8&eri=1&cust_params=refid%3D2%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&abxe=1&dt=1670344267633&lmt=1670344267&dlt=1670344262709&idt=4808&adxs=513&adys=2421&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=3&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fpastelink.net%2F6brvsep8&frm=20&vis=1&psz=665x250&msz=300x-1&fws=4&ohw=1600&ga_vid=850373404.1670344266&ga_sid=1670344268&ga_hid=29185637&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

cafe /

Resource Hash

5763ede17f86fbbc3a0dc91eb13255fa2683801ece66e254056ee8c53712f546

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:09 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 278
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 22 KB
9 KB 1261ms
1256ms XHR
text/plain 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3206157806165007&correlator=2865034015938268&eid=31070873%2C31071157&output=ldjh&gdfp_req=1&vrg=2022120101&ptt=17&impl=fif&iu_parts=22405481091%2Cpastelink.net%2CInline_banner&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&ifi=8&adks=3581406220&sfv=1-0-40&prev_scp=rand_key%3D8&eri=1&cust_params=refid%3D2%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&abxe=1&dt=1670344267635&lmt=1670344267&dlt=1670344262709&idt=4808&adxs=513&adys=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=4&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fpastelink.net%2F6brvsep8&frm=20&vis=1&psz=665x250&msz=300x-1&fws=4&ohw=1600&ga_vid=850373404.1670344266&ga_sid=1670344268&ga_hid=29185637&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

cafe /

Resource Hash

1771fa56748c811d79bb11bbe03ec1212b43811245ab051b1fdaba0550e102aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9551
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 548 B
309 B 1608ms
1604ms XHR
text/plain 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3206157806165007&correlator=2865034015938268&eid=31070873%2C31071157&output=ldjh&gdfp_req=1&vrg=2022120101&ptt=17&impl=fif&iu_parts=22405481091%2Cpastelink.net%2CSidebar_MPU&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=160x600&ifi=9&adks=3854452215&sfv=1-0-40&prev_scp=rand_key%3D8&eri=1&cust_params=refid%3D2%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&abxe=1&dt=1670344267637&lmt=1670344267&dlt=1670344262709&idt=4808&adxs=1071&adys=521&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fpastelink.net%2F6brvsep8&frm=20&vis=1&psz=168x607&msz=160x-1&fws=4&ohw=1600&ga_vid=850373404.1670344266&ga_sid=1670344268&ga_hid=29185637&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

cafe /

Resource Hash

52ec82de9bd266991110570ea69cd6ed2ecab3931579d5b2809a2a29760a586e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:09 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 279
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
13 KB 822ms
278ms XHR
application/json 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022120101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

af76fed26819f89c07226d0d2790a382a049399f5baa7607a1471e393302d8ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:08 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12543
x-xss-protection: 0

GET
H2 200 container.html Show response
f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame ECD1 6 KB
3 KB 824ms
272ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Dec 2022 16:31:08 GMT
expires: Wed, 06 Dec 2023 16:31:08 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 32 KB
10 KB 732ms
258ms Script
text/javascript 13.224.250.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.250.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-250-68.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c7ad2fb033696f6b193dc1e4ef7d353c1d9a4d4a39772bdd0b44175704986ef8

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 12:55:18 GMT
content-encoding: gzip
via: 1.1 f524a7fd984e15aeceb1c8903b4e45c2.cloudfront.net (CloudFront)
last-modified: Mon, 21 Nov 2022 18:55:24 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C2
age: 12952
x-amz-server-side-encryption: AES256
etag: W/"51c5af7d71728569b41d03503fff2de7"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age: 86400
x-amz-cf-id: LSPTfB6-kVzyY-71_UwUGqtHy3pt6yP_nAVRi34ysyfG18hGaUjeMQ==

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 57 KB
17 KB 434ms
148ms Script
text/javascript 172.67.38.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/6brvsep8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.38.106 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

39fae3dc476aaaa594e2c963401633dd5d02eccb3c175eda03912cfe0f91c92e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:09 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 24 Nov 2022 12:48:29 GMT
server: cloudflare
x-amz-request-id: MPPZXSN02VSTMT9F
age: 1950
etag: W/"9ee82d693d1e83b3a37ee20226716f78"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 775669062c1daae1-SYD
x-amz-id-2: kw27fDfYfh8B9hjsFBCGebIKTd/A1DchBNERGw9YsWdDGKf049qNucAfSbx3f2jKywcCawKMjBM=

GET
H2 200 container.html Show response
f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame B120 6 KB
3 KB 272ms
271ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Dec 2022 16:31:08 GMT
expires: Wed, 06 Dec 2023 16:31:08 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame A697 6 KB
3 KB 571ms
270ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Dec 2022 16:31:08 GMT
expires: Wed, 06 Dec 2023 16:31:08 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 572ms
271ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Dec 2022 16:31:10 GMT

GET
H2 200 container.html Show response
f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 9A7D 6 KB
3 KB 571ms
270ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Dec 2022 16:31:08 GMT
expires: Wed, 06 Dec 2023 16:31:08 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame B120 0
0 290ms
287ms Fetch
text/html 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CbmcZS26PY7WUMJDOoAO38Qn21NfjbZ2cudWKCsCNtwEQASAAYKvssYXgGIIBF2NhLXB1Yi0xNzUwODU2MjM5MjA0NDE0yAEJ4AIAqAMBqgT_AU_QSUJFnaJy2uhwDipgSdosfEmQ4Uj0QeCZo1EDRn9P6Hz2Os3lho-Enc_d4qdnwPRT-inwYmUGCIgoy31FMUtNE21a_oxB5WM3CFu5MBEuh10I6tKxF0oq9PxqZx3Py5PmQWa1lLBDu7unhSbGW7cYMWn1Wbd4yKVwgjEaH06iav6MwudNVaX88SK906egKMndzDzZdRAjT4Ou1qfXVVeAvIRsteoL4od_WV-nBHiiG1pF_Q9hfuNjmgdnui-jBxK6C6OJpOJDg4uedxeH6VmFJO9dSKJHQyhtuQWo_ArgI2jVttZ0Xa8CpgPa3Yy5iAT09bWmlgCu24w6WN9eAeAEAYAGn4D5gabR_ZMKoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDQiAYRABMgKKAjoCgECACgH6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItMTc1MDg1NjIzOTIwNDQxNBj63nw&sigh=-ZRnh44yWuM&uach_m=[UACH]&cid=CAQSTADq26N9mxRAPO7gbrnJb9o7FT1cXlcuTJC9wN0D6FAvD5-FZdZbZeGSR5KoMeZIW3kxX68KcnbQNKBw5bymG_nAhNZNnCMOraIdZ8UYASAT
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f154.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 200
OK /
b1-sindc1.zemanta.com/bidder/win/googleadx_display/62e7b485-7583-11ed-8e23-064c0f297e85/Y49uSwAMCjUKaCcQAAJ4t28-36kVzGuDzn3ikQ/3QXBAQWW3MLOJ6HFWJ5MFRBPBJED2Y62D2GALC6PXMJRDY2RRHY7QFWFVBY7EULYFLKBCH... Frame B120 0
0 712ms
236ms Fetch 23.108.101.160
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://b1-sindc1.zemanta.com/bidder/win/googleadx_display/62e7b485-7583-11ed-8e23-064c0f297e85/Y49uSwAMCjUKaCcQAAJ4t28-36kVzGuDzn3ikQ/3QXBAQWW3MLOJ6HFWJ5MFRBPBJED2Y62D2GALC6PXMJRDY2RRHY7QFWFVBY7EULYFLKBCHYEQTVNZ6D7KGHW5BX7FKLHUKYRJLASZM6NGCO5M2O5ESG2XLUKDF4EEZ2PCNZIFPGKGUYXGEBF6FXJ4ZS5LKBHK3QPB265QRYXH4SHZMOMXF5DXJ4EFONHU6BUM3D7JIUNXY5P4AWY4KLF3OUCR67NIQTPIKQ6H6D455G6AJ57TSJETAHVVKRX5IMYTRZAIT2KY27K6Q2ZXOCGFF2L6QWNMQ6K2RFFOEZ6X2OMAYDODVI42Y2YUUC43676YHMN3TYWRK426IU4ZIN3WJKH45IXPVKIYXRIW6B2DDISYLVMD35NNXKJDEXZVRGBAZ7POXVA6WALLFLIQZSBMWPOVMLAPOVNLUMOS6EABQIAQHDZPVSQT3XEU3KJYNCHHIM2QYPJZY72IG4GAUB2ZVFBPF23D2TSGC6IK52JANGZEXBVSDRQ/?
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.101.160 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection: keep-alive
Date: Tue, 06 Dec 2022 16:31:09 GMT
Content-Length: 0

GET
H2 200 widget.js Show response
widgets.outbrain.com/n2d/widget/ Frame B120 40 KB
9 KB 734ms
242ms Script
application/x-javascript 104.65.229.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/n2d/widget/widget.js
Requested by: Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.229.95 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-229-95.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 0d3fd60e80f18f6b8a3b0a3cfec13dcbdaf3e710db09b170096ab1c163dda39c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:09 GMT
content-encoding: gzip
last-modified: Tue, 29 Nov 2022 13:46:18 GMT
server: AkamaiNetStorage
etag: "07232370ef9b8600031a091dcd1ad3af:1669729961.956991"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 8977
expires: Tue, 06 Dec 2022 20:31:09 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/ Frame B120 3 KB
1 KB 570ms
270ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/window_focus_fy2021.js

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 11:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16932
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Dec 2022 11:48:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/ Frame B120 18 KB
8 KB 815ms
269ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

cafe /

Resource Hash

f066f881ead135cd4ee88cf0c80ddb796f8841fc536a7950d4f7102e0502be2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 11:48:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16935
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7443
x-xss-protection: 0
server: cafe
etag: 629801499763588852
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Dec 2022 11:48:54 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame B120 24 KB
7 KB 842ms
296ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 11:48:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16935
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 06 Dec 2023 11:48:54 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B120 153 KB
47 KB 4496ms
3951ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

f08c94a636dea8c08b6a50658ba1200281007d4fba996ac05cd2eeb0b873d32d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47692
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670243872199174"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Dec 2022 16:31:12 GMT

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame F236
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain&dcc=t

354 B
1 KB

358ms
358ms

Document
text/html

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

afd0648fc2669732f3f6a1b107154a668fbff4350345d7ac6305c5c33f41d822

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 354
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 06 Dec 2022 16:31:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: A7Q63W364289M1V3JA5Q

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Tue, 06 Dec 2022 16:31:09 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: J225NB69A038ESFNMKHZ

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 2B85 0
0 280ms
279ms Fetch
image/gif 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss_nmu5Jq4JY5gFPHaBBlENWGBihin_XMqC_MoU52oA-OS50OvwtTh-fqMOzW-kQlSkyI0bBVrI3b6HmvaXZmK-xOuDiF6pbQ-j1Ca_GEAGjAe1Z1iPGdwqa0v4poMR3KMPof7ix_eJw4wStgVdhLUh31PuWOtMXeih2vKj0MH5P2haCykh5cQGDylKDQdyvHZOYNLbLchpqV9qRuWr2FoWys_1_AIixb03AqB1UuCpG0p2zVtA0E3ow1YyMEXIXoqFU0ypuLMD9J_c5n1bVX5tqzHhDF95g9iXZ2Y5OiiocZOWqjdhsA_WHxN4o_zhr2nkQKe0mL1XNlF5P2Lv4qE&sai=AMfl-YRnzaTYaPzeoF9F0KU07m-7eEtdD5fqIky2LrefiG7jPZlji0EIVsE1WwVbntp1qc_ycWAxCbgZktwx4sSJsuIbnbO0F0ie1kF_Muj6G3NeJva4ou7Sq_FN9ttb_1YuT0Y16g&sig=Cg0ArKJSzNDH_v-2ml94EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/6brvsep8

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:08 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 06 Dec 2022 16:31:08 GMT

GET
H2 200 outbrain.js Show response
widgets.outbrain.com/ Frame 2B85 216 KB
75 KB 251ms
251ms Script
application/x-javascript 104.65.229.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/outbrain.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.229.95 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-229-95.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 287c4ffed8b446fb8a15e9e0d93b69eb603b133328e30db3fbc93e0de8a0cca5

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:09 GMT
content-encoding: gzip
last-modified: Mon, 05 Dec 2022 16:33:01 GMT
etag: "17-2wO7FqprilnWgl1Ng7i71GR2t8Q"
vary: Accept-Encoding
edge-cache-tag: widget-cheetah
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-allow-methods: GET,POST
cache-control: max-age=14400
access-control-allow-credentials: false
x-traceid: 47b199678f4634de7ecb98d11d8bc336
timing-allow-origin: *, *
content-length: 76078

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2B85 153 KB
47 KB 3576ms
3207ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

f08c94a636dea8c08b6a50658ba1200281007d4fba996ac05cd2eeb0b873d32d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47692
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670243872199174"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Dec 2022 16:31:12 GMT

GET
H3 200 container.html Show response
f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C2B0 6 KB
3 KB 430ms
270ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Dec 2022 16:31:08 GMT
expires: Wed, 06 Dec 2023 16:31:08 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame A697 0
0 288ms
287ms Fetch
text/html 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C13U4S26PY6-mO_qz1AaRg4moCPbU1-NtnZy51YoKwI23ARABIABgq-yxheAYggEXY2EtcHViLTk2MDI1MTk1MDI2MTgyNjLIAQngAgCoAwGqBIECT9Diwqnfqo5EMculZ0hpNIvMPro8tWOEEJq6VRdOnFWXD2wi4p8EfXtbqCMRhSZ3VmXWMwpLvgiB8SW-9TzGvp21b7r6xpD6xVJWL1UgCOVODRm8olZSwdROrmOST4SSSgw7DYjcokxrI_hyFQGFAV-WPUGZdRKfeJSOYd1iW2aYj5suPP_uHjANYjZqt9l_EVRiHxYIprPdN82BHmJYQ1fLtntC17VAAi9dOfHH_60C6BUm4hmN3nl-KqFzZs5n06iL50k9jD8jBG08A1UNJBQm3R2Jk9DWiPacOCb1SKOepGHkpeWoO_6kxuvxKg_5HxcXE8c5gGHqQTskq7sBklzgBAGABrXI6KHXgdvIvAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQIAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi05NjAyNTE5NTAyNjE4MjYyGPrefA&sigh=DUgokZMfTwI&uach_m=[UACH]&cid=CAQSSwDq26N945y7oz75xNMA_AGCjlhK8IS0Gssr85FfR-mKhDpLSvQifwR-JroS7lr2HUctNt3sNB1ciizbwStnaE_D421i6VzDGbXz2xgBIBM
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f154.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 200
OK /
b1-sindc1.zemanta.com/bidder/win/googleadx_display/63030416-7583-11ed-84e9-b785c9d8f04d/Y49uSwAO0y8K1Rn6AAJBkaAJJ0hU8WT4fmJ6zQ/3QXBAQWW3MLOJ6HFWJ5MFRBPBI7ZJTHGNR7FSSWPXMJRDY2RRHY6L6MPG74LW6X5MPJQGA... Frame A697 0
0 400ms
235ms Fetch 23.108.101.160
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://b1-sindc1.zemanta.com/bidder/win/googleadx_display/63030416-7583-11ed-84e9-b785c9d8f04d/Y49uSwAO0y8K1Rn6AAJBkaAJJ0hU8WT4fmJ6zQ/3QXBAQWW3MLOJ6HFWJ5MFRBPBI7ZJTHGNR7FSSWPXMJRDY2RRHY6L6MPG74LW6X5MPJQGAO4IGUYB4SQVH53PBH56XYYU5ROG4HHOER63VF6PSIMVQ4B2CX55PYPDBD26JDCW52BMNBKAUEBLP4NUDRQL2BHK3QPB265QRZLRRV6JTV7OOBJCVAKU375G6UKPLPXBKL45CQJ3CUKEMPG66JONR42AM72HUFODSMIBGIPOKX5WOROS6EXF5SKHOICRFHSIR5FZ56Q6SPUAK4GCCEY4TYAB744XQZJLALKPSZRX7TUFFC4EN5SHC3WYNJJZTVVG5RSEHGUZQS2KE66GB3BBYWYINDCAXIYAGZBCSJR7UYQ7OAE2M4LF6WTWKTNHBHLEDS5R74OZFLIQZSBMWPOVMLAPOVNLUMOS6EABQIAQHDZPVSQT3XEU3KJYNCHHIM2QYPJZY72IG4GAUB2ZVFBPF23D2TSGC6IK5YQWZ4DHVXDQ7NQ/?
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.101.160 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection: keep-alive
Date: Tue, 06 Dec 2022 16:31:09 GMT
Content-Length: 0

GET
H2 200 / Show response
asia.adform.net/adfscript/ Frame A697 2 KB
2 KB 797ms
266ms Script
text/javascript 185.84.60.20
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://asia.adform.net/adfscript/?bn=56367627;click=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCG2ggS26PY6-mO_qz1AaRg4moCPbU1-NtnZy51YoKwI23ARABIABgq-yxheAYggEXY2EtcHViLTk2MDI1MTk1MDI2MTgyNjLIAQngAgCoAwGqBIQCT9Diwqnfqo5EMculZ0hpNIvMPro8tWOEEJq6VRdOnFWXD2wi4p8EfXtbqCMRhSZ3VmXWMwpLvgiB8SW-9TzGvp21b7r6xpD6xVJWL1UgCOVODRm8olZSwdROrmOST4SSSgw7DYjcokxrI_hyFQGFAV-WPUGZdRKfeJSOYd1iW2aYj5suPP_uHjANYjZqt9l_EVRiHxYIprPdN82BHmJYQ1fLtntC17VAAi9dOfHH_60C6BUm4hmN3nl-KqFzZs5n06iL50k9jD8jBG08A1UNJBQm3R2Jk9DWiPaceiTU2h5Qfwcbfr9z0ttMB8nRIIvwMQ-U3jYcaKpMaBc8FFDC9KPGM2zgBAGABrXI6KHXgdvIvAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0PlKgkRlKclftkcf2IlmAhU7kJ4g%26client%3Dca-pub-9602519502618262%26adurl%3Dhttps%253A%252F%252Fr1-usc1.zemanta.com%252Frp2%252Fb1_googleadx_display%252F27660748%252F92404972%252FHGUIS43X2PZU3EQSL6ARXK4MNOUNCUSTKEB4LOU6GWQR6OAC7IXCYJHER4APXAGUAO3VC2V3LCT2354FFI25ZFMWZO2AZ4VG66K4CNOYEMC6QXDTJKGND6SF367BDMWDCZZEQHJAAAV24Y46YVUFRNAPN5XOKSSJHFSWEBIVMZMQDPV4IOBQTJ3HWEJFA5ZILKEMD3S4XOROFWPIE45RZ6PGD7XVYO5SPI2HZT7FE77S2NSJZDDSNBYRUBQF7LIVDBM5ZCIVOZ43D45RFFES2APD2VPNWQ2J4KJBIC35WZESRWBEWXLFPP5YQVU6AY6OEEJLII74S3KXB6T6F45IU23KBTG56IT6TOJCCSZSPMXN4DGNTTD5TXZKGAHOCZECSJGSXLOHHOC6TMMKMFBET4U62MN4NMURPL6KHY7GFATBTF3XDHNNZ2SWHSWZ6FA2YR7M3JK7YGL55U4YZCY4O5BM377Q2T7YEDDXA2H5UYIL26DP3ZH4BC7R4ZURB5W75MT3UV3LL672GT52DJMFXYNZGSBGFFASH2NPIEA4L3F2JX3EDKPFITLRMDL5XXVU%252F%253Frurl%253D

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

f7cd0b3261e1b40d614d0ed99e8c146776e760569efc6c1b1e5d6126021c8c5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 2057
expires: -1

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/ Frame A697 3 KB
1 KB 571ms
270ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/window_focus_fy2021.js

