ondequando.com Open in urlscan Pro
179.188.52.153 Public Scan

URL:
https://ondequando.com/
Submission: On July 20 via manual (July 20th 2021, 12:26:19 pm UTC) from US

Summary HTTP 233 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 32 IPs in 5 countries across 27 domains to perform 233 HTTP transactions. The main IP is 179.188.52.153, located in Brazil and belongs to Locaweb Servicos de Internet SA, BR. The main domain is ondequando.com.
TLS certificate: Issued by R3 on July 14th 2021. Valid for: 3 months.

This is the only time ondequando.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
29	179.188.52.153 179.188.52.153	27715 (Locaweb S...) (Locaweb Servicos de Internet SA)
3	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
23	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700:20:... 2606:4700:20::681a:f79	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1288:80:... 2a00:1288:80:800::7000	203220 (YAHOO-DEB) (YAHOO-DEB)
1	151.101.194.109 151.101.194.109	54113 (FASTLY) (FASTLY)
1	2606:4700:303... 2606:4700:3031::6815:1f21	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	94.31.29.250 94.31.29.250	33438 (HIGHWINDS2) (HIGHWINDS2)
8	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700:20:... 2606:4700:20::681a:276	13335 (CLOUDFLAR...) (CLOUDFLARENET)
33	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
52	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
7 13	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
2	142.250.185.163 142.250.185.163	15169 (GOOGLE) (GOOGLE)
1 3	2620:116:800d... 2620:116:800d:21:f916:5049:f87f:108e	16509 (AMAZON-02) (AMAZON-02)
1 1	52.18.11.109 52.18.11.109	16509 (AMAZON-02) (AMAZON-02)
17	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
2 2	23.45.99.241 23.45.99.241	16625 (AKAMAI-AS) (AKAMAI-AS)
5 5	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
5 5	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3 3	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
4	2a00:1450:400... 2a00:1450:4001:827::2006	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
2	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:808::2006	15169 (GOOGLE) (GOOGLE)
2 2	18.194.175.178 18.194.175.178	16509 (AMAZON-02) (AMAZON-02)
2	2a05:d01c:1d8... 2a05:d01c:1d8:8102:3268:e5ec:7f57:13ef	16509 (AMAZON-02) (AMAZON-02)
12	2606:4700::68... 2606:4700::6810:c40	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.186.114 142.250.186.114	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2012	15169 (GOOGLE) (GOOGLE)
233	32

29 179.188.52.153 (Brazil)

ASN27715 (Locaweb Servicos de Internet SA, BR)
PTR: vpshost4091.publiccloud.com.br

ondequando.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:f79 (United States)

ASN13335 (CLOUDFLARENET, US)

cimg.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:80:800::7000 (Frankfurt am Main, Germany)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.194.109 (United States)

ASN54113 (FASTLY, US)

images.dailykos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::6815:1f21 (United States)

ASN13335 (CLOUDFLARENET, US)

en.cryptonomist.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.31.29.250 (United Kingdom)

ASN33438 (HIGHWINDS2, US)
PTR: 94.31.29.250.IPYX-077437-ZYO.above.net

cdn57.androidauthority.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:276 (United States)

ASN13335 (CLOUDFLARENET, US)

customketodiet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.162 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

52 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany) 7 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f3.1e100.net

p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800d:21:f916:5049:f87f:108e (United States) 1 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.11.109 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-11-109.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.45.99.241 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-45-99-241.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.227.252.103 (Kansas City, United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.64.190.78 (United Kingdom) 5 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 69.173.144.138 (Frankfurt am Main, Germany) 3 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:827::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:808::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

static.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.194.175.178 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:d01c:1d8:8102:3268:e5ec:7f57:13ef (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700::6810:c40 (United States)