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 11:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16932
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Dec 2022 11:48:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/ Frame A697 18 KB
7 KB 330ms
330ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

cafe /

Resource Hash

f066f881ead135cd4ee88cf0c80ddb796f8841fc536a7950d4f7102e0502be2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 11:48:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16935
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7443
x-xss-protection: 0
server: cafe
etag: 629801499763588852
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Dec 2022 11:48:54 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame A697 24 KB
6 KB 536ms
535ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 11:48:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16935
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 06 Dec 2023 11:48:54 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A697 153 KB
47 KB 3796ms
3795ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

f08c94a636dea8c08b6a50658ba1200281007d4fba996ac05cd2eeb0b873d32d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47692
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670243872199174"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Dec 2022 16:31:12 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 9A7D 0
0 286ms
286ms Fetch
text/html 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cd_UdTG6PY9OOCae61Aahp7iQDPbU1-NtnZy51YoKwI23ARABIABgq-yxheAYggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTTIAQngAgCoAwGqBPwBT9DBkRjR-wCUyq78bIxggeHK-WaTZmFmnkgz_mqfp2VRPqG0iHhVjsoSYtozt7wFWNM0khMHXBb6uSSVIk1mK5Gw2aW2XZ3qKrB7W3hnhgVxLrLnHDGG5m8ldmWhov0NJC5roKjXsCmnc7i0UbW1k5lzgqgtIGxb1imvNK66VWFtVC-jnG0I6uuLbBHr8wR5ebXTo6srr2-fqYOemWm_pR-pjTtLcoC-iD7cE7PP9aPdUQASdiwTEweDMA9Ogt4wQ-J6RDT5mUOCnoK8LVV1zgeDOnxFFyqnDxZsaT0CbVu5obG1_C5ksV_ha3l5qNohtjIrWUjVzuRJwyfI4AQBgAbM6Iunp5jN9CigBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQIAKAfoLAggBgAwB0BUBgBcBshccChoSFHB1Yi0xNzUwODU2MjM5MjA0NDE0GPrefA&sigh=h5mUzHYeGaQ&uach_m=[UACH]&cid=CAQSSwDq26N9iwnVMvfRWSyaTNdm8mBifvaxbSGosGKXDYyjbSD0GAXNOQIOh1rsojfOkHtsX7PSBCVgTicUpJsq_IVXa3jEoNWAJapoJRgBIBM
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f154.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 200
OK /
b1-sindc1.zemanta.com/bidder/win/googleadx_display/6321bcf0-7583-11ed-9171-72e0f80e11d7/Y49uTAACR1MK1R0nAA4ToXGzLyT8YoeJSKzhfg/3QXBAQWW3MLOJ6HFWJ5MFRBPBLEOJOQB4OM3UV6PXMJRDY2RRHYXYW3NUHNFPDL5KTECQE... Frame 9A7D 0
0 607ms
235ms Fetch 23.108.101.160
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://b1-sindc1.zemanta.com/bidder/win/googleadx_display/6321bcf0-7583-11ed-9171-72e0f80e11d7/Y49uTAACR1MK1R0nAA4ToXGzLyT8YoeJSKzhfg/3QXBAQWW3MLOJ6HFWJ5MFRBPBLEOJOQB4OM3UV6PXMJRDY2RRHYXYW3NUHNFPDL5KTECQE2MRXY4E42UHPXG423R5DYYU5ROG4HHOER63VF6PSIMVQ4JL6F6ID7SWYMHN54JQLMT6DD6ROOMRPEJKSCA46BHK3QPB265QR6S5SKU42WHV5FVPIP4D3JMBIICPLPXBKL45CQJ3CUKEMPG66JONR42AM72HUFODSMIBGIPOKX5WOROS6EXF5SKHOICRFHSIR5FZ56Q6SPUAK4GCCEY4TYAB744XQZJLALKPSZRX7TUFFC4EN5SHC3WYNJJZTVVG5RSEHGUZQS2KE66GB3BBYWYINDCAXIYAG6TH43IZYT4GQ2R4ZW7RKVMBFET6KF47PUNFGOO5FLIQZSBMWPOVMLAPOVNLUMOS6EABQIAQHDZPVSQT3XEU3KJYNCHHIM2QYPJZY72IG4GAUB2ZVFBPF23D2TSGC6IK546SRERFF36JXQQ/?
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.101.160 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection: keep-alive
Date: Tue, 06 Dec 2022 16:31:09 GMT
Content-Length: 0

GET
H2 200 / Show response
asia.adform.net/adfscript/ Frame 9A7D 2 KB
2 KB 768ms
265ms Script
text/javascript 185.84.60.20
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://asia.adform.net/adfscript/?bn=56367626;click=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCkWqeTG6PY9OOCae61Aahp7iQDPbU1-NtnZy51YoKwI23ARABIABgq-yxheAYggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTTIAQngAgCoAwGqBP8BT9DBkRjR-wCUyq78bIxggeHK-WaTZmFmnkgz_mqfp2VRPqG0iHhVjsoSYtozt7wFWNM0khMHXBb6uSSVIk1mK5Gw2aW2XZ3qKrB7W3hnhgVxLrLnHDGG5m8ldmWhov0NJC5roKjXsCmnc7i0UbW1k5lzgqgtIGxb1imvNK66VWFtVC-jnG0I6uuLbBHr8wR5ebXTo6srr2-fqYOemWm_pR-pjTtLcoC-iD7cE7PP9aPdUQASdiwTEweDMA9Ogt4wQ-J6RDT5mUOCnoK8LVV1zgeDOnxFF2ilLoTRp-ZkkoDjeliQFO9GkVVlYldhKxfQk9rg_2H51luiAEE3VXrO4AQBgAbM6Iunp5jN9CigBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3lEDTogwbsx0nN5KBnS6_OA2yXJg%26client%3Dca-pub-1750856239204414%26adurl%3Dhttps%253A%252F%252Fr1-usc1.zemanta.com%252Frp2%252Fb1_googleadx_display%252F27660748%252F92404976%252FHGUIS43X2PZU3FMKJO44QWZBPKUNCUSTKEB4LOU6GWQR6OAC7IXA6SKCJ6LJE6TTKM5D2WY3JFMJF54FFI25ZFMWZNVFDAAO4J2UMWWYEMC6QXDTJKGFUUS2OHIVIY4EK4R25YMMFNIXNW3LHJQRUPL3ZSJUBBQYMMAWJTPCVEW6GXR2UGQOF7QWLEBUAV3Q3QWZT4OFFBGVBJEXN5UCGHMCGZVD2WHEORR5QKQZS3EJMSP7FJ6BA45IC5BFJGDWGHS2DE7EQBLIK3HNNUF5O6MDJVLEV4L4LLDVKL4CXJ63LQMFKUQVAM5MCNVAA5VIPNI7PIL65SY6OEUV7TPUSMEOSPXSQ65RKOHUBQGXBHUX37435OWQSL7DIT76V7TGCYBJ4AHEMOHCFF6DAEQLNQLUNBTXYHOU2N2FEPG6GWHPZRNTEPXCG6ETVL42C6CMHWQLJJ5E45KRCBNYACUH5JIYQWQCWJJ2FTSZDNDW5RV52L246746DIJCRW2H2F27EQTLGVSKRIVVGVG443MWWJTUHK527TF4GMZSB7Q4L3F2JX3EDKPJVFO7FDEIP7WY%252F%253Frurl%253D

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

d4a84e6328bab7b8bd0587b30ae377b2fe90246b5c706ea221727c060fbbad4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 2045
expires: -1

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/ Frame 9A7D 3 KB
1 KB 570ms
270ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/window_focus_fy2021.js

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 11:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16932
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Dec 2022 11:48:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/ Frame 9A7D 18 KB
7 KB 542ms
541ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

cafe /

Resource Hash

f066f881ead135cd4ee88cf0c80ddb796f8841fc536a7950d4f7102e0502be2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 11:48:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16935
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7443
x-xss-protection: 0
server: cafe
etag: 629801499763588852
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Dec 2022 11:48:54 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 9A7D 24 KB
6 KB 582ms
582ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 11:48:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16935
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 06 Dec 2023 11:48:54 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9A7D 153 KB
47 KB 3553ms
3553ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

f08c94a636dea8c08b6a50658ba1200281007d4fba996ac05cd2eeb0b873d32d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47692
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670243872199174"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Dec 2022 16:31:12 GMT

GET
H2 200 884f0096fde08101746443c6d2675a94ac.png
zem.outbrainimg.com/p/srv/sha/c9/b9/b9/ Frame B120 10 KB
10 KB 1082ms
407ms Image
image/jpeg 199.232.46.132
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zem.outbrainimg.com/p/srv/sha/c9/b9/b9/884f0096fde08101746443c6d2675a94ac.png?w=180&h=90&fit=crop&crop=faces,center&thomcrop&fm=jpg

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.232.46.132 Singapore, Singapore, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

07f3e4f6f2cd8b798060659253e829f1e5a11547e00a8dc5a1f6e869e14ebae9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:10 GMT
via: 1.1 varnish
x-content-type-options: nosniff
age: 1843633
x-cache: HIT, MISS, MISS
x-imgix-id: 643720af585775f6a2c00c52605c4b1fef84f757
cross-origin-resource-policy: cross-origin
content-length: 9895
x-served-by: cache-sjc10069-SJC, cache-qpg1262-QPG, cache-qpg1224-QPG
x-imgix-render-farm: 01.1104
last-modified: Tue, 15 Nov 2022 08:23:57 GMT
server: imgix
x-timer: S1670344270.152091,VS0,VE173
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 achoice.svg
widgets.outbrain.com/images/widgetIcons/ Frame B120 3 KB
3 KB 252ms
251ms Image
image/svg+xml 104.65.229.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by: Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.229.95 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-229-95.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:09 GMT
last-modified: Mon, 12 Sep 2022 07:37:47 GMT
server: AkamaiNetStorage
etag: "9d26fa4e7238ed94f1d0d92afb453b3e:1662969032.874716"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 2735
expires: Thu, 05 Jan 2023 16:31:09 GMT

GET
H/1.1 200
OK /
b1t-sindc1.zemanta.com/t/imp/impression/5XRJCELATCR4MHWOT3JB7OZNQDU4S2FP5FEXQYLENKQHU5HLTWWR4LNJ3PNZC2NZJKAJOV5CLQYZYF5A37JVGVBN64GWLN5UHSH6YX3STKSSYE4OAM2WERGJB6OAKL336A7UXJE3IBRUIBAIX56NNXVTSZ6HO... Frame B120 26 B
151 B 716ms
234ms Image
image/gif 23.108.101.160
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b1t-sindc1.zemanta.com/t/imp/impression/5XRJCELATCR4MHWOT3JB7OZNQDU4S2FP5FEXQYLENKQHU5HLTWWR4LNJ3PNZC2NZJKAJOV5CLQYZYF5A37JVGVBN64GWLN5UHSH6YX3STKSSYE4OAM2WERGJB6OAKL336A7UXJE3IBRUIBAIX56NNXVTSZ6HOVWAHYFITV5IYRYZNYWA6V4IIO6C7XQPXOBKBWXMTPM26OBZVFYWO4XDNK5NCVJZ4YSXZGHHR57RLEPLI4GO4VMCJYYN2ENFFXK7AY7MIWX2NG5OEBNMW3XR5OGVWPPW47CYIYJPXWME2D5SPK2WKJUCU3YNUQKGYNUGFY3OPXWGSFQNJZKTKM4NH6P7BN3BI6GIXCCMCSWKO7EPUHYQD3VQ/?
Requested by: Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.101.160 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Dec 2022 16:31:10 GMT
Connection: keep-alive
Content-Length: 26
Content-Type: image/gif

GET
H2 200 /
asia.adform.net/adfserve/ Frame B120 35 B
386 B 267ms
267ms Image
image/gif 185.84.60.20
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://asia.adform.net/adfserve/?bn=59008820;1x1inv=1;srctype=3;ord=1670344267

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:10 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, no-transform
expires: -1

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame C2B0 0
0 287ms
287ms Fetch
text/html 142.250.4.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CdZBATG6PY8GNIpm91AavkZuwDMan3O9cvdKFia8LwI23ARABIABgq-yxheAYggEXY2EtcHViLTk2MDI1MTk1MDI2MTgyNjLIAQmpAgGe5tCp-oI-4AIAqAMBqgSJAk_QsEqM3tW65WdVL0dTt4LHxgfbmNmUSTPp5uKKLgtYHTAtgv5D0pGj06YTNtoof8Y3zGzYqpm3czHoAPZ8nBv1KEVftQanALn1mpwBN2mj_6p9TFTROYQ4OZJRpsEdo5pczvLgfTEf4Z7eB3mV45EUO9oKqawWVLOlniR-uL7zj822gE_b63VEuCIEwoBvH4jOx_Sm7IB9Yg8o2DcEhbN1d3gJbIL5Khcn0gEWqu2BSIFgbGfAqdVaNNj2BVOzXTdpMHsYr7QTpho4E-AZyLRtFjOeWe3I1avUYwWIQqKL5sk1ba9kPSuX9LE5aWakk5wFHHomP35uOLBL2UHkNNfNb2MmyuoBgFzgBAGABoCX_NXV--Lf-QGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQIAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi05NjAyNTE5NTAyNjE4MjYyGPrefA&sigh=3iHr8tzwjCk&uach_m=[UACH]&cid=CAQSSwDq26N9kNTEsnB5EhpN98s6dbsh6tQjyZIWXcae7AgZl26vL8RmG2hSQhfYmSPBtP8YDdFe1N2nGOaHITiwh6qNCK7WboeBG2Q7PxgBIBM
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f154.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 / Show response
asia.adform.net/adfscript/ Frame C2B0 2 KB
2 KB 559ms
267ms Script
text/javascript 185.84.60.20
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://asia.adform.net/adfscript/?bn=59567767;rtbwp=Y49uTAAIhsEK1R6ZAAbIr2hHHMMEUlvpHVZbOA;rtbdata=Kmcunbdoc-iYrqZfWmdfYl-n-sgwQBtfJ4U_mph6EOCcb9KVlyDBjQ6DQwJNnHcF-CcnH1I2EkMXWlaa94Hv-NsfPst2lzPrLSC1BuLllsALxQvR_rlwjLpB_98nViapuejrgDAE7gXvw1TLPhgmpRCkxQ2k4_-AJ_xA0CDOr3f3cotLvGxRwdm3ypN9VbUfytjAbBo9VB3P10YckVIn8pkxHhXgX9Se4UFuhV40q881;nofp=1;click=https://adclick.g.doubleclick.net/aclk?sa=L&ai=CvHnVTG6PY8GNIpm91AavkZuwDMan3O9cvdKFia8LwI23ARABIABgq-yxheAYggEXY2EtcHViLTk2MDI1MTk1MDI2MTgyNjLIAQmpAgGe5tCp-oI-4AIAqAMBqgSMAk_QsEqM3tW65WdVL0dTt4LHxgfbmNmUSTPp5uKKLgtYHTAtgv5D0pGj06YTNtoof8Y3zGzYqpm3czHoAPZ8nBv1KEVftQanALn1mpwBN2mj_6p9TFTROYQ4OZJRpsEdo5pczvLgfTEf4Z7eB3mV45EUO9oKqawWVLOlniR-uL7zj822gE_b63VEuCIEwoBvH4jOx_Sm7IB9Yg8o2DcEhbN1d3gJbIL5Khcn0gEWqu2BSIFgbGfAqdVaNNj2BVOzXTdpMHsYr7QTpho4E-AZyLRtFjOeWe3I1avUYwWIQqKL5sk1L61Fr5M6fNih4U8oeLCJ32UyNbdkFqjxU9GNrH0ecU8-MHbyrNCIZvDgBAGABoCX_NXV--Lf-QGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB&num=1&sig=AOD64_0a3npzNC3QuLO17INiRSE6WWYV-w&client=ca-pub-9602519502618262&adurl=

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

88ea4726ae9eef27732a0db3ab1dcd6eb733b5af3f63f34b34c503631f52bc06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 1612
expires: -1

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/ Frame C2B0 3 KB
1 KB 475ms
474ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/window_focus_fy2021.js

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 11:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16931
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Dec 2022 11:48:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/ Frame C2B0 18 KB
7 KB 397ms
397ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221129/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

cafe /

Resource Hash

f066f881ead135cd4ee88cf0c80ddb796f8841fc536a7950d4f7102e0502be2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 11:48:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16935
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7443
x-xss-protection: 0
server: cafe
etag: 629801499763588852
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Dec 2022 11:48:54 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame C2B0 24 KB
6 KB 437ms
436ms Script
text/javascript 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 11:48:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16935
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 06 Dec 2023 11:48:54 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C2B0 153 KB
47 KB 3825ms
3824ms Script
text/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f157.1e100.net

Software

sffe /

Resource Hash

f08c94a636dea8c08b6a50658ba1200281007d4fba996ac05cd2eeb0b873d32d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47692
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670243872199174"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Dec 2022 16:31:12 GMT

GET
DATA 200
OK truncated
/ Frame B120 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9a96cdc2774663149c42d2ff4d3c755e4fdbffdd277a7ed7768a168e7944f832

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET /
b1t-sindc1.zemanta.com/t/imp/view/5XRJCELATCR4MHWOT3JB7OZNQDU4S2FP5FEXQYLENKQHU5HLTWWR4LNJ3PNZC2NZJKAJOV5CLQYZYF5A37JVGVBN64GWLN5UHSH6YX3STKSSYE4OAM2WERGJB6OAKL336A7UXJE3IBRUIBAIX56NNXVTSZ6HOVWAHYF... Frame B120 0
0

OPTIONS
H/1.1 200
OK /
b1t-sindc1.zemanta.com/t/imp/view/5XRJCELATCR4MHWOT3JB7OZNQDU4S2FP5FEXQYLENKQHU5HLTWWR4LNJ3PNZC2NZJKAJOV5CLQYZYF5A37JVGVBN64GWLN5UHSH6YX3STKSSYE4OAM2WERGJB6OAKL336A7UXJE3IBRUIBAIX56NNXVTSZ6HOVWAHYF... Frame 0
0 706ms
236ms Preflight 23.108.101.160
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://b1t-sindc1.zemanta.com/t/imp/view/5XRJCELATCR4MHWOT3JB7OZNQDU4S2FP5FEXQYLENKQHU5HLTWWR4LNJ3PNZC2NZJKAJOV5CLQYZYF5A37JVGVBN64GWLN5UHSH6YX3STKSSYE4OAM2WERGJB6OAKL336A7UXJE3IBRUIBAIX56NNXVTSZ6HOVWAHYFITV5IYRYZNYWA6V4IIO6C7XQPXOBKBWXMTPM26OBZVFYWO4XDNK5NCVJZ4YSXZGHHR57RLEPLI4GO4VMCJYYN2ENFFXK7AY7MIWX2NG5OEBNMW3XR5OGVWPPW47CYIYJPXWME2D5SPK2WKJUCU3YNUQKGYNUGFY3OPXWGSFQNJZKTKM4NH6P7BN3BI6GIXCCMCSWKO7EPUHYQD3VQ/?
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.101.160 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Allow: GET, HEAD, OPTIONS
Connection: keep-alive
Content-Length: 0
Date: Tue, 06 Dec 2022 16:31:10 GMT

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
400 B 1194ms
398ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

ns3203177.ip-141-95-33.eu

Software

Resource Hash

5282f53750426eb239915692dc53de3fcf8f69d1024cbbd5470af079fd9ad426

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://pastelink.net/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pastelink.net
date: Tue, 06 Dec 2022 16:31:10 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 34 B
280 B 1194ms
400ms XHR
application/json 141.95.98.64
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lbs.eu-1-id5-sync.com/lbs/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

Resource Hash

fb41a26d951259ebe96696a49e271a70c258facf682bb44071834aeb33aa6176

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://pastelink.net/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pastelink.net
date: Tue, 6 Dec 2022 16:31:10 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 34
vary: Origin
content-type: application/json

GET
H2 200 bootstrap.js Show response
s2.adform.net/stoat/626/s2.adform.net/ Frame 9A7D 34 KB
16 KB 1065ms
531ms Script
text/javascript 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js
Requested by: Host: asia.adform.net
URL: https://asia.adform.net/adfscript/?bn=56367626;click=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCkWqeTG6PY9OOCae61Aahp7iQDPbU1-NtnZy51YoKwI23ARABIABgq-yxheAYggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTTIAQngAgCoAwGqBP8BT9DBkRjR-wCUyq78bIxggeHK-WaTZmFmnkgz_mqfp2VRPqG0iHhVjsoSYtozt7wFWNM0khMHXBb6uSSVIk1mK5Gw2aW2XZ3qKrB7W3hnhgVxLrLnHDGG5m8ldmWhov0NJC5roKjXsCmnc7i0UbW1k5lzgqgtIGxb1imvNK66VWFtVC-jnG0I6uuLbBHr8wR5ebXTo6srr2-fqYOemWm_pR-pjTtLcoC-iD7cE7PP9aPdUQASdiwTEweDMA9Ogt4wQ-J6RDT5mUOCnoK8LVV1zgeDOnxFF2ilLoTRp-ZkkoDjeliQFO9GkVVlYldhKxfQk9rg_2H51luiAEE3VXrO4AQBgAbM6Iunp5jN9CigBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3lEDTogwbsx0nN5KBnS6_OA2yXJg%26client%3Dca-pub-1750856239204414%26adurl%3Dhttps%253A%252F%252Fr1-usc1.zemanta.com%252Frp2%252Fb1_googleadx_display%252F27660748%252F92404976%252FHGUIS43X2PZU3FMKJO44QWZBPKUNCUSTKEB4LOU6GWQR6OAC7IXA6SKCJ6LJE6TTKM5D2WY3JFMJF54FFI25ZFMWZNVFDAAO4J2UMWWYEMC6QXDTJKGFUUS2OHIVIY4EK4R25YMMFNIXNW3LHJQRUPL3ZSJUBBQYMMAWJTPCVEW6GXR2UGQOF7QWLEBUAV3Q3QWZT4OFFBGVBJEXN5UCGHMCGZVD2WHEORR5QKQZS3EJMSP7FJ6BA45IC5BFJGDWGHS2DE7EQBLIK3HNNUF5O6MDJVLEV4L4LLDVKL4CXJ63LQMFKUQVAM5MCNVAA5VIPNI7PIL65SY6OEUV7TPUSMEOSPXSQ65RKOHUBQGXBHUX37435OWQSL7DIT76V7TGCYBJ4AHEMOHCFF6DAEQLNQLUNBTXYHOU2N2FEPG6GWHPZRNTEPXCG6ETVL42C6CMHWQLJJ5E45KRCBNYACUH5JIYQWQCWJJ2FTSZDNDW5RV52L246746DIJCRW2H2F27EQTLGVSKRIVVGVG443MWWJTUHK527TF4GMZSB7Q4L3F2JX3EDKPJVFO7FDEIP7WY%252F%253Frurl%253D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 8b1719d28e80205c8ce4ec2285a705276ff3bd6c2e6ba01ecb73d0a4f77b94a9

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:10 GMT
content-encoding: gzip
last-modified: Tue, 15 Nov 2022 08:06:48 GMT
server: nginx
x-cache-status: HIT, HIT, HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Mon, 05 Dec 2022 20:04:02 GMT

GET
H2 200 bootstrap.js Show response
s2.adform.net/stoat/626/s2.adform.net/ Frame A697 34 KB
16 KB 1181ms
648ms Script
text/javascript 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js
Requested by: Host: asia.adform.net
URL: https://asia.adform.net/adfscript/?bn=56367627;click=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCG2ggS26PY6-mO_qz1AaRg4moCPbU1-NtnZy51YoKwI23ARABIABgq-yxheAYggEXY2EtcHViLTk2MDI1MTk1MDI2MTgyNjLIAQngAgCoAwGqBIQCT9Diwqnfqo5EMculZ0hpNIvMPro8tWOEEJq6VRdOnFWXD2wi4p8EfXtbqCMRhSZ3VmXWMwpLvgiB8SW-9TzGvp21b7r6xpD6xVJWL1UgCOVODRm8olZSwdROrmOST4SSSgw7DYjcokxrI_hyFQGFAV-WPUGZdRKfeJSOYd1iW2aYj5suPP_uHjANYjZqt9l_EVRiHxYIprPdN82BHmJYQ1fLtntC17VAAi9dOfHH_60C6BUm4hmN3nl-KqFzZs5n06iL50k9jD8jBG08A1UNJBQm3R2Jk9DWiPaceiTU2h5Qfwcbfr9z0ttMB8nRIIvwMQ-U3jYcaKpMaBc8FFDC9KPGM2zgBAGABrXI6KHXgdvIvAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0PlKgkRlKclftkcf2IlmAhU7kJ4g%26client%3Dca-pub-9602519502618262%26adurl%3Dhttps%253A%252F%252Fr1-usc1.zemanta.com%252Frp2%252Fb1_googleadx_display%252F27660748%252F92404972%252FHGUIS43X2PZU3EQSL6ARXK4MNOUNCUSTKEB4LOU6GWQR6OAC7IXCYJHER4APXAGUAO3VC2V3LCT2354FFI25ZFMWZO2AZ4VG66K4CNOYEMC6QXDTJKGND6SF367BDMWDCZZEQHJAAAV24Y46YVUFRNAPN5XOKSSJHFSWEBIVMZMQDPV4IOBQTJ3HWEJFA5ZILKEMD3S4XOROFWPIE45RZ6PGD7XVYO5SPI2HZT7FE77S2NSJZDDSNBYRUBQF7LIVDBM5ZCIVOZ43D45RFFES2APD2VPNWQ2J4KJBIC35WZESRWBEWXLFPP5YQVU6AY6OEEJLII74S3KXB6T6F45IU23KBTG56IT6TOJCCSZSPMXN4DGNTTD5TXZKGAHOCZECSJGSXLOHHOC6TMMKMFBET4U62MN4NMURPL6KHY7GFATBTF3XDHNNZ2SWHSWZ6FA2YR7M3JK7YGL55U4YZCY4O5BM377Q2T7YEDDXA2H5UYIL26DP3ZH4BC7R4ZURB5W75MT3UV3LL672GT52DJMFXYNZGSBGFFASH2NPIEA4L3F2JX3EDKPFITLRMDL5XXVU%252F%253Frurl%253D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 8b1719d28e80205c8ce4ec2285a705276ff3bd6c2e6ba01ecb73d0a4f77b94a9

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:10 GMT
content-encoding: gzip
last-modified: Tue, 15 Nov 2022 08:06:48 GMT
server: nginx
x-cache-status: HIT, HIT, HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Mon, 05 Dec 2022 20:04:02 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
613 B 734ms
260ms XHR
application/json 18.141.78.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.141.78.38 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-141-78-38.ap-southeast-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 4f1419ff9ccddb65e044735b4c5cc0d810355e5ffaae450e32082a29e839afc3

Request headers

Referer: https://pastelink.net/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:10 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://pastelink.net
cache-control: no-cache
x-server: 10.42.31.112
access-control-allow-credentials: true
content-length: 156
expires: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 9186 13 KB
5 KB 270ms
270ms Document
text/html 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f132.1e100.net

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 16940
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Dec 2022 11:48:50 GMT
expires: Wed, 06 Dec 2023 11:48:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4CBC 783 B
1 KB 825ms
277ms Document
text/html 142.250.4.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f99.1e100.net

Software

GSE /

Resource Hash

9aaf6a9c19d7472805d6e9424762aca082b09f6ab57c6e23f26f90f5ca142568

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-NlvwYHN2eaBIURaKhSVCuA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-NlvwYHN2eaBIURaKhSVCuA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 06 Dec 2022 16:31:10 GMT
expires: Tue, 06 Dec 2022 16:31:10 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 bootstrap.js Show response
s2.adform.net/stoat/626/s2.adform.net/ Frame C2B0 34 KB
16 KB 1072ms
796ms Script
text/javascript 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js
Requested by: Host: asia.adform.net
URL: https://asia.adform.net/adfscript/?bn=59567767;rtbwp=Y49uTAAIhsEK1R6ZAAbIr2hHHMMEUlvpHVZbOA;rtbdata=Kmcunbdoc-iYrqZfWmdfYl-n-sgwQBtfJ4U_mph6EOCcb9KVlyDBjQ6DQwJNnHcF-CcnH1I2EkMXWlaa94Hv-NsfPst2lzPrLSC1BuLllsALxQvR_rlwjLpB_98nViapuejrgDAE7gXvw1TLPhgmpRCkxQ2k4_-AJ_xA0CDOr3f3cotLvGxRwdm3ypN9VbUfytjAbBo9VB3P10YckVIn8pkxHhXgX9Se4UFuhV40q881;nofp=1;click=https://adclick.g.doubleclick.net/aclk?sa=L&ai=CvHnVTG6PY8GNIpm91AavkZuwDMan3O9cvdKFia8LwI23ARABIABgq-yxheAYggEXY2EtcHViLTk2MDI1MTk1MDI2MTgyNjLIAQmpAgGe5tCp-oI-4AIAqAMBqgSMAk_QsEqM3tW65WdVL0dTt4LHxgfbmNmUSTPp5uKKLgtYHTAtgv5D0pGj06YTNtoof8Y3zGzYqpm3czHoAPZ8nBv1KEVftQanALn1mpwBN2mj_6p9TFTROYQ4OZJRpsEdo5pczvLgfTEf4Z7eB3mV45EUO9oKqawWVLOlniR-uL7zj822gE_b63VEuCIEwoBvH4jOx_Sm7IB9Yg8o2DcEhbN1d3gJbIL5Khcn0gEWqu2BSIFgbGfAqdVaNNj2BVOzXTdpMHsYr7QTpho4E-AZyLRtFjOeWe3I1avUYwWIQqKL5sk1L61Fr5M6fNih4U8oeLCJ32UyNbdkFqjxU9GNrH0ecU8-MHbyrNCIZvDgBAGABoCX_NXV--Lf-QGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB&num=1&sig=AOD64_0a3npzNC3QuLO17INiRSE6WWYV-w&client=ca-pub-9602519502618262&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 8b1719d28e80205c8ce4ec2285a705276ff3bd6c2e6ba01ecb73d0a4f77b94a9

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:10 GMT
content-encoding: gzip
last-modified: Tue, 15 Nov 2022 08:06:48 GMT
server: nginx
x-cache-status: HIT, HIT, HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Mon, 05 Dec 2022 20:04:02 GMT

GET
H/1.1 200
OK cGFzdGVsaW5rLm5ldA== Show response
tcheck.outbrainimg.com/tcheck/check/ Frame 2B85 15 B
462 B 730ms
240ms XHR
application/json 23.36.49.189
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tcheck.outbrainimg.com/tcheck/check/cGFzdGVsaW5rLm5ldA==
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.49.189 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-49-189.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 39d160e97e2bea07b0cf1c647259ffa4f0bd07069dba4e6c19a22d38b408510f

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Dec 2022 16:31:10 GMT
ETag: W/"f-ayLlCL3PuzXSThdu78iReSEjl6Y"
Access-Control-Max-Age: 43200
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=14100
Access-Control-Allow-Credentials: false
Connection: keep-alive
X-TraceId: d9d2ae3283917fd0f4c6b3f5fd46abcc
Content-Length: 15
Expires: Tue, 06 Dec 2022 20:26:10 GMT

GET
H2 200 px.gif
widget-pixels.outbrain.com/widget/detect/ Frame 2B85 43 B
341 B 242ms
241ms Image
image/gif 104.65.229.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widget-pixels.outbrain.com/widget/detect/px.gif?ch=1
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.229.95 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-229-95.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:11 GMT
last-modified: Wed, 30 Sep 2020 14:22:29 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1601475749.911431"
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 43
expires: Thu, 05 Jan 2023 16:31:11 GMT

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame 9B6A 2 KB
3 KB 341ms
341ms Document
text/html 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

9db9163023d7fa84f0784efe03a984337f85cc526ce7602ca48ab9666583d6fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 2208
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 06 Dec 2022 16:31:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: TJSCDGN1XZRKQP0A9WBE

GET
H3 200 T3BTWj-SqXOOtsP36vZJ1esojObpW8ivZm_viBadolo.js Show response
pagead2.googlesyndication.com/bg/ Frame 9186 36 KB
16 KB 809ms
270ms Script
text/javascript 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/T3BTWj-SqXOOtsP36vZJ1esojObpW8ivZm_viBadolo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

sffe /

Resource Hash

4f70535a3f92a9738eb6c3f7eaf649d5eb288ce6e95bc8af666fef88169da25a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 20:29:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 590530
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Mon, 21 Nov 2022 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 29 Nov 2023 20:29:01 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 9B6A
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=ae86389a

43 B
479 B

340ms
340ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=ae86389a

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:11 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: XXRHS9JMQDX41K0JJ14T
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Tue, 06 Dec 2022 16:31:11 GMT
via: 1.1 1c20fd4ecd6ab2f80432e8e32dafb792.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: SIN52-P1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=ae86389a
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: 98gYsih9qLvKfDxHDwxv4AzqaU7Rn_8ep0WHRiOJMRg3zEOHtDb_GQ==

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 9B6A
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D
https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=471b34de-8dc7-4692-bfae-4535f8d261a3

43 B
479 B

679ms
343ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=471b34de-8dc7-4692-bfae-4535f8d261a3

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: PWQJNWK2HZMHSCJK56XA
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=471b34de-8dc7-4692-bfae-4535f8d261a3
Date: Tue, 06 Dec 2022 16:31:11 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 9B6A
Redirect Chain

https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D
https://s.amazon-adsystem.com/ecm3?id=2A98FD745A1B4AF8AE7DB3D2EBC1B256&ex=simpli.fi&status=ok

43 B
479 B

779ms
342ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=2A98FD745A1B4AF8AE7DB3D2EBC1B256&ex=simpli.fi&status=ok

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 2VF2TTKJFPH0VXSWBMTB
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Tue, 06 Dec 2022 16:31:11 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://s.amazon-adsystem.com/ecm3?id=2A98FD745A1B4AF8AE7DB3D2EBC1B256&ex=simpli.fi&status=ok
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 05 Dec 2022 16:31:11 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 9B6A
Redirect Chain

https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3133458717443696000V10

43 B
479 B

344ms
344ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3133458717443696000V10

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:11 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 2V76YEF806V8W3ZN0PQS
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:11 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3133458717443696000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
X-MNET-HL2: E
Expires: Tue, 06 Dec 2022 16:31:11 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 9B6A
Redirect Chain

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__
https://stags.bluekai.com/site/23178?id=Lwq7BAKDzSlALlB6Qdna&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZSXQY3IMFXGOZJ5MFWWC6TPNZPXIYLNEZUWIPKMO5YTOQSBJNCHUU3MIFGGY...
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=Lwq7BAKDzSlALlB6Qdna

43 B
479 B

345ms
345ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=Lwq7BAKDzSlALlB6Qdna

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: P6DCSJTEGM7RNSYYEFCR
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:13 GMT
Content-Type: text/html; charset=utf-8
Location: https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=Lwq7BAKDzSlALlB6Qdna
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 101
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 / Show response
match.sharethrough.com/jwumXNuB/v1/ Frame 3B25 427 B
612 B 783ms
235ms Document
text/html 54.254.5.67
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.254.5.67 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-5-67.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 78e91203d3fe53559461933e84cedf9f3c834053fa8992b3c40745fceceaa873

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

content-length: 427
date: Tue, 06 Dec 2022 16:31:11 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 91E8 15 KB
6 KB 844ms
235ms Document
text/html 104.65.228.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.228.208 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-228-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=48007
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 06 Dec 2022 16:31:11 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Wed, 07 Dec 2022 05:51:18 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame E81B 281 B
554 B 741ms
263ms Document
text/html 23.9.185.218
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_n-simpli.fi_rbd_n-MediaNet_smrt_cnv_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.9.185.218 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-9-185-218.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 06 Dec 2022 16:31:11 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame AAF3
Redirect Chain

https://ssbsync-us.smartadserver.com/api/sync?callerId=2
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4391157641653952304&gdpr=0&gdpr_consent=

43 B
479 B

390ms
340ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4391157641653952304&gdpr=0&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 06 Dec 2022 16:31:11 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: NQFZKHENBSTNHZJY8BF6

Redirect headers

content-length: 0
date: Tue, 06 Dec 2022 16:31:11 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4391157641653952304&gdpr=0&gdpr_consent=

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame E4D1
Redirect Chain

https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D
https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=155d84e820ae1b0e&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAALp5fZQ7v81wM8fcZPAAAAAAA&expiration=1670430671&is_secure=true

43 B
479 B

455ms
341ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAALp5fZQ7v81wM8fcZPAAAAAAA&expiration=1670430671&is_secure=true

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 06 Dec 2022 16:31:12 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: D3BPCAS313QAAFBJ651N

Redirect headers

cache-control: no-cache, private, max-age=0, no-store
content-length: 0
date: Tue, 06 Dec 2022 16:31:11 GMT
expires: 0
location: https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAALp5fZQ7v81wM8fcZPAAAAAAA&expiration=1670430671&is_secure=true
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
pragma: no-cache
server: nginx

GET
H/1.1 200
OK dwce_cheq_events Show response
log.outbrainimg.com/loggerServices/ Frame 2B85 4 B
325 B 1164ms
291ms XHR
application/json 38.133.127.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1670344271001&sessionId=c7b1dcaf-26e5-17ae-a9db-39d068149d28&url=pastelink.net&cheqSource=1&cheqEvent=3&responseTime=733
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.63 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:12 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: 6ea6e416d5a1d516ac5ae06c02c4da30
Content-Length: 4
Expires: 0

GET
H2 200 / Show response
asia.adform.net/adfserve/ Frame 9A7D 11 KB
4 KB 267ms
266ms Script
text/javascript 185.84.60.20
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://asia.adform.net/adfserve/?CC=1&bn=56367626;click=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCkWqeTG6PY9OOCae61Aahp7iQDPbU1-NtnZy51YoKwI23ARABIABgq-yxheAYggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTTIAQngAgCoAwGqBP8BT9DBkRjR-wCUyq78bIxggeHK-WaTZmFmnkgz_mqfp2VRPqG0iHhVjsoSYtozt7wFWNM0khMHXBb6uSSVIk1mK5Gw2aW2XZ3qKrB7W3hnhgVxLrLnHDGG5m8ldmWhov0NJC5roKjXsCmnc7i0UbW1k5lzgqgtIGxb1imvNK66VWFtVC-jnG0I6uuLbBHr8wR5ebXTo6srr2-fqYOemWm_pR-pjTtLcoC-iD7cE7PP9aPdUQASdiwTEweDMA9Ogt4wQ-J6RDT5mUOCnoK8LVV1zgeDOnxFF2ilLoTRp-ZkkoDjeliQFO9GkVVlYldhKxfQk9rg_2H51luiAEE3VXrO4AQBgAbM6Iunp5jN9CigBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3lEDTogwbsx0nN5KBnS6_OA2yXJg%26client%3Dca-pub-1750856239204414%26adurl%3Dhttps%253A%252F%252Fr1-usc1.zemanta.com%252Frp2%252Fb1_googleadx_display%252F27660748%252F92404976%252FHGUIS43X2PZU3FMKJO44QWZBPKUNCUSTKEB4LOU6GWQR6OAC7IXA6SKCJ6LJE6TTKM5D2WY3JFMJF54FFI25ZFMWZNVFDAAO4J2UMWWYEMC6QXDTJKGFUUS2OHIVIY4EK4R25YMMFNIXNW3LHJQRUPL3ZSJUBBQYMMAWJTPCVEW6GXR2UGQOF7QWLEBUAV3Q3QWZT4OFFBGVBJEXN5UCGHMCGZVD2WHEORR5QKQZS3EJMSP7FJ6BA45IC5BFJGDWGHS2DE7EQBLIK3HNNUF5O6MDJVLEV4L4LLDVKL4CXJ63LQMFKUQVAM5MCNVAA5VIPNI7PIL65SY6OEUV7TPUSMEOSPXSQ65RKOHUBQGXBHUX37435OWQSL7DIT76V7TGCYBJ4AHEMOHCFF6DAEQLNQLUNBTXYHOU2N2FEPG6GWHPZRNTEPXCG6ETVL42C6CMHWQLJJ5E45KRCBNYACUH5JIYQWQCWJJ2FTSZDNDW5RV52L246746DIJCRW2H2F27EQTLGVSKRIVVGVG443MWWJTUHK527TF4GMZSB7Q4L3F2JX3EDKPJVFO7FDEIP7WY%252F%253Frurl%253D;js=1;adfxid=1x;934;set=en-US|en-US|1600X1200|0|300|250|24|8|3|7|1|;cmpgdpr=;cmpgdprconsent=;fd=0|0&CREFURL=https%3A%2F%2Fpastelink.net

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

082c1c08ffa28a33a284b7e67345c2fbe156f5e4264dbaefa74c994e71a7f9d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 3667
expires: -1