ASN13335 (CLOUDFLARENET, US)

c.bannerflow.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.114 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f18.1e100.net

p4-givzykgrqtkzy-nmwjlooz37abvag6-894477-i1-v6exp3.v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2012 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

p4-givzykgrqtkzy-nmwjlooz37abvag6-894477-i2-v6exp3.ds.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
76	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com ade.googlesyndication.com	852 KB
53	doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net googleads4.g.doubleclick.net static.doubleclick.net	784 KB
29	ondequando.com ondequando.com	2 MB
16	google.com 7 redirects adservice.google.com www.google.com	2 KB
13	gstatic.com fonts.gstatic.com p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com www.gstatic.com p4-givzykgrqtkzy-nmwjlooz37abvag6-894477-i1-v6exp3.v4.metric.gstatic.com p4-givzykgrqtkzy-nmwjlooz37abvag6-894477-i2-v6exp3.ds.metric.gstatic.com	157 KB
12	bannerflow.net c.bannerflow.net	124 KB
9	googletagservices.com www.googletagservices.com	326 KB
5	pubmatic.com 5 redirects image6.pubmatic.com	2 KB
5	openx.net 5 redirects rtb.openx.net	2 KB
5	googleapis.com fonts.googleapis.com ajax.googleapis.com	61 KB
4	2mdn.net s0.2mdn.net	151 KB
3	rubiconproject.com 3 redirects pixel.rubiconproject.com	1 KB
3	quantserve.com 1 redirects cms.quantserve.com	1 KB
3	google.de adservice.google.de	1 KB
3	google-analytics.com www.google-analytics.com	19 KB
3	googletagmanager.com www.googletagmanager.com	127 KB
2	innovid.com ag.innovid.com	592 B
2	agkn.com 2 redirects d.agkn.com	1 KB
2	addthis.com 2 redirects e.dlx.addthis.com	1 KB
1	everesttech.net 1 redirects pixel.everesttech.net	376 B
1	googleadservices.com partner.googleadservices.com	659 B
1	customketodiet.com customketodiet.com	221 KB
1	androidauthority.net cdn57.androidauthority.net	320 KB
1	cryptonomist.ch en.cryptonomist.ch	39 KB
1	dailykos.com images.dailykos.com	117 KB
1	yimg.com s.yimg.com	4 MB
1	cimg.co cimg.co	117 KB
233	27

	Domain	Requested by
52	tpc.googlesyndication.com	googleads.g.doubleclick.net ondequando.com tpc.googlesyndication.com pagead2.googlesyndication.com
31	googleads.g.doubleclick.net	pagead2.googlesyndication.com ondequando.com googleads.g.doubleclick.net
29	ondequando.com	ondequando.com
23	pagead2.googlesyndication.com	ondequando.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
17	cm.g.doubleclick.net	ondequando.com googleads.g.doubleclick.net
13	www.google.com	7 redirects googleads.g.doubleclick.net tpc.googlesyndication.com
12	c.bannerflow.net	s0.2mdn.net ondequando.com c.bannerflow.net
9	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
8	fonts.gstatic.com	fonts.googleapis.com
5	image6.pubmatic.com	5 redirects
5	rtb.openx.net	5 redirects
4	static.doubleclick.net	googleads.g.doubleclick.net
4	s0.2mdn.net	tpc.googlesyndication.com ondequando.com s0.2mdn.net
3	pixel.rubiconproject.com	3 redirects
3	cms.quantserve.com	1 redirects googleads.g.doubleclick.net
3	adservice.google.com	pagead2.googlesyndication.com
3	adservice.google.de	pagead2.googlesyndication.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	www.googletagmanager.com	ondequando.com www.googletagmanager.com
3	fonts.googleapis.com	ondequando.com googleads.g.doubleclick.net tpc.googlesyndication.com
2	ag.innovid.com	googleads.g.doubleclick.net
2	d.agkn.com	2 redirects
2	ajax.googleapis.com	tpc.googlesyndication.com
2	e.dlx.addthis.com	2 redirects
2	p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com	googleads.g.doubleclick.net p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com
1	ade.googlesyndication.com
1	p4-givzykgrqtkzy-nmwjlooz37abvag6-894477-i2-v6exp3.ds.metric.gstatic.com
1	p4-givzykgrqtkzy-nmwjlooz37abvag6-894477-i1-v6exp3.v4.metric.gstatic.com
1	googleads4.g.doubleclick.net	ondequando.com
1	www.gstatic.com	googleads.g.doubleclick.net
1	pixel.everesttech.net	1 redirects
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	customketodiet.com	ondequando.com
1	cdn57.androidauthority.net	ondequando.com
1	en.cryptonomist.ch	ondequando.com
1	images.dailykos.com	ondequando.com
1	s.yimg.com	ondequando.com
1	cimg.co	ondequando.com
233	38