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4CBC 0
0 280ms
280ms Image
text/html 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022120101&jk=3206157806165007&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.194.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

POST
H/1.1 200 1102.json Show response
id5-sync.com/g/v2/ 462 B
1 KB 1191ms
397ms XHR
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/1102.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

124f0f57688243156d74f6b125967d4271fb72421497701415cbac4100ccc4a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://pastelink.net/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Dec 2022 16:31:11 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://pastelink.net
p3p: CP="CAO PSA OUR"
access-control-allow-credentials: true

GET
H2 200 / Show response
asia.adform.net/adfserve/ Frame A697 11 KB
4 KB 267ms
266ms Script
text/javascript 185.84.60.20
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://asia.adform.net/adfserve/?CC=1&bn=56367627;click=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCG2ggS26PY6-mO_qz1AaRg4moCPbU1-NtnZy51YoKwI23ARABIABgq-yxheAYggEXY2EtcHViLTk2MDI1MTk1MDI2MTgyNjLIAQngAgCoAwGqBIQCT9Diwqnfqo5EMculZ0hpNIvMPro8tWOEEJq6VRdOnFWXD2wi4p8EfXtbqCMRhSZ3VmXWMwpLvgiB8SW-9TzGvp21b7r6xpD6xVJWL1UgCOVODRm8olZSwdROrmOST4SSSgw7DYjcokxrI_hyFQGFAV-WPUGZdRKfeJSOYd1iW2aYj5suPP_uHjANYjZqt9l_EVRiHxYIprPdN82BHmJYQ1fLtntC17VAAi9dOfHH_60C6BUm4hmN3nl-KqFzZs5n06iL50k9jD8jBG08A1UNJBQm3R2Jk9DWiPaceiTU2h5Qfwcbfr9z0ttMB8nRIIvwMQ-U3jYcaKpMaBc8FFDC9KPGM2zgBAGABrXI6KHXgdvIvAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0PlKgkRlKclftkcf2IlmAhU7kJ4g%26client%3Dca-pub-9602519502618262%26adurl%3Dhttps%253A%252F%252Fr1-usc1.zemanta.com%252Frp2%252Fb1_googleadx_display%252F27660748%252F92404972%252FHGUIS43X2PZU3EQSL6ARXK4MNOUNCUSTKEB4LOU6GWQR6OAC7IXCYJHER4APXAGUAO3VC2V3LCT2354FFI25ZFMWZO2AZ4VG66K4CNOYEMC6QXDTJKGND6SF367BDMWDCZZEQHJAAAV24Y46YVUFRNAPN5XOKSSJHFSWEBIVMZMQDPV4IOBQTJ3HWEJFA5ZILKEMD3S4XOROFWPIE45RZ6PGD7XVYO5SPI2HZT7FE77S2NSJZDDSNBYRUBQF7LIVDBM5ZCIVOZ43D45RFFES2APD2VPNWQ2J4KJBIC35WZESRWBEWXLFPP5YQVU6AY6OEEJLII74S3KXB6T6F45IU23KBTG56IT6TOJCCSZSPMXN4DGNTTD5TXZKGAHOCZECSJGSXLOHHOC6TMMKMFBET4U62MN4NMURPL6KHY7GFATBTF3XDHNNZ2SWHSWZ6FA2YR7M3JK7YGL55U4YZCY4O5BM377Q2T7YEDDXA2H5UYIL26DP3ZH4BC7R4ZURB5W75MT3UV3LL672GT52DJMFXYNZGSBGFFASH2NPIEA4L3F2JX3EDKPFITLRMDL5XXVU%252F%253Frurl%253D;js=1;adfxid=2x;5397;set=en-US|en-US|1600X1200|0|300|250|24|8|3|7|1|;cmpgdpr=;cmpgdprconsent=;fd=0|0&CREFURL=https%3A%2F%2Fpastelink.net

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

daf08b23f2d621d5d90906aa40766a0335d7431e51b9dfb019cea6fabc29d3ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 3679
expires: -1

GET
H2 200 / Show response
asia.adform.net/adfserve/ Frame C2B0 7 KB
4 KB 269ms
268ms Script
text/javascript 185.84.60.20
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://asia.adform.net/adfserve/?CC=1&bn=59567767;rtbwp=Y49uTAAIhsEK1R6ZAAbIr2hHHMMEUlvpHVZbOA;rtbdata=Kmcunbdoc-iYrqZfWmdfYl-n-sgwQBtfJ4U_mph6EOCcb9KVlyDBjQ6DQwJNnHcF-CcnH1I2EkMXWlaa94Hv-NsfPst2lzPrLSC1BuLllsALxQvR_rlwjLpB_98nViapuejrgDAE7gXvw1TLPhgmpRCkxQ2k4_-AJ_xA0CDOr3f3cotLvGxRwdm3ypN9VbUfytjAbBo9VB3P10YckVIn8pkxHhXgX9Se4UFuhV40q881;nofp=1;click=https://adclick.g.doubleclick.net/aclk?sa=L&ai=CvHnVTG6PY8GNIpm91AavkZuwDMan3O9cvdKFia8LwI23ARABIABgq-yxheAYggEXY2EtcHViLTk2MDI1MTk1MDI2MTgyNjLIAQmpAgGe5tCp-oI-4AIAqAMBqgSMAk_QsEqM3tW65WdVL0dTt4LHxgfbmNmUSTPp5uKKLgtYHTAtgv5D0pGj06YTNtoof8Y3zGzYqpm3czHoAPZ8nBv1KEVftQanALn1mpwBN2mj_6p9TFTROYQ4OZJRpsEdo5pczvLgfTEf4Z7eB3mV45EUO9oKqawWVLOlniR-uL7zj822gE_b63VEuCIEwoBvH4jOx_Sm7IB9Yg8o2DcEhbN1d3gJbIL5Khcn0gEWqu2BSIFgbGfAqdVaNNj2BVOzXTdpMHsYr7QTpho4E-AZyLRtFjOeWe3I1avUYwWIQqKL5sk1L61Fr5M6fNih4U8oeLCJ32UyNbdkFqjxU9GNrH0ecU8-MHbyrNCIZvDgBAGABoCX_NXV--Lf-QGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQPoLAggBgAwB0BUBgBcB&num=1&sig=AOD64_0a3npzNC3QuLO17INiRSE6WWYV-w&client=ca-pub-9602519502618262&adurl=;js=1;adfxid=3x;1384;set=en-US|en-US|1600X1200|0|300|250|24|8|3|7|1|;fd=0|0&CREFURL=https%3A%2F%2Fpastelink.net

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e4fb476276f1f85cdb8083cd12d8586b8b9e631fc3ef83b7b752fa01c7f8e834

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 3132
expires: -1

GET
DATA 200
OK truncated
/ Frame 9A7D 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7db34c76d93cc7d307141a584e7e34227794e9b1ceccdd5c447910b89a89ce89

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 get Show response
odb.outbrain.com/utils/ Frame 2B85 20 KB
7 KB 1104ms
632ms Script
text/javascript 199.232.46.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://odb.outbrain.com/utils/get?url=https%3A%2F%2Fpastelink.net%2F6brvsep8&idx=0&rand=84181&key=NANOWDGT01&widgetJSId=AR_1&va=true&et=true&format=html&adblck=false&abwl=false&px=0&py=0&vpd=0&cw=300&activeTab=true&darkMode=false&ab=0&wl=0undefined&settings=true&recs=true&version=2000974&sig=9zLXxPDh&apv=false&false&osLang=en-US&winW=300&winH=250&scrW=1600&scrH=1200&dpr=1&secured=true&cmpStat=0&ccpaStat=0&iframe=true&ref=https%3A%2F%2Fpastelink.net%2F6brvsep8&ogn=https%3A%2F%2Fpastelink.net%2F6brvsep8
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.46.132 Singapore, Singapore, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: fa8faf9862aa69aec8ba3890bca3712fd816736afc0d636814ea98f1fe36a0f3

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-cache-hits: 0, 0
date: Tue, 06 Dec 2022 16:31:13 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
traffic-path: SADC1, SJC, QPG, APAC1
x-cache: MISS, MISS
p3p: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
x-traceid: 41b58bb14ef5c48c0f991a941b6eec34
content-length: 6733
x-served-by: cache-sjc10057-SJC, cache-qpg1245-QPG
pragma: no-cache
x-timer: S1670344273.757615,VS0,VE399
vary: Accept-Encoding, User-Agent
content-type: text/javascript; charset=UTF-8
cache-control: no-cache
accept-ranges: bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 Standard Show response
s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/ Frame 9A7D 90 KB
39 KB 307ms
307ms Script
text/javascript 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/Standard
Requested by: Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 8e16ad2005bc4c19f8560189ef6e7b7475f2b3def2c60a57f9041fac5b4f94cf

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:11 GMT
content-encoding: gzip
last-modified: Tue, 15 Nov 2022 08:06:48 GMT
server: nginx
x-cache-status: MISS, HIT, HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Mon, 05 Dec 2022 19:59:24 GMT

GET
DATA 200
OK truncated
/ Frame A697 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f18aa8aff38b203c6cecb0fd2bb9e13c1ea7295956d4842cba9958334318bb2

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame E81B 34 KB
10 KB 236ms
236ms Script
text/html 23.9.185.218
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.9.185.218 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-9-185-218.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c32c5c6fa15808159a19785f2cd7418fc20b8fce3fd18194aaaf4062059368a5

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Dec 2022 16:31:11 GMT
Content-Encoding: gzip
Last-Modified: Tue, 06 Dec 2022 00:31:58 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=28839
Connection: keep-alive
Content-Length: 10067
Expires: Wed, 07 Dec 2022 00:31:50 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 3B25 43 B
479 B 610ms
343ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=5225d362-f884-4d90-acba-808da9caf77b

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:11 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: E4ZXM9NP0DMKPMSSPGHX
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 3B25
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1
https://b1sync.zemanta.com/usersync/sharethrough?gdpr=0&gdpr_consent=
https://stags.bluekai.com/site/23178?id=MHwbB1ok78yc3gqJKnDs&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS63LBORRWQLTTNBQXEZLUNBZG65LHNAXGG33NF5ZXS3TD...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS63LBORRWQLTTNBQXEZLUNBZG65LHNAXGG33NF5ZXS3TDF53DCP3FPBRWQYLOM5ST243IMFZGK5DIOJXXKZ3IEZTWI4DSHUYCM43POVZGGZK7NFSD2YJXHEZTKMZQGU4DC...
https://match.sharethrough.com/sync/v1?gdpr=0&source_id=a7935305814f8c5e2a34ba54&source_user_id=MHwbB1ok78yc3gqJKnDs

68 B
279 B

239ms
239ms

Image
image/png

54.254.5.67
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?gdpr=0&source_id=a7935305814f8c5e2a34ba54&source_user_id=MHwbB1ok78yc3gqJKnDs
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 54.254.5.67 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-5-67.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:13 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:13 GMT
Content-Type: text/html; charset=utf-8
Location: https://match.sharethrough.com/sync/v1?gdpr=0&source_id=a7935305814f8c5e2a34ba54&source_user_id=MHwbB1ok78yc3gqJKnDs
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 147
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 3B25
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=

68 B
279 B

237ms
236ms

Image
image/png

54.254.5.67
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 54.254.5.67 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-5-67.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:12 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 3B25
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3
https://sync.search.spotxchange.com/partner?adv_id=8499&redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3Dk1jJghvBi79yX1NZ2sM5fXrm%26source_user_id%3D%24SPOTX_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=8499&redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3Dk1jJghvBi79yX1NZ2sM5fXrm%26source_user_id%3D%24SPOTX_USER_ID&__user_chec...
https://match.sharethrough.com/sync/v1?source_id=k1jJghvBi79yX1NZ2sM5fXrm&source_user_id=65cc15b1-7583-11ed-8059-10e583b00307

68 B
279 B

238ms
238ms

Image
image/png

54.254.5.67
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=k1jJghvBi79yX1NZ2sM5fXrm&source_user_id=65cc15b1-7583-11ed-8059-10e583b00307
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 54.254.5.67 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-5-67.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:13 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Date: Tue, 06 Dec 2022 16:31:12 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: https://match.sharethrough.com/sync/v1?source_id=k1jJghvBi79yX1NZ2sM5fXrm&source_user_id=65cc15b1-7583-11ed-8059-10e583b00307
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 17
Connection: keep-alive
Content-Length: 0

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 3B25
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=deb3cc24-b269-4904-b0b7-618fe5c8ea83&gdpr=0&gdpr_consent=

68 B
279 B

237ms
236ms

Image
image/png

54.254.5.67
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=deb3cc24-b269-4904-b0b7-618fe5c8ea83&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 54.254.5.67 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-254-5-67.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:12 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=deb3cc24-b269-4904-b0b7-618fe5c8ea83&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 9186 0
10 B 270ms
270ms Image
text/plain 142.250.4.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?Ag6rQg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.4.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sm-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:11 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 Standard Show response
s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/ Frame A697 90 KB
39 KB 317ms
317ms Script
text/javascript 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/Standard
Requested by: Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 8e16ad2005bc4c19f8560189ef6e7b7475f2b3def2c60a57f9041fac5b4f94cf

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:11 GMT
content-encoding: gzip
last-modified: Tue, 15 Nov 2022 08:06:48 GMT
server: nginx
x-cache-status: MISS, HIT, HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Mon, 05 Dec 2022 19:59:24 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 91E8 2 KB
2 KB 708ms
235ms Script
text/html 67.199.150.81
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=13998982&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.81 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: 60fc9aef81f8d49c37871134e6266f6461981ea49c9b6f1375be0b9cf7af2933

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 06 Dec 2022 16:31:12 GMT
content-length: 1652
content-type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame C2B0 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b8a9b9565ed30ab5e7dfe1fc24d9aa17748d72d8a09edc72aab83aa25706032c

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Standard Show response
s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/ImageTag:types/ Frame C2B0 85 KB
36 KB 348ms
348ms Script
text/javascript 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/ImageTag:types/Standard
Requested by: Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 863ad739bb9402363d8f11aa86e044ddfa80fd927de18b09814259f152fdf01f

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:11 GMT
content-encoding: gzip
last-modified: Tue, 15 Nov 2022 08:06:48 GMT
server: nginx
x-cache-status: MISS, HIT, HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Mon, 05 Dec 2022 20:30:19 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame E81B 284 B
932 B 948ms
237ms Image
image/jpg 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 284
X-RPHost: 38ddff6a66d3988dfd0c6ea3be81c5f1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

POST
H2 200 /
asia.adform.net/csimpr/ Frame 9A7D 35 B
494 B 266ms
266ms Ping
image/gif 185.84.60.20
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://asia.adform.net/csimpr/?bn=56367626&csi=9LOE0TWO5V_Ff_Y9kL8fSO29JqcV15LMo-Yc4GmGQEUJDwKV3Zer3D1OmF_cvIJZ4BaZNlXUCrgs9fwUj3Hii96vWmW1dlSa0

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 11240091.js Show response
s2.adform.net/Banners/Elements/Files/2111416/11240091/ Frame 8CDD 8 KB
4 KB 268ms
267ms Script
application/x-javascript 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/Banners/Elements/Files/2111416/11240091/11240091.js?ADFassetID=11240091&bv=513
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 8c6af3eda3fb057943991e6f4cb4b09706f6fc422de9f6fd6130347e4446493e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:11 GMT
content-encoding: gzip
last-modified: Sat, 28 May 2022 23:24:13 GMT
server: nginx
x-amz-request-id: tx000005070139e1a70dec6-00638e7c95-329373d4-default
etag: W/"e4cbd12b65e1415d73b367e76b1a6327"
x-cache-status: MISS, HIT, HIT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800

POST
H2 200 /
asia.adform.net/csimpr/ Frame A697 35 B
494 B 265ms
264ms Ping
image/gif 185.84.60.20
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://asia.adform.net/csimpr/?bn=56367627&csi=Wj_LUckaj5f_DZ_UEp7a6Sq5GBAQogb4o-Yc4GmGQEUJDwKV3Zer3D1OmF_cvIJZGHoaQIsCmBX0R2E56QFmM96vWmW1dlSa0

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 11240088.js Show response
s2.adform.net/Banners/Elements/Files/2111416/11240088/ Frame 9CD0 8 KB
4 KB 267ms
266ms Script
application/x-javascript 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/Banners/Elements/Files/2111416/11240088/11240088.js?ADFassetID=11240088&bv=513
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 70e3f17e43a1cb1cd7905c7677b894b82f933476e5b36eda27b474d2846058c0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
last-modified: Sat, 28 May 2022 23:24:13 GMT
server: nginx
x-amz-request-id: tx000004b55b512a27022b7-00638f3fc7-329373d4-default
etag: W/"75193eb768fb2e95947f3d97bb0b99e1"
x-cache-status: MISS, EXPIRED, HIT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800

POST
H2 200 /
asia.adform.net/csimpr/ Frame C2B0 35 B
494 B 270ms
268ms Ping
image/gif 185.84.60.20
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://asia.adform.net/csimpr/?bn=59567767&csi=hulVlV2vsaWIVCrjQZ5QCFOLKhST8Lee0UQbOeUBPL4JDwKV3Zer3D1OmF_cvIJZgpcYg1c1wXIsEfegxcsc7WQBbo50IEXs0

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 56357163.jpg
s2.adform.net/Banners/56357163/ Frame C2B0 52 KB
53 KB 283ms
281ms Image
image/jpeg 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s2.adform.net/Banners/56357163/56357163.jpg?bv=2
Requested by: Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 2229f7b0ab01979c53a12a84a8f1502417cc2d0c41010980e345b921c9ebde21

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
last-modified: Wed, 16 Nov 2022 14:57:34 GMT
server: nginx
x-amz-request-id: tx00000384f194a40cf2c17-00638dcf64-329373d4-default
etag: "484ecfb2cf258b95b1cb3ab60667565c"
x-cache-status: HIT, HIT, HIT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 53522

GET
H2 200 Adform.DHTML.js Show response
s2.adform.net/banners/scripts/rmb/ Frame 8CDD 30 KB
14 KB 333ms
331ms Script
application/javascript 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/banners/scripts/rmb/Adform.DHTML.js?bv=626
Requested by: Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/Standard
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
last-modified: Wed, 08 Jun 2022 12:02:22 GMT
server: nginx
x-amz-request-id: tx00000c70e9fd68608542c-0063765fb4-329373d4-default
etag: W/"4731aef0a5114a59b4311776d270e848"
x-cache-status: HIT, HIT, HIT
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-rgw-object-type: Normal
cache-control: public, max-age=604800

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame 8CDD 236 KB
63 KB 811ms
320ms Script
text/javascript 23.49.60.145
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/Standard
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.49.60.145 Singapore, Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-49-60-145.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=900
x-n: S
accept-ranges: bytes
expires: Tue, 06 Dec 2022 16:46:12 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 8CDD 2 KB
624 B 575ms
274ms Stylesheet
text/css 74.125.24.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:600&subset=latin

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f95.1e100.net

Software

ESF /

Resource Hash

a12f64cad3e3b6dbad5d094c5ec316e18b64cbab9b4a1481e46d0afe4d707110

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 06 Dec 2022 16:31:12 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Dec 2022 16:31:12 GMT

GET
H2 200 index.js Show response
s2.adform.net/Banners/Elements/Files/2111416/11240091/bvpath_513/ Frame 8CDD 51 KB
16 KB 352ms
350ms Script
application/x-javascript 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/Banners/Elements/Files/2111416/11240091/bvpath_513/index.js
Requested by: Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/Standard
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: f8c6274be8ab5d7dafd695c4683723ea43bc60fa25fa75d6834b4aabadc0cb2e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
last-modified: Sat, 28 May 2022 23:24:13 GMT
server: nginx
x-amz-request-id: tx00000f74e4dd20e78c482-00638e7c96-3293868f-default
etag: W/"29b762426bc7904813be16876d37c7f6"
x-cache-status: MISS, HIT, HIT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800

GET
H2 200 Adform.DHTML.js Show response
s2.adform.net/banners/scripts/rmb/ Frame 9CD0 30 KB
14 KB 280ms
278ms Script
application/javascript 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/banners/scripts/rmb/Adform.DHTML.js?bv=626
Requested by: Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/Standard
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
last-modified: Wed, 08 Jun 2022 12:02:22 GMT
server: nginx
x-amz-request-id: tx00000c70e9fd68608542c-0063765fb4-329373d4-default
etag: W/"4731aef0a5114a59b4311776d270e848"
x-cache-status: HIT, HIT, HIT
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-rgw-object-type: Normal
cache-control: public, max-age=604800