This site contains links to these domains. Also see Links.

Domain
ezequias55.1keto.hop.clickbank.net
e40b24975to-5tjyoa-cvb0u27.hop.clickbank.net
facebook.com
twitter.com
linkedin.com
instagram.com
youtube.com
pinterest.com
mantrabrain.com

Subject Issuer	Validity	Valid
ondequando.com R3	`2021-07-14` - `2021-10-12`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-06` - `2022-07-05`	a year	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-06-23` - `2021-08-04`	a month	crt.sh
images.dailykos.com GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
cdn57.androidauthority.net Sectigo RSA Domain Validation Secure Server CA	`2020-09-07` - `2021-09-21`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
customketodiet.com Cloudflare Inc ECC CA-3	`2021-06-05` - `2022-06-04`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.innovid.com RapidSSL RSA CA 2018	`2020-02-07` - `2022-04-07`	2 years	crt.sh
*.v4.metric.gstatic.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.ds.metric.gstatic.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh

This page contains 38 frames:

Primary Page: https://ondequando.com/
Frame ID: ACFA58256FAF316354FE696DE8FD45F0
Requests: 59 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html
Frame ID: A4F888386A535BD1A8A37AC6538D23FE
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&adk=1812271804&adf=3025194257&lmt=1626783957&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fondequando.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783956914&bpp=5&bdt=1551&idt=318&shv=r20210712&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4379787723602&frm=20&pv=2&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=352
Frame ID: B7F4C5A839DA83FC92CCB2C983909E2A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=472073290&adf=2330585139&pi=t.aa~a.3817703234~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=3&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0&nras=2&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=1296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=M7jxOLt4kW&p=https%3A//ondequando.com&dtd=24
Frame ID: 226BB78D2B7E9A4D6B342C431A65BD2B
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3828852411&adf=346089256&pi=t.aa~a.1421695759~rp.4&w=947&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=947x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280&nras=3&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=75&ady=1618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=pb3qJyBEdn&p=https%3A//ondequando.com&dtd=31
Frame ID: 03D853CA2FFBA38A1DE7533E91BCD625
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=651220815&adf=2407669957&pi=t.aa~a.2618034162~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280&nras=4&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=2069&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=oEOeuwDnkZ&p=https%3A//ondequando.com&dtd=37
Frame ID: 496BA036D009EAD49029C6A148618B31
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3160215234&adf=2049820743&pi=t.aa~a.2560532834~rp.4&w=947&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=947x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280&nras=5&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=75&ady=2402&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=wisURkTwgi&p=https%3A//ondequando.com&dtd=41
Frame ID: 2696D843A0354BF8A79086F0B43F6CD3
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3862781926&adf=1775375230&pi=t.aa~a.4198048424~rp.1&w=991&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=991x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280&nras=6&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=53&ady=3296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=Nwpj28KFaH&p=https%3A//ondequando.com&dtd=46
Frame ID: CF83563D4B46D25E9580FAFB1A405EFF
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=2335843837&adf=1207670937&pi=t.aa~a.3775770939~rp.4&w=487&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=487x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280&nras=7&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=3500&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=SfBAjp0a9Z&p=https%3A//ondequando.com&dtd=50
Frame ID: C81C73ED927D0E7E791C07B5990417BB
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=90&adk=3403801137&adf=436985940&pi=t.aa~a.1188756047~rp.4&w=977&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=977x90&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=2&bdt=2443&idt=2&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280%2C487x280&nras=8&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=60&ady=4517&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=7&fsb=1&xpc=boah1urc7z&p=https%3A//ondequando.com&dtd=56
Frame ID: AA8F00D2F7BCE7E6AD522B232530A68A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1
Frame ID: 89A7480DEBF12A37A2129E8920DE6F44
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 7683D45AAE42B3828AFB7E2E7F9613A2
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js
Frame ID: 77F5DE9DF0EC50E9DB1E70D0F9BA8AED
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 6C55CCF0EC3DC71E76DF431D68591CE8
Requests: 2 HTTP requests in this frame

Frame: https://p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Frame ID: 25FF3454DC09557575C74585E794D46E
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 2BDC6C3857B54ACF28FFA7AEB1B9B508
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/index.html
Frame ID: 75DADCE90EB550AC40CC9BE60ABC811E
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CIMHf1cD2YLLNNbCDx_AP_dm9uAj804rCY4Of0s7dDejHlZhDEAEg7pWqgQFglQKgAf-Ere0DyAEJqAMByANIqgSsAU_Q3zaAibr1m1YqmnzVmyXwbHsxOddCqph8apVK9tNZDfj0poN8qi7-IfQ4iQDGWOUehLBb0fYUmKPeoYPIW4FKLd8B5dPAq37RUKEcyERPTyCildcEghKFi5FG7O9qW3TOS6tTF0eBias3-6qLuzLCyUPnWZ9r8kh5N9SAZzV11nnSMD-8eVfS1jGxb8fCA4JDIXXC9FYjUMTLf2uZPU34tnXOqTmW8IuZ9ufABISAx8L4ApIFBAgEGAGSBQQIBRgEoAYugAeS-5odqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEMeJM9IICQiA4YAQEAEYH4AKAcgLAdgTDNAVAYAXAbIXGgoYCAASFHB1Yi02MDQ3ODYxNTU0ODA1ODY2&sigh=3rFBSgE2AG4&template_id=419
Frame ID: 4986CD3E882C4F3A72A645389A7C5F31
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: FD3BCFC651DED1254E06ABF844BFF09D
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js
Frame ID: 9F8D672E3EFC49E1D92E8787CF2B596E
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html
Frame ID: 7AC172FE30E837707B17EBD7E8278A0D
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=Cq-4t1cD2YJC9NM2IgAfGka6QCfzTisJjrqqWy80N6MeVmEMQASDulaqBAWCVAqAB_4St7QPIAQmoAwHIA0iqBK0BT9CIW_K8208z2A10Sds1FzPwL4feTiMfl38iIZu8rMc5wbInDRl0JTz-KaGac6fGvomqAMEKJ4Pws7pOlqavFfLLb74dDfduPJZ9Kye_6DQfsF8YVDC2CC1RrJ89qgXd8R3iezjbSJ_ndcKP_5E-F_jwcFq1l3ct_tHu08WlRtIYufqcXt4e0-g-ND5GVTP6_l_36gPqt9JV3uReItEjIBuvUvWsDbzQH1kCxFPABISAx8L4ApIFBAgEGAGSBQQIBRgEoAYugAeS-5odqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEPDDI9IICQiA4YAQEAEYH4AKAcgLAdgTDNAVAYAXAbIXGgoYCAASFHB1Yi02MDQ3ODYxNTU0ODA1ODY2&sigh=PTmmKW7RIg0&template_id=419
Frame ID: A3562910515F3B5B913AF31B245E4140
Requests: 8 HTTP requests in this frame