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame 9CD0 236 KB
63 KB 589ms
258ms Script
text/javascript 23.49.60.145
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/Standard
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.49.60.145 Singapore, Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-49-60-145.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=900
x-n: S
accept-ranges: bytes
expires: Tue, 06 Dec 2022 16:46:12 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 9CD0 2 KB
578 B 574ms
273ms Stylesheet
text/css 74.125.24.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:600&subset=latin

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f95.1e100.net

Software

ESF /

Resource Hash

a12f64cad3e3b6dbad5d094c5ec316e18b64cbab9b4a1481e46d0afe4d707110

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 06 Dec 2022 16:31:12 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Dec 2022 16:31:12 GMT

GET
H2 200 index.js Show response
s2.adform.net/Banners/Elements/Files/2111416/11240088/bvpath_513/ Frame 9CD0 66 KB
19 KB 298ms
297ms Script
application/x-javascript 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/Banners/Elements/Files/2111416/11240088/bvpath_513/index.js
Requested by: Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/Standard
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 2576c0d36efa51e919a92bd795c184bdd66b36736ef24efebbdd5d576af45c1e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:12 GMT
content-encoding: gzip
last-modified: Sat, 28 May 2022 23:24:13 GMT
server: nginx
x-amz-request-id: tx0000089ccd5da26a6b7e7-00638f3fc8-3293aae9-default
etag: W/"0e20c5c5f52d79952e05a2bba891b71e"
x-cache-status: MISS, EXPIRED, HIT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800

GET
H2 200 match Show response
c1.adform.net/serving/cookie/ Frame 8167 35 B
476 B 266ms
265ms Document
image/gif 185.84.60.20
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?party=14&cid=44E18C09-7587-44A4-8BE6-C5026AC544A2&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Tue, 06 Dec 2022 16:31:12 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 1CA2
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3029638f-6e50-4a00-a015-5da045eeed90&gdpr=0&gdpr_consent=

42 B
402 B

235ms
235ms

Document
image/gif

67.199.150.86
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3029638f-6e50-4a00-a015-5da045eeed90&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.86 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Dec 2022 16:31:11 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Tue, 06 Dec 2022 16:31:12 GMT
Expires: Tue, 06 Dec 2022 16:31:11 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 180 1fd3e2d master hkg-pixel-x20 config:1.0.0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3029638f-6e50-4a00-a015-5da045eeed90&gdpr=0&gdpr_consent=

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame 8296 43 B
479 B 417ms
342ms Document
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID44E18C09-7587-44A4-8BE6-C5026AC544A2

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 06 Dec 2022 16:31:12 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: TJWG9T33GB6DQ0AH7NPP

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 91E8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=ROGMCXWHRKSL5sUCasVEog%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

15 KB
15 KB

234ms
234ms

Image
text/html

104.65.228.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 104.65.228.208 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-228-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:13 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=48005
accept-ranges: bytes
content-length: 5549
expires: Wed, 07 Dec 2022 05:51:18 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

458249.gif
idsync.rlcdn.com/ Frame 91E8
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=44E18C09-7587-44A4-8BE6-C5026AC544A2
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJDQ0RTE4QzA5LTc1ODctNDRBNC04QkU2LUM1MDI2QUM1NDRBMhAAGg0I0Ny9nAYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=42a6034dfd996077b9095cfdf12eb2f9ff45ead9e4c6a799e0c1e6c5bdc5e85c791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA0MmE2MDM0ZGZkOTk2MDc3YjkwOTVjZmRmMTJlYjJmOWZmNDVlYWQ5ZTRjNmE3OTllMGMxZTZjNWJkYzVlODVjNzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA0MmE2MDM0ZGZkOTk2MDc3YjkwOTVjZmRmMTJlYjJmOWZmNDVlYWQ5ZTRjNmE3OTllMGMxZTZjNWJkYzVlODVjNzkxNDI2YjU0MTdkY2UyMRAAGgwI0dy9nAYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=0472ab86-463e-49a2-92cd-a95c05201748

42 B
60 B

318ms
318ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=0472ab86-463e-49a2-92cd-a95c05201748
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:15 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/458249.gif?partner_uid=0472ab86-463e-49a2-92cd-a95c05201748
date: Tue, 06 Dec 2022 16:31:15 GMT
via: 1.1 google
x-samesite: secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111
content-type: text/html; charset=utf-8

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 91E8
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=1104638f-6e50-4200-86b1-632afc2acc2c

0
260 B

710ms
238ms

Image
text/plain

67.199.150.85
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=1104638f-6e50-4200-86b1-632afc2acc2c
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 67.199.150.85 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:13 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Tue, 06 Dec 2022 16:31:12 GMT
Server: MT3 180 1fd3e2d master hkg-pixel-x27 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=1104638f-6e50-4200-86b1-632afc2acc2c
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 06 Dec 2022 16:31:11 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 91E8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NDRFMThDMDktNzU4Ny00NEE0LThCRTYtQzUwMjZBQzU0NEEy&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
95 B

235ms
234ms

Image
image/gif

67.199.150.86
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 67.199.150.86 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 06 Dec 2022 16:31:13 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 91E8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK74ruw0sCJbz4uVpDu_dA4&google_cver=1

42 B
376 B

236ms
235ms

Image
image/gif

67.199.150.86
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK74ruw0sCJbz4uVpDu_dA4&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 67.199.150.86 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 06 Dec 2022 16:31:13 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEK74ruw0sCJbz4uVpDu_dA4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 91E8
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:2A98FD745A1B4AF8AE7DB3D2EBC1B256

42 B
439 B

708ms
235ms

Image
image/gif

67.199.150.86
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:2A98FD745A1B4AF8AE7DB3D2EBC1B256
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 67.199.150.86 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 06 Dec 2022 16:31:11 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Tue, 06 Dec 2022 16:31:12 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:2A98FD745A1B4AF8AE7DB3D2EBC1B256
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 05 Dec 2022 16:31:12 GMT

GET
H2 200 44E18C09-7587-44A4-8BE6-C5026AC544A2
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 91E8 43 B
603 B 954ms
348ms Image
image/gif 44.238.192.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/44E18C09-7587-44A4-8BE6-C5026AC544A2?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.238.192.116 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-238-192-116.us-west-2.compute.amazonaws.com

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 91E8
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=

42 B
508 B

706ms
235ms

Image
image/gif

67.199.150.86
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 67.199.150.86 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 06 Dec 2022 16:31:13 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:12 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 355

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame E81B
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=LBCFUPAL-1R-9PLK
https://s.amazon-adsystem.com/ecm3?id=LBCFUPAL-1R-9PLK&ex=d-rubiconproject.com&status=ok

43 B
479 B

342ms
341ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LBCFUPAL-1R-9PLK&ex=d-rubiconproject.com&status=ok

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 3783MW6Y7XQEXG0F49KR
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LBCFUPAL-1R-9PLK&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
Expires: 0

GET
DATA 200
OK truncated
/ Frame 2B85 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 20e28022f8ab881cac6da6c6cc0e56333da60ab3f4d5540285865f30016d7ebf

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame E81B
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=&expires=30

42 B
689 B

945ms
237ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 548ddf114c6f6bfbb66a4cdeb6a219f4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:12 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame E81B 43 B
855 B 1710ms
491ms Image
image/gif 52.95.126.160
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.95.126.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: KWFHEFENJ82TCYHNZ0KV
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame E81B
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/ekWRCk-6GdE-CWazLSZhucn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-P3aCGyNE2oIytHPJPAbzNvV8qCp92yrYROPRLQ--~A

42 B
689 B

738ms
236ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-P3aCGyNE2oIytHPJPAbzNvV8qCp92yrYROPRLQ--~A
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: c80248407eff6cf595ce43a76c04e23f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Tue, 06 Dec 2022 16:31:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-P3aCGyNE2oIytHPJPAbzNvV8qCp92yrYROPRLQ--~A
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame E81B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEOH9oClomGk9tk3f1RJ8jp0&google_cver=1

42 B
689 B

941ms
235ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEOH9oClomGk9tk3f1RJ8jp0&google_cver=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 6690dc791bf02dde8c4051a04cfd7bb8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEOH9oClomGk9tk3f1RJ8jp0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame E81B
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=hzSbOGDbQWWiqBmROx7ddQ&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=hzSbOGDbQWWiqBmROx7ddQ

43 B
479 B

343ms
343ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=hzSbOGDbQWWiqBmROx7ddQ

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: GV8BC6V66NC8CFVVN4JZ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=hzSbOGDbQWWiqBmROx7ddQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 548ddf114c6f6bfbb66a4cdeb6a219f4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame E81B
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LBCFUPAL-1R-9PLK

0
573 B

712ms
423ms

Image
text/plain

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LBCFUPAL-1R-9PLK
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:13 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: B757430D31D74BC590005A8190DE407A Ref B: SYD03EDGE2010 Ref C: 2022-12-06T16:31:13Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXvK1UWUrzV9Wt4l7S0Fg==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LBCFUPAL-1R-9PLK
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 808ed95536e7f55d8adbcb9fc76d309d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E81B
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJDRlVQQUwtMVItOVBMSw==

170 B
243 B

575ms
274ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJDRlVQQUwtMVItOVBMSw==

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f156.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJDRlVQQUwtMVItOVBMSw==
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 0ed95c36ed1932be3ba76fc523a6e179
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E81B
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=Y2EyYzRiZmVkNjhkZjMwOTUzNWNmNDBhYjEzZTZiMzA5YmU0NWRjNg

170 B
188 B

275ms
275ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=Y2EyYzRiZmVkNjhkZjMwOTUzNWNmNDBhYjEzZTZiMzA5YmU0NWRjNg

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f156.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=Y2EyYzRiZmVkNjhkZjMwOTUzNWNmNDBhYjEzZTZiMzA5YmU0NWRjNg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c80248407eff6cf595ce43a76c04e23f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCu173w5aXo.woff2
fonts.gstatic.com/s/montserrat/v25/ Frame 8CDD 12 KB
13 KB 573ms
271ms Font
font/woff2 172.217.194.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCu173w5aXo.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:600&subset=latin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f94.1e100.net

Software

sffe /

Resource Hash

98be19bc78b5bc5d419e4fa6ea055ebd4671a963e2cc644aeed4362f15d14c31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Dec 2022 10:11:18 GMT
x-content-type-options: nosniff
age: 454795
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12700
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:56:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Dec 2023 10:11:18 GMT

GET
H2 200 Layer0.jpg
s2.adform.net/Banners/Elements/Files/2111416/11240091/bvpath_513/ Frame 8CDD 37 KB
37 KB 277ms
276ms Image
image/jpeg 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s2.adform.net/Banners/Elements/Files/2111416/11240091/bvpath_513/Layer0.jpg
Requested by: Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 398b6ad3f27000beaa3dc741a62da981e585b46f9bb3f0c9de11cf08c7f9e30d

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:13 GMT
last-modified: Sat, 28 May 2022 23:24:13 GMT
server: nginx
x-amz-request-id: tx00000c00f3d9050ebd11d-00638f17b3-3293aae9-default
etag: "230a51b3460bd0d50f20fbd77b1e218e"
x-cache-status: MISS, EXPIRED, HIT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 37583

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 270ms
270ms Ping
text/plain 142.251.12.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-S3DKHVPF03&gtm=2oebu0&_p=29185637&cid=850373404.1670344266&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAI&sid=1670344266&sct=1&seg=0&dl=https%3A%2F%2Fpastelink.net%2F6brvsep8&dt=Tevfik%20Arif%20tips%20on%20investing%20in%20Turkish%20real%20estate%20-%20Pastelink.net&_s=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f138.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pastelink.net/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:13 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 test.html Show response
widgets.outbrain.com/nanoWidget/externals/obUserFrame/ Frame EFCD 2 KB
1003 B 244ms
243ms Document
text/html 104.65.229.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/obUserFrame/test.html?lsd=f73d11c3-6579-475d-b002-34b84b12988e
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.229.95 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-229-95.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 45f0f27fb78191006375051ee3046fae3105b652d11680432511cba61b32c330

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 686
content-type: text/html
date: Tue, 06 Dec 2022 16:31:13 GMT
etag: "1e015194a0e596827cb8971f884eb43c:1670259804.24266"
expires: Tue, 13 Dec 2022 16:31:13 GMT
last-modified: Mon, 05 Dec 2022 16:29:35 GMT
server: AkamaiNetStorage
timing-allow-origin: * *
vary: Accept-Encoding

GET
H2 200 put.html Show response
widgets.outbrain.com/nanoWidget/externals/cookie/ Frame 9A8E 416 B
713 B 241ms
241ms Document
text/html 104.65.229.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.229.95 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-229-95.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4f3b933077b738b503f7543ffc82fa0a061f0fe7d0ff1470865fde561a324bcc

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: max-age=604800
content-length: 416
content-type: text/html
date: Tue, 06 Dec 2022 16:31:13 GMT
etag: "c0311cf15c21ddda054005e92fad3f9e:1670259801.248722"
expires: Tue, 13 Dec 2022 16:31:13 GMT
last-modified: Mon, 05 Dec 2022 16:29:35 GMT
server: AkamaiNetStorage
timing-allow-origin: * *

GET
H2 200 ob_logo_67x12.png
widgets.outbrain.com/images/widgetIcons/ Frame 2B85 2 KB
3 KB 256ms
255ms Image
image/png 104.65.229.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/ob_logo_67x12.png
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.229.95 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-229-95.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 487aec7746a83542b3573383df65747e31c494d8412103b5675329f3d4befaeb

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:13 GMT
last-modified: Mon, 12 Sep 2022 07:37:47 GMT
server: AkamaiNetStorage
etag: "c52b07e749f7a09fa7b97b7e195e06ce:1662969049.940408"
access-control-allow-methods: GET,POST
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 2326
expires: Thu, 05 Jan 2023 16:31:13 GMT

GET
H2 200 achoice.svg
widgets.outbrain.com/images/widgetIcons/ Frame 2B85 3 KB
3 KB 255ms
254ms Image
image/svg+xml 104.65.229.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.229.95 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-229-95.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:13 GMT
last-modified: Mon, 12 Sep 2022 07:37:47 GMT
server: AkamaiNetStorage
etag: "9d26fa4e7238ed94f1d0d92afb453b3e:1662969032.874716"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 2735
expires: Thu, 05 Jan 2023 16:31:13 GMT

GET
H/1.1 200
OK l Show response
mcdp-sadc1.outbrain.com/ Frame 2B85 4 B
332 B 1165ms
292ms Fetch
text/plain 38.133.127.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-sadc1.outbrain.com/l?token=b0648b6015fed33cddcbec9e7beab3e3_113125_1670344273057&tm=3020&eT=0&widgetWidth=300&widgetHeight=250&widgetX=0&widgetY=0&wRV=2000974&pVis=1&lsd=f73d11c3-6579-475d-b002-34b84b12988e&eIdx=&cheq=0&rtt=1916&oo=false&lo=1475&odbreq=2588&odbres=4502&cet=4g&to=1670344268779&ab=0&wl=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.63 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 06 Dec 2022 16:31:14 GMT
Access-Control-Expose-Headers: content-range
X-TraceId: cb151649cdc5172156c68e5816fa85f5
Content-Length: 4
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain; charset=UTF-8

GET
H2 200 placement_invocation Show response
rock.defybrick.com/ Frame 2B85 48 KB
18 KB 762ms
279ms Script
text/javascript 13.33.33.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rock.defybrick.com/placement_invocation?id=65349&idx=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.33.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-33-31.sin2.r.cloudfront.net
Software: Caddy /
Resource Hash: 620bae4f435d4ccd1c611f602c0790871f65d6bf668f6ff2ac716b89285cdc4a

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 13:10:44 GMT
content-encoding: gzip
via: 1.1 74e86ed0fa6d314b06f69aa24cdc2c36.cloudfront.net (CloudFront)
server: Caddy
x-amz-cf-pop: SIN2-P1
age: 12030
etag: "bf8f-sbLSqLgrhMmD0M6HbtAQ/QtX6WE"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
cache-control: max-age=43200
content-length: 18460
x-amz-cf-id: QxyQnoUmP1PEHpBX34p1RjhfpVXEPKIVpjCYlS6ZYLEguaKV--TWhg==
expires: Wed, 07 Dec 2022 01:10:44 GMT

GET
H2 200 obUserSync.html Show response
widgets.outbrain.com/widgetOBUserSync/ Frame 546D 18 KB
6 KB 257ms
256ms Document
text/html 104.65.229.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.229.95 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-229-95.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4866af459743edbc357c225821368d9b4d370c771e955ea5ee313403adb0a4a5

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 5938
content-type: text/html
date: Tue, 06 Dec 2022 16:31:13 GMT
etag: "3d588be7f01fe5a6448a8ef1aeb70463:1669278724.034982"
expires: Tue, 13 Dec 2022 16:31:13 GMT
last-modified: Thu, 24 Nov 2022 08:27:03 GMT
server: AkamaiNetStorage
timing-allow-origin: * *
vary: Accept-Encoding

GET
H2 200 eyJpdSI6ImMxNmIzMDJjYWRlYjQyZTFkODcyZDY4NDhiMGQ1NDkwZTkwZWE5ODU4NzgxZTAyYjk5ODllZTA3OTA5Njg5NmIiLCJ3Ijo0ODAsImgiOjI0MCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ Frame 2B85 38 KB
38 KB 865ms
375ms Image
image/webp 23.36.49.189
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6ImMxNmIzMDJjYWRlYjQyZTFkODcyZDY4NDhiMGQ1NDkwZTkwZWE5ODU4NzgxZTAyYjk5ODllZTA3OTA5Njg5NmIiLCJ3Ijo0ODAsImgiOjI0MCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.49.189 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-49-189.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4cc159bb0445934e4a8fa48bfdcf439222e4bf20c19bb5966de421aae5bcd8cb

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:14 GMT
last-modified: Thu, 24 Nov 2022 22:19:47 GMT
access-control-allow-methods: GET,POST
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=2396956
access-control-allow-credentials: false
x-traceid: 47386ddeab2cba0bed96af31a3243f00
timing-allow-origin: *, *
content-length: 38984

GET
H2 200 JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCu173w5aXo.woff2
fonts.gstatic.com/s/montserrat/v25/ Frame 9CD0 12 KB
12 KB 570ms
270ms Font
font/woff2 172.217.194.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCu173w5aXo.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:600&subset=latin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f94.1e100.net

Software

sffe /

Resource Hash

98be19bc78b5bc5d419e4fa6ea055ebd4671a963e2cc644aeed4362f15d14c31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Dec 2022 10:11:18 GMT
x-content-type-options: nosniff
age: 454795
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12700
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:56:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Dec 2023 10:11:18 GMT

GET
H2 200 Layer0.jpg
s2.adform.net/Banners/Elements/Files/2111416/11240088/bvpath_513/ Frame 9CD0 52 KB
52 KB 277ms
276ms Image
image/jpeg 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s2.adform.net/Banners/Elements/Files/2111416/11240088/bvpath_513/Layer0.jpg
Requested by: Host: f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: bfd59d10ce3e609050c1cdb16b573f2f259139f5a2988a30d67b72b7a9082e8a

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:13 GMT
last-modified: Sat, 28 May 2022 23:24:13 GMT
server: nginx
x-amz-request-id: tx00000c7de9153aab71a23-00638e46c0-32941e2b-default
etag: "d37b2bcff874364599e02ce78aef888e"
x-cache-status: MISS, HIT, HIT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 53043

GET
H2 200 Layer51.jpg
s2.adform.net/Banners/Elements/Files/2111416/11240091/bvpath_513/ Frame 8CDD 25 KB
25 KB 277ms
276ms Image
image/jpeg 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s2.adform.net/Banners/Elements/Files/2111416/11240091/bvpath_513/Layer51.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 6bea380818c86e33533ac6374891866e96adb5add81d4f359c5da93aabf0d3c2

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:13 GMT
last-modified: Sat, 28 May 2022 23:24:13 GMT
server: nginx
x-amz-request-id: tx00000237d2038c9a8e187-00638d4d06-32941e2b-default
etag: "6c6aa3760c63502417807faecd8f7006"
x-cache-status: MISS, HIT, HIT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 25201