Frame: https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstkVnMSnMhKIKClwiHUebU7hebzP8wKqdHggnxgdX_nPyG4pkrYGeEjYuvwjISxU40XYs2e3ZjyTlNtQ2wxNjuTKNNEJtWgUEMEF3fhJ8UPMSc6E0EEvJM8mJTrQAE8mRG0H92ZfVduBvmUO0ZhTVHkHVs2yXlOniqW9_JpjPveH9K4keT1ivD-weXJ5jl7-LoWD6MNls8TpiyIc-N2tFnaebaBPaCfbR3QMkrNa9gimNeJapNdlKYsotZxhkXSju8iRx5HazYK18GqgaMsHIkZK3qWdOx1OmsVqI3dlHagGCpR8XXboL8pxVyZ2gHQQ2Qtprv_QtRNHZbjJ4e60Bx-7EUCDzm8taLW-k-KOOg_bNO7LQMbxl8zX2znmzqh6pXx8bVtV9uT2996RDAHtJvID9-JKxX34rpQ71Lu52kgYDoA0-z4ZtLcwbz__mXbZf7w7GcsDE4Rv-l5U27SiXM8mL9dnUUjRpQja03bPynpiQc30StlIYW-On1b-IdleJKhe0817wEJJqAs8UVkjfxiZMX4eR1OuqkyF32OAcBJIE8XYRS4fAV7u_x46WeMVet7OuaKLfyghShC8EAXv3PQVR-cRUELj6QyDar5NLcNAiRG82imEVQSXRTAiKVHiU1BuEKvWCKncee-oWXQYjFC0Y1pFAjhbhe5CVr_ZfWS69hfim6N80lsfnGMpbK2N0ur1MEcSvsz8hEmhM0qAWu6OGRzgkodUc7Ag8sMZVvV1i1Xeb4ILSdN7oW56pogV3j2-VkjrLrU1yQNTf3TekUal8qz_0PfwtVGUcZyrefyQpbjNqcmB_9iJt5zUQLc6un9Y4xeyFBNYn8QNUlmPvUDWRqfEuJqyGZ1MFPba19sZ0MGvMZiGN1WkInuKAFaMQQJ2IxWB2b9EeWXaLH2L2cZxr5Lf1M_2UQPj0sj_I_gw8uKhoc98Q&sig=Cg0ArKJSzD1Q_6PtzoJlEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=
Frame ID: 9A35B357618960A8621002DE6C9F83A8
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 91D2E4E25543B9616B415C40AA0746B9
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 6F0A16A503465EE061954777321C360B
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 86FF0F9C36C1D19EA94EA81F00B0A33B
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: B4D3AFAF8EEFE988F49D50DE1DB6B288
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 6FC1B21FE9E0D1F094EFA33237DEA35C
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: D0786FF42951CF98CCFE59D018143E41
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/6418128/1611760407800/DE_T2_Indices_Germany30_spreads_prospecting-1-German-970x250-637473572063783250-8f138022-363b-4089-90b9-4ee4520246de.html
Frame ID: 0EE2551BD8C3A2C102908D20DAB3DA7E
Requests: 13 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html
Frame ID: 68C73D4B0756EB4853D10505C05DCDA4
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CZhlo1cD2YNjZNInrgAfLl73QC8XV9c5j7-27oNIO6Kq2lYsDEAEg7pWqgQFglQKgAb38_JwDyAEJqQLx9Vf5JsOzPqgDAcgDSKoEsAFP0CRB_N7mqI37sbBzVGy2AxVQG7vHP5suaFhMv5tAx-iXaQCgpq6z81shp-ylhbg2jFu_Y0E9XgGLDrSikC2fTmXlohoaHxy1Ho5F3ZAncZN9ekH_2TYiJwRwdU_A0F42NwC7-9qX5fJkwMUft4hIg1Em6TFBpmQFAc69mQiZbO4gBuHCkPGu-5dGsaqgSfua9XEOiCNJ9P3UVf5LgWfYbQ4D5QWv1RvMc9nuZoJ_HMAE3fa328gDkgUECAQYAZIFBAgFGASgBi6AB6uDg2OoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwUQl6GaAdIICQiA4YAQEAEYH4AKAcgLAdgTDdAVAYAXAbIXGgoYCAASFHB1Yi02MDQ3ODYxNTU0ODA1ODY2&sigh=UHEFQZ-fgNs&template_id=419
Frame ID: A23DD8A879ADA8E964799DDE2E0FABE2
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 2535171E9986BD2AAB9FECC728E03A42
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js
Frame ID: 6E908E32987069B4C5B8FA96C1C056E7
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js
Frame ID: ECDDFDA2C8C7B206654186AD6837F0C5
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 3563BCF97DC33ED36717ADB9BC8E1069
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: EEED632D4FFE1AC5F01984573703FC4C
Requests: 1 HTTP requests in this frame