GET
H2 200 test.html Show response
widgets.outbrain.com/nanoWidget/externals/cookie/ Frame 9A8E 610 B
907 B 243ms
243ms Document
text/html 104.65.229.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/test.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.65.229.95 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-65-229-95.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 6139e1fc0d3709eebbe2b18510cf24361b9f8a538c3529a73c282bafe6c78474

Request headers

Referer: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: max-age=604800
content-length: 610
content-type: text/html
date: Tue, 06 Dec 2022 16:31:13 GMT
etag: "48053d50141031b1511dbd30f9a31288:1670259802.043089"
expires: Tue, 13 Dec 2022 16:31:13 GMT
last-modified: Mon, 05 Dec 2022 16:29:35 GMT
server: AkamaiNetStorage
timing-allow-origin: * *

GET
H3

200

396846.gif
idsync.rlcdn.com/ Frame 546D
Redirect Chain

https://idsync.rlcdn.com/420046.gif?partner_uid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://us-u.openx.net/w/1.0/cm?cc=1&id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=ffad39a4-649b-4770-a6da-94d43dcda307

42 B
60 B

319ms
318ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=ffad39a4-649b-4770-a6da-94d43dcda307
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:14 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Tue, 06 Dec 2022 16:31:14 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=ffad39a4-649b-4770-a6da-94d43dcda307
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame 546D
Redirect Chain

https://b1sync.zemanta.com/usersync/outbrain/?puid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_consent=&us_privacy=1---
https://sync.outbrain.com/cookie-sync?p=zemanta&uid=MHwbB1ok78yc3gqJKnDs&gdpr=0&us_privacy=1---

0
145 B

1168ms
293ms

Image
text/plain

38.133.127.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=zemanta&uid=MHwbB1ok78yc3gqJKnDs&gdpr=0&us_privacy=1---
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.63 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Dec 2022 16:31:14 GMT
Cache-Control: no-cache
X-TraceId: 45fb0a18d33c34153aa746c75e10685e
Content-Length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:13 GMT
Content-Type: text/html; charset=utf-8
Location: https://sync.outbrain.com/cookie-sync?p=zemanta&uid=MHwbB1ok78yc3gqJKnDs&gdpr=0&us_privacy=1---
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 130
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame 546D
Redirect Chain

https://ib.adnxs.com/getuid?https://sync.outbrain.com/cookie-sync?p=appnexus&uid=$UID&obUid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_consent=&us_privacy=1---
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dappnexus%26uid%3D%24UID%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26gdpr...
https://sync.outbrain.com/cookie-sync?p=appnexus&uid=7175809292421391107&obUid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_consent=&us_privacy=1---

0
145 B

430ms
293ms

Image
text/plain

38.133.127.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=appnexus&uid=7175809292421391107&obUid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.63 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Dec 2022 16:31:14 GMT
Cache-Control: no-cache
X-TraceId: 1a725c7fa14f8ebf8dff6d6555410614
Content-Length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 06 Dec 2022 16:31:14 GMT
AN-X-Request-Uuid: cb2b7dd1-2911-4c7c-918d-2f8997f37370
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://sync.outbrain.com/cookie-sync?p=appnexus&uid=7175809292421391107&obUid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_consent=&us_privacy=1---
Connection: keep-alive
X-Proxy-Origin: 116.90.74.196; 116.90.74.196; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame 546D
Redirect Chain

https://dpm.demdex.net/ibs:dpid=133726&dpuuid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_pd=1&gdpr_consent=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=133726&dpuuid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_pd=1&gdpr_consent=

42 B
942 B

241ms
240ms

Image
image/gif

54.179.72.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=133726&dpuuid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_pd=1&gdpr_consent=

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html

Protocol

HTTP/1.1

Server

54.179.72.137 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-179-72-137.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS: dcs-prod-apse-1-v042-0980279d3.edge-apse.demdex.com 5 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: PJwZb9HXTLI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-apse-1-v042-07ac04a21.edge-apse.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: IzVY+vFzTho=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=133726&dpuuid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_pd=1&gdpr_consent=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 set
sync-jp.im-apps.net/imid/ Frame 546D 43 B
194 B 803ms
242ms Image
image/gif 35.79.171.96
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-jp.im-apps.net/imid/set?cid=1000047&tid=obid&uid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.79.171.96 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-79-171-96.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 06 Dec 2022 16:31:14 GMT
cache-control: max-age=3000
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
content-length: 43
expires: Tue, 06 Dec 2022 17:21:14 GMT

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame 546D
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=icco6m5&ttd_tpi=1
https://sync.outbrain.com/cookie-sync?p=ttd&uid=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=

0
145 B

1168ms
293ms

Image
text/plain

38.133.127.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=ttd&uid=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.63 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Dec 2022 16:31:14 GMT
Cache-Control: no-cache
X-TraceId: 3fc7e59e62af783d84729b79ccc3b777
Content-Length: 0

Redirect headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:13 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.outbrain.com/cookie-sync?p=ttd&uid=76058cc7-bb7d-486a-8e9a-bd0978d6a844&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 241

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame 546D 0
338 B 905ms
297ms Image
text/plain 44.231.207.188
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=outbrain&partner_uid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.231.207.188 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-231-207-188.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-served-by: beacon-n005-pdx-prod.krxd.net
date: Tue, 06 Dec 2022 16:31:14 GMT
cache-control: private, no-cache, no-store
x-request-time: D=31 t=1670344274
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame 546D 43 B
500 B 735ms
245ms Image
image/gif 35.79.79.30
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212295978&puid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.79.79.30 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-79-79-30.ap-northeast-1.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:14 GMT
server: AAWebServer
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length: 43
expires: 0

GET

sync
rtb.mfadsrvr.com/ul_cb/ Frame 546D
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=outbrain&ssp_user_id=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=outbrain&ssp_user_id=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp

0
0

GET

check
pixel.tapad.com/idsync/ex/receive/ Frame 546D
Redirect Chain

https://x.bidswitch.net/sync?ssp=outbrain&user_id=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&us_privacy=1---&gdpr=0&gdpr_pd=1&gdpr_consent=
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=471b34de-8dc7-4692-bfae-4535f8d261a3&ssp=outbrain&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10525897493553347199&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vi...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2910&partner_device_id=10525897493553347199&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26...

0
0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 546D 43 B
363 B 754ms
235ms Image
image/gif 182.161.73.146

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=74&p=126&cp=outbrain&cu=1&url=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dcriteo%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26uid%3D%40%40CRITEO_USERID%40%40

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.146 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:14 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 425316
expires: Tue, 06 Dec 2022 00:00:00 GMT

GET

bswsync
crb.kargo.com/api/v1/ Frame 546D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&google_dbm
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEMvkmYtYoEh4mew1eSWVChg&google_cver=1
https://crb.kargo.com/api/v1/bswsync?bsw_uuid=471b34de-8dc7-4692-bfae-4535f8d261a3&dsp_uuid=&dsp_id=&krg_ids=&gdpr=&gdpr_consent=&us_privacy=

0
0

GET /
dsp.adfarm1.adition.com/cookie/ Frame 546D 0
0

GET match
ps.eyeota.net/ Frame 546D 0
0

GET mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp
id.geistm.com/m/OB/ Frame 546D 0
0

GET cm-notify
creativecdn.com/ Frame 546D 0
0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame 546D
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=15268&gdpr=0&gdpr_consent=&us_privacy=1---
https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LBCFUPAL-1R-9PLK&gdpr=0&us_privacy=1---

0
145 B

295ms
295ms

Image
text/plain

38.133.127.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LBCFUPAL-1R-9PLK&gdpr=0&us_privacy=1---
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.63 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Dec 2022 16:31:15 GMT
Cache-Control: no-cache
X-TraceId: ff45c173c36e298d6e66e6ae72704f04
Content-Length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LBCFUPAL-1R-9PLK&gdpr=0&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
Expires: 0

GET
H2 403 tpid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp
sync.crwdcntrl.net/map/c=14516/tp=OBRN/ Frame 546D 49 B
269 B 276ms
235ms Image
image/gif 18.141.78.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=14516/tp=OBRN/tpid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.141.78.38 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-141-78-38.ap-southeast-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:15 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.42.31.214
content-length: 49
expires: 0

GET usermatchredir
ssum-sec.casalemedia.com/ Frame 546D 0
0

GET ImgSync
image8.pubmatic.com/AdServer/ Frame 546D 0
0

GET

cookie-sync
sync.outbrain.com/ Frame 546D
Redirect Chain

https://u.openx.net/w/1.0/cm?id=00df9f64-6f67-4cae-aeb2-d951da52047c&r=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dopenx%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26obUid%3DmCybWBevd...
https://sync.outbrain.com/cookie-sync?p=openx&gdpr=0&gdpr_consent=&us_privacy=1---&obUid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&uid=1a7a6fc5-d632-4cec-9acc-468abced05f4

0
0

GET occ
ups.analytics.yahoo.com/ups/58523/ Frame 546D 0
0

GET um
cs.emxdgt.com/ Frame 546D 0
0

GET server_match
ice.360yield.com/ Frame 546D 0
0

GET /
s.ad.smaato.net/c/ Frame 546D 0
0

GET sync
ssbsync.smartadserver.com/api/ Frame 546D 0
0

GET c.gif
c.bing.com/ Frame 546D 0
0

GET services
sync.technoratimedia.com/ Frame 546D 0
0

GET 711945.gif
id.rlcdn.com/ Frame 546D 0
0

GET pixelSync
pixel-sync.sitescout.com/dmp/ Frame 546D 0
0

GET p-cxanv6hYFn1kw.gif
cms.quantserve.com/pixel/ Frame 546D 0
0

GET rtset
bh.contextweb.com/bh/ Frame 546D 0
0

GET outbrain
trace.mediago.io/cs/ Frame 546D 0
0

GET 9.gif
id5-sync.com/s/164/ Frame 546D 0
0

GET sync
t.adx.opera.com/pub/ Frame 546D 0
0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 273ms
273ms Image
text/html 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022120101&jk=3206157806165007&bg=!9fal9rLNAAa7eOFIm3g7ACkAdvg8WndySuKu_6KRzC1MlHjSpvV2p3ML8BduK-Tkd6HiJNp-Ux3oiwIAAAB5UgAAAARoAQeZArFPz0fNH_M4IJhGiz1IENNgU32LawiPyeXej0fFzIlXHWRm6KOujvgEMFh-DnclVG5lpEOZJbj3KMoLSpvRHSR4R42dR6_dmJVyeq_Q-_gHl52sWu02MJZi3RCiACJgHipLCys15BGjPneS6ufAGMRClsEnOcEHX_EWBMsF8HeBXHtkx3Z_cPv0Qwl9MVi8SfkJWPtv9SZ7voHuKm7r79KlWD9KRas-qN8jqTleB10mN8vGHOwTVuCvx8RG9mQXoymXq8sS0EClNqm8V5Nasnxu6e7wLv_XdXCx7GaxGX5ClWuvtVlc3GazBM1OmDuocd23XZHOmSksPVgRmnLcYMh0jXYfpWjAL4YXFW4v6bGvMe02Q4XVu1kQDQ4zTs9nK_O2I3KdskHWWzKSkIsiS140MWmoc8GyKFJM_uYveFO9drOxo08W-pysdlj1ULhj1Ek_TdYItBJvkFd2Jy_jFpwaouQLKFYMwaTkDljcIwSVX3oCamja3yWYcVM9s9WsTpXDFMasMggY3Jw_7424MyedqFSid7uHM7LG6_RxkCzfe2y_sJkxfu_5VuFb3Fa9XlxKinUCEJpF62bw3LiEiKNzBWAS-GCkHW70ISD41XiHDd4jUQdV4qf6Q0aUszj5IGDFkAjUt-EcOdQPeUQtfrpaH9t0vm0ak5_kops3fM49APRHBooIpAzhVj6bUJkpB1QiMu8G7uiffQ84dEsI59yPqmm7R82YphbHxWVIuiFod8fs5A54fZa6Dg3JYwN1ksVb581tqDleAWHleL10iAamcVNxDOtGK5O7q4_8s6F1qZRJkOzfu54OcHdlPbceNpZsX1dGMAdIQKYIVkpwZ_0GbuF6Sm04hGQ0YDKXfj3oDz7K5RSEf0ZAl0ldszSpxgsz1FX8OLCpwN_0jIngP2YniQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.194.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 Layer0_1.jpg
s2.adform.net/Banners/Elements/Files/2111416/11240088/bvpath_513/ Frame 9CD0 43 KB
43 KB 277ms
277ms Image
image/jpeg 185.84.60.57
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s2.adform.net/Banners/Elements/Files/2111416/11240088/bvpath_513/Layer0_1.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.84.60.57 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 53860cf28033a16a12d71aafad5dcdfce0f1883bb93b876a294715294c847ac4

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:13 GMT
last-modified: Sat, 28 May 2022 23:24:13 GMT
server: nginx
x-amz-request-id: tx00000137e40ebbdb7dddd-00638f3fc9-32941e2b-default
etag: "4f5b85661cafe73ab73b39c3db2a8afa"
x-cache-status: MISS, EXPIRED, HIT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 43559

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9A7D 42 B
174 B 573ms
272ms Fetch
image/gif 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu8cKe8ZXoAkauujzZp9Okjsmr-ofl10zmmBVAtUq1Qgs15sKp4LvR4Zb7YrXH-UFQEwLpf5hM1VMPEygonoadpky9P&sig=Cg0ArKJSzNWt_Sku52-HEAE&id=lidar2&mcvt=1002&p=308,310,558,610&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20221205&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2603746535&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1670344268601&rpt=4570&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B120 42 B
108 B 573ms
272ms Fetch
image/gif 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu4cO7NvnjF1oM4x0A1DBF9vOkcoMUpZqyHhEyHgxFBN4KtPSVs446p8JklUcHXH4fHwRttIL5-_zG07tRGmrP_1kBH&sig=Cg0ArKJSzDxOUV4T9C3_EAE&id=lidar2&mcvt=1001&p=1105,436,1195,1164&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20221205&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=759513158&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1670344268213&rpt=5033&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 91E8 0
128 B 236ms
235ms Script
text/plain 67.199.150.85
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.85 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:31:14 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H2 200 /
asia.adform.net/serving/unload/ Frame 9A7D 35 B
494 B 265ms
265ms Ping
image/gif 185.84.60.20
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://asia.adform.net/serving/unload/?version=15&unload=7360079201359004777@@56367626,1950859637701644074,100|1129|0|0|0|0|0|0|0||44|1|||||1|0|0|V8acoBj0tXLxBx_RTJEBJy0vgZ-ZldoPoLQzbvcE1PX2qLyudIT4jfL_QlhaeLlf0|||11||0

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 show_pla Show response
flint.defybrick.com/ Frame 2B85 2 KB
2 KB 1038ms
353ms Script
text/javascript 52.45.196.192

General

Check archive.org

Show headers Download Go to

Full URL: https://flint.defybrick.com/show_pla?id=65349&url=https%3A%2F%2Fpastelink.net%2F6brvsep8&sf=0&k=&idx=0&ch=&ext=&np=win32&nv=google%20inc.&rand=64581208592100022715057896116618240822369595677315090855177990111028&nc=0&tsf=0&tsfmi=&pv=0&cb=1670344274380&ref=&pit=1&hl=2&op=0&fs=300x250&ss=1600x1200&pre=0&jsonp=OBR.extern.onCheqResponse&mr=&ag=2826626440&at=&bid=e30%3D&di=W1siZWYiLDMxNl0sWzEyLCJ7XCJjdHhcIjpcIndlYmdsMlwiLFwidlwiOlwiaW50ZWwgaW5jLlwi%0D%0ALFwiclwiOlwiaW50ZWwgaXJpcyBvcGVuZ2wgZW5naW5lXCIsXCJzbHZcIjpcIndlYmdsIGdsc2wg%0D%0AZXMgMy4wMCAob3BlbmdsIGVzIGdsc2wgZXMgMy4wIGNocm9taXVtKVwiLFwiZ3ZlclwiOlwid2Vi%0D%0AZ2wgMi4wIChvcGVuZ2wgZXMgMy4wIGNocm9taXVtKVwiLFwiZ3ZlblwiOlwid2Via2l0XCIsXCJi%0D%0AZW5cIjo2LFwid2dsXCI6MSxcImdyZW5cIjpcIndlYmtpdCB3ZWJnbFwiLFwic2VmXCI6MTA1MTY5%0D%0ANDA4OSxcInNlY1wiOlwiXCJ9Il0sWzM3LCJbMzMxNjIyNDA0OSxmdW5jdGlvbihuZXdWYWx1ZSkg%0D%0Ae1xuICAgICAgICAgICAgICBhZGRDb250ZW50V2luZG93UHJveHkodGhpcylcbiAgICAgICAgICAg%0D%0AICAgLy8gUmVzZXQgcHJvcGVydHksIHRoZSBob29rIGlzIG9ubHkgbmVlZGVkIG9uY2VcbiAgICAg%0D%0AICAgICAgICAgT2JqZWN0LmRlZmluZVByb3BlcnR5KGlmcmFtZSwgJ3NyY2RvYycsIHtcbiAgICAg%0D%0AICAgICAgICAgICBjb25maWd1cmFibGU6IGZhbHNlLFxuICAgICAgICAgICAgICAgIHdyaXRhYmxl%0D%0AOiBmYWxzZSxcbiAgICAgICAgICAgICAgICB2YWx1ZTogX3NyY2RvY1xuICAgICAgICAgICAgICB9%0D%0AKVxuICAgICAgICAgICAgICBfaWZyYW1lLnNyY2RvYyA9IG5ld1ZhbHVlXG4gICAgICAgICAgICB9%0D%0AXSJdLFstMSwiLSJdLFstMiwiNSxlWUc5WDEvWDF0WmxTMjJkNTF4OFlOWTlNeEpRRU1DZFVCSEpM%0D%0AODZMMjNBQ0dVaEJJd0lTU0VFQWNJSmZSZUFnUUlFRm9JbmRDeHdRWGpobzI3MTk2bU1qT3Yvcjg3%0D%0AMHV4cUZ4Il0sWy0zLCJbXCJpbnRlcm5hbC1wZGYtdmlld2VyXCIsXCJtaGpmYm1kZ2NmamJicGFl%0D%0Ab2pvZm9ob2VmZ2llaGphaVwiLFwiaW50ZXJuYWwtbmFjbC1wbHVnaW5cIl0iXSxbLTQsIi0iXSxb%0D%0ALTUsIi0iXSxbLTYsIi0iXSxbLTcsIi0iXSxbLTgsIi0iXSxbLTksIisiXSxbLTEwLCItIl0sWy0x%0D%0AMSwie1widFwiOlwiXCIsXCJtXCI6W1wib2c6dGl0bGVcIixcImRlc2NyaXB0aW9uXCIsXCJvZzpk%0D%0AZXNjcmlwdGlvblwiXX0iXSxbLTEyLCJudWxsIl0sWy0xMywiLSJdLFstMTQsIntcIm9cIjowLjU4%0D%0AMzMzMzMzMzMzMzMzMzR9Il0sWy0xNSwiLSJdLFstMTYsIjAiXSxbLTE3LCI0Il0sWy0xOCwiWzAs%0D%0AMCwwLDFdIl0sWy0xOSwiWzAsMCwwLDAsMCwwLDEsMjQsMjQsXCItXCIsMTYwMCwxMjAwLDE2MDAs%0D%0AMTIwMCwxNjAwLDEyMDAsMzAwLDI1MCwwLDAsMCwwLFwiLVwiLFwiLVwiXSJdLFstMjAsIjg1MDM3%0D%0AMzQwNC4xNjcwMzQ0MjY2Il0sWy0yMSwiLSJdLFstMjIsIltcIm5cIixcIm5cIl0iXSxbLTIzLCIr%0D%0AIl0sWy0yNCwiW10iXSxbLTI1LCItIl0sWy0yNiwie1widGpoc1wiOjMzMTAwMDAwLFwidWpoc1wi%0D%0AOjI3NjAwMDAwLFwiamhzbFwiOjM3NjAwMDAwMDB9Il0sWy0yNywiWzAsOS43LDAsXCI0Z1wiLG51%0D%0AbGxdIl0sWy0yOCwiZW4tVVMsZW4iXSxbLTI5LCJ7XCJ2XCI6WzIsMiwyLDIsMCwwLDAsMiwwLDIs%0D%0AMCwyLDAsMCwyLDIsMiwyLDBdfSJdLFstMzAsIltcInZcIiwwXSJdLFstMzEsImZhbHNlIl0sWy0z%0D%0AMiwiLSJdLFstMzMsIi0iXSxbLTM0LCItIl0sWy0zNSwiWzE2NzAzNDQyNzQzNjAsMF0iXSxbLTM2%0D%0ALCJbXCI0LzNcIixcIjQvM1wiXSJdLFstMzcsIi0xMDktNjYtNzAtIl0sWy0zOCwiaSwtMSwtMSwt%0D%0AMTY3MDM0NDI2ODc3OSwwLDAsMCwwLDAsMTY3MDM0NDI2ODc4NSwwLDAsNDAwMi40LDQwMDIuNCw1%0D%0ANTgzLDU1ODMiXSxbLTM5LCJbXCIyMDAzMDEwN1wiLDQsXCJHZWNrb1wiLFwiTmV0c2NhcGVcIixc%0D%0AIk1vemlsbGFcIixudWxsLG51bGwsdHJ1ZSw4LGZhbHNlLG51bGwsM10iXSxbLTQwLCIzMyJdLFst%0D%0ANDEsIi0iXSxbLTQyLCIxNzI0Mjk3NjUzIl0sWy00MywiMDAwMDAwMDEwMTAwMDAwMTAwMTExMDEx%0D%0AMDAiXSxbLTQ0LCIwLDAsMCw1Il0sWy00NSwiLSJdLFstNDYsIjAiXSxbLTQ3LCJFdGMvVW5rbm93%0D%0Abixlbi1VUyxsYXRuLGdyZWdvcnkiXSxbLTQ4LCIwLDAiXSxbLTQ5LCItIl0sWyJibmNoIiw1M11d&tsfu=&fst=1600x1200&dep=1&cpos=%5B%7B%22x%22%3A0%2C%22y%22%3A0%2C%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22x%22%3A512%2C%22y%22%3A1265%2C%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A1600%2C%22h%22%3A1200%7D%5D&ver=41&cri=RSMHxBXnWN&sdd=%7B%7D&pto=5603&ao=https%3A%2F%2Fpastelink.net&aol=1
Requested by: Host: rock.defybrick.com
URL: https://rock.defybrick.com/placement_invocation?id=65349&idx=0
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.45.196.192 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ac863beb5e95f43cb246367b26cfd3a362076e753d60c179019b9325a4c57e2