Frame: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fcmc-markets%2F560bd8d24d47fc28fc84259d%2Fimages%2F0f7d384c-494d-4b00-b910-80b6777b7929.png&w=127&h=95&q=90&f=webp&rt=contain
Frame ID: 75592B094B376B80FB98EEAB47D3536B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /react.*\.js/i

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

OWL Carousel (Widgets) Expand

Overall confidence: 100%
Detected patterns

html /<link [^>]*href="[^"]+owl\.carousel(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
html /<link [^>]*href="[^"]+owl\.carousel(?:\.min)?\.css/i
script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

233
Requests

99 %
HTTPS

62 %
IPv6

27
Domains

38
Subdomains

32
IPs

5
Countries

8608 kB
Transfer

12067 kB
Size

3
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: http://ezequias55.1keto.hop.clickbank.net/
Title:

Search URL Search Domain Scan URL

URL: https://e40b24975to-5tjyoa-cvb0u27.hop.clickbank.net/

Search URL Search Domain Scan URL

URL: http://facebook.com/

Search URL Search Domain Scan URL

URL: http://twitter.com/

Search URL Search Domain Scan URL

URL: http://linkedin.com/

Search URL Search Domain Scan URL

URL: http://instagram.com/

Search URL Search Domain Scan URL

URL: http://youtube.com/

Search URL Search Domain Scan URL

URL: http://pinterest.com/

Search URL Search Domain Scan URL

URL: https://mantrabrain.com/
Title: Mantrabrain

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 74

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 90

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPLIoJrIKOziEipngztFH-kDBtm4P_4dXypLsniJ3NrRsJHCUEuMESnvwfM-0jSBxA9ZWnZOYI-ORXoNP2QpZvqLXYbNJ2N-&google_gid=CAESEJKA48usxvSG8sHPbZAUs6w&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVBiQTFnQUFCVEpHcFRoRQ&google_push=AYg5qPLIoJrIKOziEipngztFH-kDBtm4P_4dXypLsniJ3NrRsJHCUEuMESnvwfM-0jSBxA9ZWnZOYI-ORXoNP2QpZvqLXYbNJ2N-

Request Chain 91

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJCNpJVNGpVFjYJUMOmONScEtwHf06CogKRjQnaiTeL3_wQnAao_Xqv39Pb0Q5VAwV0k-K7VspZNFVsqhFEAO-px6FWkQX2&google_gid=CAESEJc9Ph5Kvxm3LvxG--YLqpg&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJCNpJVNGpVFjYJUMOmONScEtwHf06CogKRjQnaiTeL3_wQnAao_Xqv39Pb0Q5VAwV0k-K7VspZNFVsqhFEAO-px6FWkQX2&google_gid=CAESEJc9Ph5Kvxm3LvxG--YLqpg&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA3MjAxMjI1NTgwMDAxMTAxODQ2NDUxMg%3D%3D&google_push=AYg5qPJCNpJVNGpVFjYJUMOmONScEtwHf06CogKRjQnaiTeL3_wQnAao_Xqv39Pb0Q5VAwV0k-K7VspZNFVsqhFEAO-px6FWkQX2