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: text/javascript
pragma: no-cache
date: Tue, 06 Dec 2022 16:31:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 1419
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A697 42 B
108 B 573ms
272ms Fetch
image/gif 172.217.194.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssPIQX2B7ptnJ602gkgYkw2jZrHTT20UB13TbzU2kxLCiikR3gOnPn8NiB8YQx81tGeU6bVQmBCFwG-EOCR-U-Nzh-u&sig=Cg0ArKJSzEGOIaaIsrmJEAE&id=lidar2&mcvt=1048&p=800,513,1050,813&mtos=1048,1048,1048,1048,1048&tos=1048,0,0,0,0&v=20221205&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3770940712&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1670344268377&rpt=4959&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 /
asia.adform.net/serving/unload/ Frame A697 35 B
503 B 264ms
264ms Ping
image/gif 185.84.60.20
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://asia.adform.net/serving/unload/?version=15&unload=7360079201359004777@@56367627,2710476680320674694,100|1053|0|0|0|0|0|0|0||41|1|||||1|0|0|PACWbvIjRr7xBx_RTJEBJy0vgZ-ZldoPoLQzbvcE1PWs6CCaNHCu9fL_QlhaeLlf0|||11||0

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.20 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 06 Dec 2022 16:31:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 imp.gif
flint.defybrick.com/tracker/ Frame 2B85 43 B
79 B 338ms
338ms Image
image/gif 52.45.196.192

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://flint.defybrick.com/tracker/imp.gif?e=37dfbd8ee84e00136deec431ee458d989225c24f567d51c5c30f41b0254384cfa532ff1a285aa40e98d022e0b44dc87ea4a36fde4c1b8c682309094d0ba0bfea9475489e91da563e351aff717718956a8b70cd0130003f8101424d3f065cc3bf775d36fa26e877cb55e2cc7ce2586fb01f6f3903d053f054abd1c5d52fe87547ed62d2f1157f84163042775a90d61c63f16caeefd0f1515df80adaf568bf74842fd65a97787fe47459a545590132cb5936c186e2a038a83efd78b803f24e6f73b2c75020657c5d8e75c19b1de91444b8d3ed772a2f70addf6a3f8e835b002942611f70dfea511c6117f8a3122c9cdca07dcbbf42626e74e9f9f8c1877fb7c3de44ef5594512065cff8f9e4a065d285fd6e943410d2ffdb300a54a2207da2821661ec8df3718a00f742b68d4d90479ec779c16a31c59f238a6190d3eaa58eeaf10538b36aefefe8234340c5b012e2c837c7581307d75e5e87d1d799c6af856b9b7cd7c5e4dc7bb5782c32d42a7893c0971a7290a633bc11e9d315d665ac6c544c5ac73ab641d0c0b832ec8728d30de09d869b29ce5f432da50d5a136e4e7dd6a16ff41d8782c734abde3dc4c36295d1b9ab33dee0b311372fd3a711158ce0471556a6bfac7ba73c9ef641ece62eae61a631973ec80684ba36d5644df6b280342d35611f384e0d05a0e5907e9157f5031b015aa7f1119bc1465becb29bf8f939deffa7bc94f2afbc&cb=1670344275429&cri=RSMHxBXnWN
Requested by: Host: pastelink.net
URL: https://pastelink.net/6brvsep8
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.45.196.192 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
date: Tue, 06 Dec 2022 16:31:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pro.ip-api.com
URL: https://pro.ip-api.com/json/?key=ZxSSLwZtxrKxQbv&fields=status,countryCode,region

Domain: b1t-sindc1.zemanta.com
URL: https://b1t-sindc1.zemanta.com/t/imp/view/5XRJCELATCR4MHWOT3JB7OZNQDU4S2FP5FEXQYLENKQHU5HLTWWR4LNJ3PNZC2NZJKAJOV5CLQYZYF5A37JVGVBN64GWLN5UHSH6YX3STKSSYE4OAM2WERGJB6OAKL336A7UXJE3IBRUIBAIX56NNXVTSZ6HOVWAHYFITV5IYRYZNYWA6V4IIO6C7XQPXOBKBWXMTPM26OBZVFYWO4XDNK5NCVJZ4YSXZGHHR57RLEPLI4GO4VMCJYYN2ENFFXK7AY7MIWX2NG5OEBNMW3XR5OGVWPPW47CYIYJPXWME2D5SPK2WKJUCU3YNUQKGYNUGFY3OPXWGSFQNJZKTKM4NH6P7BN3BI6GIXCCMCSWKO7EPUHYQD3VQ/?

Domain: rtb.mfadsrvr.com
URL: https://rtb.mfadsrvr.com/ul_cb/sync?ssp=outbrain&ssp_user_id=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp

Domain: pixel.tapad.com
URL: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2910&partner_device_id=10525897493553347199&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.visitorid%3D%24%7BTA_DEVICE_ID%7D%26ssp%3Doutbrain%26gdpr_consent%3D%26gdpr%3D0

Domain: crb.kargo.com
URL: https://crb.kargo.com/api/v1/bswsync?bsw_uuid=471b34de-8dc7-4692-bfae-4535f8d261a3&dsp_uuid=&dsp_id=&krg_ids=&gdpr=&gdpr_consent=&us_privacy=

Domain: dsp.adfarm1.adition.com
URL: https://dsp.adfarm1.adition.com/cookie/?ssp=25&gdpr=0&gdpr_consent=&us_privacy=1---

Domain: ps.eyeota.net
URL: https://ps.eyeota.net/match?bid=1mpn7m0&uid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp

Domain: id.geistm.com
URL: https://id.geistm.com/m/OB/mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp

Domain: creativecdn.com
URL: https://creativecdn.com/cm-notify?pi=outbrain&gdpr=0&gdpr_consent=&us_privacy=1---

Domain: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatchredir?s=193091&cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dindxexcg%26uid%3D%24%7BUSER%7D%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---

Domain: image8.pubmatic.com
URL: https://image8.pubmatic.com/AdServer/ImgSync?p=160065&gdpr=PM_GDPR&gdpr_consent=PM_CONSENT&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160065%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync.outbrain.com%252Fcookie-sync%253Fp%253Dpubmatic%2526obUid%253DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%2526gdpr%253D0%2526gdpr_consent%253D%2526us_privacy%253D1---%2526uid%253D%2523PMUID

Domain: sync.outbrain.com
URL: https://sync.outbrain.com/cookie-sync?p=openx&gdpr=0&gdpr_consent=&us_privacy=1---&obUid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&uid=1a7a6fc5-d632-4cec-9acc-468abced05f4

Domain: ups.analytics.yahoo.com
URL: https://ups.analytics.yahoo.com/ups/58523/occ?gdpr=0&gdpr_consent=&us_privacy=1---&redir=true

Domain: cs.emxdgt.com
URL: https://cs.emxdgt.com/um?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Demx%26uid%3D%24UID%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---

Domain: ice.360yield.com
URL: https://ice.360yield.com/server_match?partner_id=1863&r=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dimprove_digital%26uid%3D%7BPUB_USER_ID%7D%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---

Domain: s.ad.smaato.net
URL: https://s.ad.smaato.net/c/?adExInit=o&redir=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dsmaato%26uid%3D%24UID%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---

Domain: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=30&gdpr=0&gdpr_consent=&redirectUri=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dsmart%26uid%3D%5Bssb_sync_pid%5D%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---

Domain: c.bing.com
URL: https://c.bing.com/c.gif?red3=MSOB_pd&uid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp

Domain: sync.technoratimedia.com
URL: https://sync.technoratimedia.com/services?srv=cs&pid=70&cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dsynacor%26uid%3D%5BUSER_ID%5D%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26us_privacy%3D1---

Domain: id.rlcdn.com
URL: https://id.rlcdn.com/711945.gif?cparams=obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp

Domain: pixel-sync.sitescout.com
URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=127&gdpr=0&gdpr_consent=&us_privacy=1---&redir=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dcentro%26uid%3D%7BuserId%7D%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---

Domain: cms.quantserve.com
URL: https://cms.quantserve.com/pixel/p-cxanv6hYFn1kw.gif?idmatch=0&obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_consent=&us_privacy=1---

Domain: bh.contextweb.com
URL: https://bh.contextweb.com/bh/rtset?pid=562709&ev=1&us_privacy=${us_privacy}&rurl=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dpulsepoint%26uid%3D%7BuserId%7D%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---

Domain: trace.mediago.io
URL: https://trace.mediago.io/cs/outbrain?cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dbaidu%26uid%3D%7Buserid%7D%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---

Domain: id5-sync.com
URL: https://id5-sync.com/s/164/9.gif?puid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp&gdpr=0&gdpr_consent=&us_privacy=1---

Domain: t.adx.opera.com
URL: https://t.adx.opera.com/pub/sync?pubid=pub8006743166848&redirect=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dopera%26uid%3D%2524%257BOPERA_UID%257D%26obUid%3DmCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---

Verdicts & Comments Add Verdict or Comment

165 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

73 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
widgets.outbrain.com/nanoWidget/externals/cookie	1970-01-20 07:59:07	Name: thirdparty Value: yes
pastelink.net/	1970-01-20 08:49:04	Name: PHPSESSID Value: 52jfgfs8s0j671th3k3r1445vf
.pastelink.net/	1970-01-20 10:08:40	Name: _gcl_au Value: 1.1.1604494116.1670344265
.pastelink.net/	1970-01-20 17:35:04	Name: _ga Value: GA1.2.850373404.1670344266
.pastelink.net/	1970-01-20 08:00:30	Name: _gid Value: GA1.2.1961607046.1670344266
.pastelink.net/	1970-01-20 07:59:04	Name: _gat_UA-55088947-2 Value: 1
pastelink.net/	1970-01-20 08:00:30	Name: plTest Value: false
.pastelink.net/	1970-01-20 07:59:04	Name: _gat_advallyTrackerpl Value: 1
pastelink.net/	1970-01-20 08:42:16	Name: _pbjs_userid_consent_data Value: 3524755945110770
.pastelink.net/	1970-01-20 17:35:04	Name: _ga_S3DKHVPF03 Value: GS1.1.1670344266.1.0.1670344268.0.0.0
.doubleclick.net/	1970-01-20 17:35:04	Name: IDE Value: AHWqTUlcW2d0OHu3cxryuHFHXtIhm8O_0U_uDLfN9GLvrq8ynlHoUAmEjqVBTZDZsEE
.doubleclick.net/	1970-01-20 07:59:05	Name: test_cookie Value: CheckForPermission
.pastelink.net/	1970-01-20 17:20:40	Name: __gads Value: ID=515cac4fb09f1104:T=1670344267:S=ALNI_MZhTW39UNWqiBDOcrKOILUSDAUk1A
.pastelink.net/	1970-01-20 17:20:40	Name: __gpi Value: UID=00000b8b621cfe4c:T=1670344267:RT=1670344267:S=ALNI_MbTMR9iwuDNaBeRsoJkvuKnqQa21Q
.adform.net/	1970-01-20 08:43:42	Name: C Value: 1
.amazon-adsystem.com/	1970-01-20 12:57:09	Name: ad-id Value: A_JTTRYZWE6Mp_c3TAFvedY
.amazon-adsystem.com/	1970-01-20 17:35:04	Name: ad-privacy Value: 0
.adform.net/	1970-01-20 09:25:28	Name: uid Value: 7360079201359004777
.crwdcntrl.net/	1970-01-20 14:27:50	Name: _cc_dc Value: 2
.crwdcntrl.net/	1970-01-20 14:27:50	Name: _cc_id Value: 3350c746604b18196cf7dc8017d48f43
.pastelink.net/	1970-01-20 14:27:52	Name: _cc_id Value: 3350c746604b18196cf7dc8017d48f43
.pastelink.net/	1970-01-20 08:00:30	Name: panoramaId_expiry Value: 1670430670756
.smaato.net/	1970-01-20 08:29:18	Name: SCM Value: ae86389a
.smaato.net/	1970-01-20 08:14:11	Name: SCMaps Value: ae86389a
.media.net/	1970-01-20 16:44:40	Name: visitor-id Value: 3133458717443696000V10
.sharethrough.com/	1970-01-20 08:42:16	Name: stx_user_id Value: 5225d362-f884-4d90-acba-808da9caf77b
.bidswitch.net/	1970-01-20 16:44:40	Name: tuuid Value: 471b34de-8dc7-4692-bfae-4535f8d261a3
.bidswitch.net/	1970-01-20 16:44:40	Name: c Value: 1670344271
.bidswitch.net/	1970-01-20 16:44:40	Name: tuuid_lu Value: 1670344271
.adform.net/	1970-01-20 08:09:09	Name: TPC Value: 1670344271453
.simpli.fi/	1970-01-20 16:46:06	Name: suid Value: 2A98FD745A1B4AF8AE7DB3D2EBC1B256
.smartadserver.com/	1970-01-20 17:29:18	Name: pid Value: 4391157641653952304
.dotomi.com/	1970-01-20 07:59:04	Name: DotomiTest Value: 155d84e820ae1b0e
.pubmatic.com/	1970-01-20 10:08:40	Name: KADUSERCOOKIE Value: 44E18C09-7587-44A4-8BE6-C5026AC544A2
.pubmatic.com/	1970-01-20 10:08:40	Name: chkChromeAb67Sec Value: 1
.pubmatic.com/	1970-01-20 08:00:30	Name: pi Value: 156011:2
.pubmatic.com/	1970-01-20 10:08:40	Name: DPSync3 Value: 1670371200%3A174%7C1671494400%3A197_201%7C1670889600%3A164
.pubmatic.com/	1970-01-20 10:08:40	Name: SyncRTB3 Value: 1671494400%3A71_7_54_220_21_13
.id5-sync.com/	1970-01-20 10:08:40	Name: id5 Value: 37b9d02c-66cb-72d0-94b8-af129b927e3b#1670344272074#1
.zemanta.com/	1970-01-20 16:44:40	Name: zuid Value: MHwbB1ok78yc3gqJKnDs
.adsrvr.org/	1970-01-20 16:44:40	Name: TDID Value: 76058cc7-bb7d-486a-8e9a-bd0978d6a844
.rubiconproject.com/	1970-01-20 16:44:40	Name: khaos Value: LBCFUPAL-1R-9PLK
.spotxchange.com/	1970-01-20 08:39:23	Name: audience Value: 65cc15b1-7583-11ed-8059-10e583b00307
.mathtag.com/	1970-01-20 17:24:59	Name: uuid Value: 3029638f-6e50-4a00-a015-5da045eeed90
.pubmatic.com/	1970-01-20 08:42:16	Name: KRTBCOOKIE_377 Value: 6810-76058cc7-bb7d-486a-8e9a-bd0978d6a844&KRTB&22918-76058cc7-bb7d-486a-8e9a-bd0978d6a844&KRTB&23031-76058cc7-bb7d-486a-8e9a-bd0978d6a844
.bluekai.com/	1970-01-20 12:21:09	Name: bku Value: ikG99aOrMtBM1Kz3
.bluekai.com/	1970-01-20 12:21:09	Name: bkpa Value: KJyWyB+0GM9R9mY7uudqBE2/q805CoYemUO/NwM4/EJ5Htrfxs4c44oIndBksPXGg/gUl84ph3kdJfqbFOSFMycKdtfB7z2w6liIEJLd0d/NWlQMPO93E3F8zHIKdTX4dUlo7T4we6na2phmXI1IWYom+IdhtkX/aDBdr8lbTD3G/YemOnC7PmZ1HbPEV/Bk55z5VCrMjtt36mTXxf7mg4JFuDG9nlJ19u/Um4Y095syf+9KqKl0WsAstQZDJrKbl3jAWcuaXS9pc+ErVnG1Z73wD3/oF9izcg5JPHiByNqr1k8bnCUgGLa+zOPs4Rh1fZMo1ZM3wD3Jo3MlKeOjvny/7WSMbf0gvZzqf0YtSXrkMbA1yUGLkUhbwl2BZNXd9ye7tZQj
.outbrain.com/	1970-01-20 07:59:06	Name: obsessionid-p113125 Value: 5b8018f2-8daa-b878-0000-0184e846ebdb\|0\|1
.outbrain.com/	1970-01-20 10:08:40	Name: obuid Value: f73d11c3-6579-475d-b002-34b84b12988e
.outbrain.com/	1970-01-20 07:59:04	Name: recs_67ee02367abd73cdb2aad23ca47199dc Value: 0B4813017155ACD1
.pubmatic.com/	1970-01-20 08:42:16	Name: KRTBCOOKIE_27 Value: 16735-uid:3029638f-6e50-4a00-a015-5da045eeed90&KRTB&16736-uid:3029638f-6e50-4a00-a015-5da045eeed90&KRTB&23019-uid:3029638f-6e50-4a00-a015-5da045eeed90&KRTB&23208-uid:3029638f-6e50-4a00-a015-5da045eeed90
.pubmatic.com/	1970-01-20 08:42:16	Name: KRTBCOOKIE_148 Value: 19421-uid:2A98FD745A1B4AF8AE7DB3D2EBC1B256
.pubmatic.com/	1970-01-20 08:42:16	Name: KRTBCOOKIE_80 Value: 22987-CAESEK74ruw0sCJbz4uVpDu_dA4&KRTB&16514-CAESEK74ruw0sCJbz4uVpDu_dA4&KRTB&23025-CAESEK74ruw0sCJbz4uVpDu_dA4&KRTB&23386-CAESEK74ruw0sCJbz4uVpDu_dA4
.pubmatic.com/	1970-01-20 08:42:16	Name: PugT Value: 1670344273
.yahoo.com/	1970-01-20 16:45:01	Name: A3 Value: d=AQABBFFuj2MCEAIekGJePgkwDXRedUWGXJ0FEgEBAQG_kGOZYwAAAAAA_eMAAA&S=AQAAAmvtpboZh-EIf4a_z0jiMtg
.rlcdn.com/	1970-01-20 16:44:40	Name: rlas3 Value: Suvb1kFUQSJBjMdUTn8leyMuHjjzsF38TwrfuaXEEvg=
.adsrvr.org/	1970-01-20 16:44:40	Name: TDCPM Value: CAESFwoIcHVibWF0aWMSCwiWzvqgquyrOxAFEhYKB3J1Ymljb24SCwiClNmlquyrOxAFGAEgASgCMgsIrNmz2sDsqzsQBTgBWgdpY2NvNm01YAI.
.rlcdn.com/	1970-01-20 09:25:28	Name: pxrc Value: CNHcvZwGEgUI6AcQABIFCOhHEAASBgi46wEQAA==
.zemanta.com/	1970-01-20 16:44:40	Name: obuid Value: mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 16:44:40	Name: bcookie Value: "v=2&db7d6403-ea5d-4ea0-87d6-3b91c8a90f3d"
.linkedin.com/	1970-01-20 08:00:30	Name: lidc Value: "b=TGST09:s=T:r=T:a=T:p=T:g=2428:u=1:x=1:i=1670344273:t=1670430673:v=2:sig=AQF1AvZk5RK6TSFa7olp6KOdQjA7dwNQ"
.pippio.com/	1970-01-20 16:44:40	Name: did Value: V7Zcgtg76KNcsNQZ
.pippio.com/	1970-01-20 16:44:40	Name: didts Value: 1670344273
.pippio.com/	1970-01-20 09:25:28	Name: nnls Value:
.pippio.com/	1970-01-20 09:25:28	Name: pxrc Value: CAA=
.rubiconproject.com/	1970-01-20 16:44:40	Name: audit Value: 1\|bK2ORTKnWFKTQ+9xMk1wx0UApw5b7d6um8BLnDRZ2Rt163fKDzeGgq9AFXFAS3UcJr89mVo4XevqFTrNE4+z9kqVaHlG5SlgpmvllXEtYN4=
.agkn.com/	1970-01-20 16:44:40	Name: ab Value: 0001%3AMz7oCyHsAhLK4BUnerD%2BT2r4kwyRIRrM
.adnxs.com/	1970-01-20 10:08:40	Name: uuid2 Value: 7175809292421391107
.openx.net/	1970-01-20 16:44:40	Name: i Value: 79c7799b-005b-4ee7-a375-dccf6071f122\|1670344274
.krxd.net/	1970-01-20 12:18:16	Name: _kuid_ Value: PPerPB64
.pubmatic.com/	1970-01-20 08:42:16	Name: SPugT Value: 1670344274
.demdex.net/	1970-01-20 12:18:16	Name: demdex Value: 58007718916859663923869473681269737092

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html Message: Access to fetch at 'https://b1t-sindc1.zemanta.com/t/imp/view/5XRJCELATCR4MHWOT3JB7OZNQDU4S2FP5FEXQYLENKQHU5HLTWWR4LNJ3PNZC2NZJKAJOV5CLQYZYF5A37JVGVBN64GWLN5UHSH6YX3STKSSYE4OAM2WERGJB6OAKL336A7UXJE3IBRUIBAIX56NNXVTSZ6HOVWAHYFITV5IYRYZNYWA6V4IIO6C7XQPXOBKBWXMTPM26OBZVFYWO4XDNK5NCVJZ4YSXZGHHR57RLEPLI4GO4VMCJYYN2ENFFXK7AY7MIWX2NG5OEBNMW3XR5OGVWPPW47CYIYJPXWME2D5SPK2WKJUCU3YNUQKGYNUGFY3OPXWGSFQNJZKTKM4NH6P7BN3BI6GIXCCMCSWKO7EPUHYQD3VQ/?' from origin 'https://f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network	error	URL: https://b1t-sindc1.zemanta.com/t/imp/view/5XRJCELATCR4MHWOT3JB7OZNQDU4S2FP5FEXQYLENKQHU5HLTWWR4LNJ3PNZC2NZJKAJOV5CLQYZYF5A37JVGVBN64GWLN5UHSH6YX3STKSSYE4OAM2WERGJB6OAKL336A7UXJE3IBRUIBAIX56NNXVTSZ6HOVWAHYFITV5IYRYZNYWA6V4IIO6C7XQPXOBKBWXMTPM26OBZVFYWO4XDNK5NCVJZ4YSXZGHHR57RLEPLI4GO4VMCJYYN2ENFFXK7AY7MIWX2NG5OEBNMW3XR5OGVWPPW47CYIYJPXWME2D5SPK2WKJUCU3YNUQKGYNUGFY3OPXWGSFQNJZKTKM4NH6P7BN3BI6GIXCCMCSWKO7EPUHYQD3VQ/? Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://id.geistm.com/m/OB/mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://sync.crwdcntrl.net/map/c=14516/tp=OBRN/tpid=mCybWBevdZSRCYp4IpFZTVZlrAO6moxMqeOIFvYeuJbv2LgDWLbBK04UHbQoVvPp Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aa.agkn.com
aax-dtb-cf.amazon-adsystem.com
aax-eu.amazon-adsystem.com
ads.pubmatic.com
adservice.google.co.nz
adservice.google.com
amazon-tam-match.dotomi.com
asia.adform.net
b1-sindc1.zemanta.com
b1sync.zemanta.com
b1t-sindc1.zemanta.com
bcp.crwdcntrl.net
beacon.krxd.net
bh.contextweb.com
c.amazon-adsystem.com
c.bing.com
c1.adform.net
cdn.adligature.com
cdn.id5-sync.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
cms.quantserve.com
code.createjs.com
code.jquery.com
crb.kargo.com
creativecdn.com
cs.emxdgt.com
cs.media.net
d3div1mtym39ic.cloudfront.net
dis.criteo.com
dpm.demdex.net
dsp.adfarm1.adition.com
eus.rubiconproject.com
f5583b2d66bbeac3e5ec4a4aeb68afc8.safeframe.googlesyndication.com
flint.defybrick.com
fonts.googleapis.com
fonts.gstatic.com
ib.adnxs.com
ice.360yield.com
id.geistm.com
id.rlcdn.com
id5-sync.com
idsync.rlcdn.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
image8.pubmatic.com
images.outbrainimg.com
lb.eu-1-id5-sync.com
lbs.eu-1-id5-sync.com
log.outbrainimg.com
match.adsrvr.org
match.sharethrough.com
mcdp-sadc1.outbrain.com
odb.outbrain.com
pagead2.googlesyndication.com
pastelink.net
pippio.com
pixel-sync.sitescout.com
pixel-us-east.rubiconproject.com
pixel.rubiconproject.com
pixel.tapad.com
pr-bh.ybp.yahoo.com
pro.ip-api.com
ps.eyeota.net
px.ads.linkedin.com
rock.defybrick.com
rtb.mfadsrvr.com
s.ad.smaato.net
s.amazon-adsystem.com
s2.adform.net
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
ssbsync-us.smartadserver.com
ssbsync.smartadserver.com
ssum-sec.casalemedia.com
stags.bluekai.com
sync-jp.im-apps.net
sync.crwdcntrl.net
sync.mathtag.com
sync.outbrain.com
sync.search.spotxchange.com
sync.technoratimedia.com
t.adx.opera.com
tags.crwdcntrl.net
tags.rd.linksynergy.com
tcheck.outbrainimg.com
token.rubiconproject.com
tpc.googlesyndication.com
trace.mediago.io
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
widget-pixels.outbrain.com
widgets.outbrain.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
zem.outbrainimg.com
b1t-sindc1.zemanta.com
bh.contextweb.com
c.bing.com
cms.quantserve.com
crb.kargo.com
creativecdn.com
cs.emxdgt.com
dsp.adfarm1.adition.com
ice.360yield.com
id.geistm.com
id.rlcdn.com
id5-sync.com
image8.pubmatic.com
pixel-sync.sitescout.com
pixel.tapad.com
pro.ip-api.com
ps.eyeota.net
rtb.mfadsrvr.com
s.ad.smaato.net
ssbsync.smartadserver.com
ssum-sec.casalemedia.com
sync.outbrain.com
sync.technoratimedia.com
t.adx.opera.com
trace.mediago.io
ups.analytics.yahoo.com
103.229.206.241
103.71.26.126
104.17.25.14
104.254.148.252
104.65.228.208
104.65.229.95
107.178.254.65
13.107.42.14
13.224.250.68
13.249.136.149
13.33.33.31
13.35.18.36
141.95.33.111
141.95.98.64
142.250.4.132
142.250.4.154
142.250.4.99
142.251.10.132
142.251.10.156
142.251.12.138
142.251.12.157
142.251.12.97
162.19.138.117
172.217.194.154
172.217.194.155
172.217.194.94
172.67.202.177
172.67.38.106
18.141.78.38
18.155.68.72
182.161.73.146
185.84.60.20
185.84.60.57
199.187.193.197
199.232.46.132
23.108.101.160
23.207.181.216
23.36.48.24
23.36.49.189
23.49.60.145
23.9.185.218
34.83.125.63
34.98.67.3
35.190.60.146
35.213.12.39
35.244.159.8
35.79.171.96
35.79.79.30
38.133.127.63
44.231.207.188
44.238.192.116
52.223.40.198
52.45.196.192
52.46.155.104
52.95.126.160
54.179.72.137
54.192.148.120
54.254.5.67
64.202.112.255
67.199.150.81
67.199.150.85
67.199.150.86
69.16.175.10
69.173.158.64
74.125.24.95
74.125.68.154
8.43.72.97
89.207.22.137
89.35.29.15
01408f8061623faa6d2c0f015cd23483c3aa363c095e152f613ed94c87a5803d
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
07f3e4f6f2cd8b798060659253e829f1e5a11547e00a8dc5a1f6e869e14ebae9
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
082c1c08ffa28a33a284b7e67345c2fbe156f5e4264dbaefa74c994e71a7f9d6
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d3fd60e80f18f6b8a3b0a3cfec13dcbdaf3e710db09b170096ab1c163dda39c
124f0f57688243156d74f6b125967d4271fb72421497701415cbac4100ccc4a9
13100cd3879e5c1385581d7c88153e60cd7c3e4b0578fe2838daa56da689769b
15f20e02ef301e62ed325d633f971c506dcf1be3458c2371b849b505bb8673dc
1771fa56748c811d79bb11bbe03ec1212b43811245ab051b1fdaba0550e102aa
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
190d542d8e593c755fd16e67ca62583e183957829dfb69cc2e00c7bf67df237d
1c9e4c65f9d921b1c0829958cc7b2f307a3e22ac7a23e8315b6db4c0954e1107
1f18aa8aff38b203c6cecb0fd2bb9e13c1ea7295956d4842cba9958334318bb2
20e28022f8ab881cac6da6c6cc0e56333da60ab3f4d5540285865f30016d7ebf
2229f7b0ab01979c53a12a84a8f1502417cc2d0c41010980e345b921c9ebde21
255c0c3d3ef9fa80db0d0bc4d4f63e65febc5d22ac325ae365821b35cc64b045
2576c0d36efa51e919a92bd795c184bdd66b36736ef24efebbdd5d576af45c1e
287c4ffed8b446fb8a15e9e0d93b69eb603b133328e30db3fbc93e0de8a0cca5
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04
2d54d98b7aadd5155567c320319c92983229bf9efc7388f5abee37784d0879e7
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
38d4c098bbff0b25d7527632da6157e9ab6bedccd0502d6a146f29154fbe5f1c
398b6ad3f27000beaa3dc741a62da981e585b46f9bb3f0c9de11cf08c7f9e30d
39d160e97e2bea07b0cf1c647259ffa4f0bd07069dba4e6c19a22d38b408510f
39fae3dc476aaaa594e2c963401633dd5d02eccb3c175eda03912cfe0f91c92e
3a73b36061944ebbb33696553917d393280f796e212afcd09057b441c1168606
3ac863beb5e95f43cb246367b26cfd3a362076e753d60c179019b9325a4c57e2
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3bcbf0d14efcfe1b28f35f517920d4acb7b26dda2d4b17fdbe40b7d646146f38
3bdae3547fa83e0bac443c9d3ecefff8fd1d98eb6fdb3f43155eee51804ec860
3c5bdcb449fb1bfe6c2b49f5dfc6f627c599d795d41bc72cf194b55c619b2f13
3c94a9e5f3cf7e07756f46c1ef5546b3e44eb2c7e7f302e8d96819d65bbe22ed
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
45f0f27fb78191006375051ee3046fae3105b652d11680432511cba61b32c330
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
478d590680c83e235e3b56c0367d122fbf91dbdd91e2bf8da6af1941cfe102a4
4866af459743edbc357c225821368d9b4d370c771e955ea5ee313403adb0a4a5
487aec7746a83542b3573383df65747e31c494d8412103b5675329f3d4befaeb
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4b6d244a569a8befc0b901e3dca8e82f19b188e2d3e76f7c62fce96935ed6311
4cc159bb0445934e4a8fa48bfdcf439222e4bf20c19bb5966de421aae5bcd8cb
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f1419ff9ccddb65e044735b4c5cc0d810355e5ffaae450e32082a29e839afc3
4f3b933077b738b503f7543ffc82fa0a061f0fe7d0ff1470865fde561a324bcc
4f70535a3f92a9738eb6c3f7eaf649d5eb288ce6e95bc8af666fef88169da25a
50a60e5e5f2e8f10a2f8685031ec9849ba8faff613139f3a402e89f25ccbbabc
5282f53750426eb239915692dc53de3fcf8f69d1024cbbd5470af079fd9ad426
52ec82de9bd266991110570ea69cd6ed2ecab3931579d5b2809a2a29760a586e
53860cf28033a16a12d71aafad5dcdfce0f1883bb93b876a294715294c847ac4
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57226adbc32c91a8cd4ec9ee08e4f155f3450e79256731c04f81709a58c4c1fc
5763ede17f86fbbc3a0dc91eb13255fa2683801ece66e254056ee8c53712f546
59b0485c1fec4f53ce71bbf2805f19215f6651cc406e6ff66548444594eebc7b
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
60fc9aef81f8d49c37871134e6266f6461981ea49c9b6f1375be0b9cf7af2933
6139e1fc0d3709eebbe2b18510cf24361b9f8a538c3529a73c282bafe6c78474
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
620bae4f435d4ccd1c611f602c0790871f65d6bf668f6ff2ac716b89285cdc4a
669a2350cbeb19863e254dfd68333ca6d76e730cd8ad983dc261e16dab276ea7
6aaab99d28a54897a3d01ceb1ff705cf5ae6a16599c3756d9878bd444ae41def
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bea380818c86e33533ac6374891866e96adb5add81d4f359c5da93aabf0d3c2
6c5348affb6ccfeb05ed71c4499647db8a79e559992be9d13e1a47c4d508d294
70e3f17e43a1cb1cd7905c7677b894b82f933476e5b36eda27b474d2846058c0
78e91203d3fe53559461933e84cedf9f3c834053fa8992b3c40745fceceaa873
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
7db34c76d93cc7d307141a584e7e34227794e9b1ceccdd5c447910b89a89ce89
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
863ad739bb9402363d8f11aa86e044ddfa80fd927de18b09814259f152fdf01f
88ea4726ae9eef27732a0db3ab1dcd6eb733b5af3f63f34b34c503631f52bc06
8a821650737b505849bb96e321884fdca8a52aaf7962a89a1f58a72e46db72ae
8af24d7350dbdc8eea22e4737deaa35a795b19b0560d7173113bec7e8a3effb7
8b1719d28e80205c8ce4ec2285a705276ff3bd6c2e6ba01ecb73d0a4f77b94a9
8c6af3eda3fb057943991e6f4cb4b09706f6fc422de9f6fd6130347e4446493e
8e16ad2005bc4c19f8560189ef6e7b7475f2b3def2c60a57f9041fac5b4f94cf
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
95b79ad7efde1e0051f941e69fa5dfbc0e6fbb86fc6dc40f9dc534a56f394371
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
98be19bc78b5bc5d419e4fa6ea055ebd4671a963e2cc644aeed4362f15d14c31
9a29a65e75a48d9c432611eb70d0377c8610f1874474b65df01aa72fed0235e3
9a96cdc2774663149c42d2ff4d3c755e4fdbffdd277a7ed7768a168e7944f832
9aaf6a9c19d7472805d6e9424762aca082b09f6ab57c6e23f26f90f5ca142568
9db9163023d7fa84f0784efe03a984337f85cc526ce7602ca48ab9666583d6fa
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a05c0edb8d72254cffbbdada7eacc1f32e43794f1c7d5fc817be19a147bb4207
a12f64cad3e3b6dbad5d094c5ec316e18b64cbab9b4a1481e46d0afe4d707110
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
aa68e17fb13028f96c0d5b38fcf7006182894eb694625f9dedf5824d5066a5f0
af76fed26819f89c07226d0d2790a382a049399f5baa7607a1471e393302d8ad
afd0648fc2669732f3f6a1b107154a668fbff4350345d7ac6305c5c33f41d822
b34d9a0bf8daa16eb72f37574ce795006f339c6342f9838bfcc6323948aef5cc
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
b8a9b9565ed30ab5e7dfe1fc24d9aa17748d72d8a09edc72aab83aa25706032c
bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a
bfd59d10ce3e609050c1cdb16b573f2f259139f5a2988a30d67b72b7a9082e8a
c0b59c362ae740c391e742fa4517d90b9461b416b9bec855d14c04603dbaf71c
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c24ccee9a35eef9e74411eac871935bdff6bcb895cce80b754b66d3e4292a3ce
c32c5c6fa15808159a19785f2cd7418fc20b8fce3fd18194aaaf4062059368a5
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
c4981116b070f9f9c625c705f353775ef7bf2cfd7c80437140bc0b6bb4201172
c64cda3c1c7c935b57b27894caec3b370b98d70011c8e5ea2f31691be13c8fe7
c77c73031f12ad805be49f065989e35ee84cdeaba71e1b64c650732c921409df
c7ad2fb033696f6b193dc1e4ef7d353c1d9a4d4a39772bdd0b44175704986ef8
c8c3971e803e2beb66d215c23f6a76aa643e7399043d6bec480a935cc8050c8e
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
cd8e217991e65be206db184ca55d6673115a4579c6673739203181999150547b
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d4a84e6328bab7b8bd0587b30ae377b2fe90246b5c706ea221727c060fbbad4e
daf08b23f2d621d5d90906aa40766a0335d7431e51b9dfb019cea6fabc29d3ca
db55a0aad2bb9ca1048674248e25d2df7b79e3dc771b56f5550f0518bb23142f
e30755c35ef5e6aa6c1e81940e87a921fbab522717f5989f7f8131ef78357605
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5
e4fb476276f1f85cdb8083cd12d8586b8b9e631fc3ef83b7b752fa01c7f8e834
ebfd96030683611d9ed054682f1ddf8b9098bc7d10105602b338605b0ae82a9a
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
ed6cd01c384db70bedbe24986aa85b0745f994ad71b7e5712f8a60e1ff457d7f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f066f881ead135cd4ee88cf0c80ddb796f8841fc536a7950d4f7102e0502be2f
f08c94a636dea8c08b6a50658ba1200281007d4fba996ac05cd2eeb0b873d32d
f7cd0b3261e1b40d614d0ed99e8c146776e760569efc6c1b1e5d6126021c8c5b
f899d555f9a558f859689a3db4c68d2a352ca91452022c4576d40baea89cb0c0
f8c6274be8ab5d7dafd695c4683723ea43bc60fa25fa75d6834b4aabadc0cb2e
fa8faf9862aa69aec8ba3890bca3712fd816736afc0d636814ea98f1fe36a0f3
fb41a26d951259ebe96696a49e271a70c258facf682bb44071834aeb33aa6176
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

pastelink.net Open in urlscan Pro 89.35.29.15 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

236 Requests

75 %HTTPS

0 %IPv6

67 Domains

102 Subdomains

54 IPs

10 Countries

2142 kBTransfer

5112 kBSize

73 Cookies

18 Outgoing links

Redirected requests

236 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

pastelink.net Open in urlscan Pro
89.35.29.15 Public Scan

Screenshot
Live screenshot

Full Image

236
Requests

75 %
HTTPS

0 %
IPv6

67
Domains

102
Subdomains

54
IPs

10
Countries

2142 kB
Transfer

5112 kB
Size

73
Cookies

236 HTTP transactions
5 data transactions