Request Chain 92

https://rtb.openx.net/sync/dds?google_gid=CAESEF2xCUlcN7CTrwYURCJ0c3A&google_cver=1&google_push=AYg5qPLV_RugGLgovo9l3gmV3dOf9JK4O35xar3kA_fdgaJ0zgMKDGI31oxOQOmfCGQYAHALoj73ohMyY6LGe7mySY9tFzhsGHp_ HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESEF2xCUlcN7CTrwYURCJ0c3A&google_cver=1&google_push=AYg5qPLV_RugGLgovo9l3gmV3dOf9JK4O35xar3kA_fdgaJ0zgMKDGI31oxOQOmfCGQYAHALoj73ohMyY6LGe7mySY9tFzhsGHp_&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLV_RugGLgovo9l3gmV3dOf9JK4O35xar3kA_fdgaJ0zgMKDGI31oxOQOmfCGQYAHALoj73ohMyY6LGe7mySY9tFzhsGHp_&google_hm=5lDSosNMzCIZP4WQ3J9mgQ==

Request Chain 93

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEFMnQOqlGCzp3yS71RVOhZw&google_cver=1&google_push=AYg5qPI7ElHNnZTbDj4lOZ1MDGfO_Rnn9x-8tbKsRp-QtCJtTcsCwfndeTW2YHBC9YAXkW4h1UsiJPSqKKXGbmi7u1NKllPI__cx HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEFMnQOqlGCzp3yS71RVOhZw&google_cver=1&google_push=AYg5qPI7ElHNnZTbDj4lOZ1MDGfO_Rnn9x-8tbKsRp-QtCJtTcsCwfndeTW2YHBC9YAXkW4h1UsiJPSqKKXGbmi7u1NKllPI__cx&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_kbEnL4FTqe5Q1vWjPZjQQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPI7ElHNnZTbDj4lOZ1MDGfO_Rnn9x-8tbKsRp-QtCJtTcsCwfndeTW2YHBC9YAXkW4h1UsiJPSqKKXGbmi7u1NKllPI__cx

Request Chain 94

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBlKMxo9mlFaCyNLP7-Hj7Y&google_cver=1&google_push=AYg5qPLxgPVJ4WYeHp-ljEeSl24hNSDzItZWnN5KtWjILNYmqAFlVK2HvuxjaeXYDeJ21ul3QivYE-cHZPk5w26_hjNb4Rzfv0N- HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JDMTVaVTktMVItNVBCTQ==&google_push=AYg5qPLxgPVJ4WYeHp-ljEeSl24hNSDzItZWnN5KtWjILNYmqAFlVK2HvuxjaeXYDeJ21ul3QivYE-cHZPk5w26_hjNb4Rzfv0N-

Request Chain 95

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk

Request Chain 97

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 115

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 180

https://d.agkn.com/pixel/2175/?google_gid=CAESEECyrBNDYIpqeStcvyN-als&google_cver=1&google_push=AYg5qPKSoQSeaubxfz4Qaemz_9vROtCXiFLlIGoDoPeqTNwatMW-jyQLgV_9htuHDjDgOSjzwVppuOxqpNnfzwMF06RYHi-P6-0F HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKSoQSeaubxfz4Qaemz_9vROtCXiFLlIGoDoPeqTNwatMW-jyQLgV_9htuHDjDgOSjzwVppuOxqpNnfzwMF06RYHi-P6-0F&google_hm=Q0FFU0VFQ3lyQk5EWUlwcWVTdGN2eU4tYWxz

Request Chain 181

https://rtb.openx.net/sync/dds?google_gid=CAESEPIs4Mor5jPQ0-EXEgUTu2E&google_cver=1&google_push=AYg5qPKv0qKTlmGEU7u9NZi44bVvVwGYyt3sdTcyHuMOzDNqD8aL-WRXMGAqRWDxlmdP4231D4htCHAuJVLX-40MEJtT9HYKod8Q HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESEPIs4Mor5jPQ0-EXEgUTu2E&google_cver=1&google_push=AYg5qPKv0qKTlmGEU7u9NZi44bVvVwGYyt3sdTcyHuMOzDNqD8aL-WRXMGAqRWDxlmdP4231D4htCHAuJVLX-40MEJtT9HYKod8Q&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKv0qKTlmGEU7u9NZi44bVvVwGYyt3sdTcyHuMOzDNqD8aL-WRXMGAqRWDxlmdP4231D4htCHAuJVLX-40MEJtT9HYKod8Q&google_hm=kRDYtQF1yPULik2X9083zg==

Request Chain 182

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBa9ZSbFvilnYQJCsu9jT5w&google_cver=1&google_push=AYg5qPLLMnmg8dyZxPOvjyxUOs6t42gv9C7j26YcNOI1KusuP-M9jItz4f6zbWWgUdEGZ2RRZrtGZTnKa2IDVX21TGVTjw_fF3YMtw HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBa9ZSbFvilnYQJCsu9jT5w&google_cver=1&google_push=AYg5qPLLMnmg8dyZxPOvjyxUOs6t42gv9C7j26YcNOI1KusuP-M9jItz4f6zbWWgUdEGZ2RRZrtGZTnKa2IDVX21TGVTjw_fF3YMtw&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8rOmD_o2S2mWKhI8mYF1fQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLLMnmg8dyZxPOvjyxUOs6t42gv9C7j26YcNOI1KusuP-M9jItz4f6zbWWgUdEGZ2RRZrtGZTnKa2IDVX21TGVTjw_fF3YMtw

Request Chain 183

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBljemKD7qjevp58ueJMYao&google_cver=1&google_push=AYg5qPKLXly7X4tx1SEp7DiV62X2_LUCrtfJs6SkNqBED2b8fFr6uYZVlFtL_vm46S3hQC1FwXgmP2vxac0SxqpQQQmFHtJvPd5tOA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JDMTYwSTEtNy05U040&google_push=AYg5qPKLXly7X4tx1SEp7DiV62X2_LUCrtfJs6SkNqBED2b8fFr6uYZVlFtL_vm46S3hQC1FwXgmP2vxac0SxqpQQQmFHtJvPd5tOA

Request Chain 184

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k

Request Chain 187

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 191

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEF-Eet_Mr7xgANSq6HLT958&google_cver=1&google_push=AYg5qPL6_gDdrPLoXnSpc__KM18KrrEfIIaZYmj2uAQvC7PyPYrT40ix0O-g7eijkwRFBeFYZN2aVX3LxJkttoTMqOxa96HiliRf HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL6_gDdrPLoXnSpc__KM18KrrEfIIaZYmj2uAQvC7PyPYrT40ix0O-g7eijkwRFBeFYZN2aVX3LxJkttoTMqOxa96HiliRf&google_hm=jzErQ72gSrYioeu2PZlxRA

Request Chain 192

https://d.agkn.com/pixel/2175/?google_gid=CAESEKcSpZt8MWq301FASVLssTs&google_cver=1&google_push=AYg5qPIY5Qe4kTFDN5lr-oscyKJ5-YgZskERwwPX2hQFSu9DfSNrv0BSjl7c5g93_19iQxSpmcJMxo3toR8IQJB6evkbvFvVZrKp HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIY5Qe4kTFDN5lr-oscyKJ5-YgZskERwwPX2hQFSu9DfSNrv0BSjl7c5g93_19iQxSpmcJMxo3toR8IQJB6evkbvFvVZrKp&google_hm=Q0FFU0VLY1NwWnQ4TVdxMzAxRkFTVkxzc1Rz

Request Chain 193

https://rtb.openx.net/sync/dds?google_gid=CAESECAOH998xQlXkUjXJs6wLko&google_cver=1&google_push=AYg5qPI1hbKnQE4i7aiL2a002DNp5UGkB2D67PvhFpb7UUs9Z5W_qtwiZLeELEj2A-c-czUeS6PeCYY4ydTJKhgWlH6q36Xy8K_P HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI1hbKnQE4i7aiL2a002DNp5UGkB2D67PvhFpb7UUs9Z5W_qtwiZLeELEj2A-c-czUeS6PeCYY4ydTJKhgWlH6q36Xy8K_P&google_hm=kRDYtQF1yPULik2X9083zg==

Request Chain 194

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEHg2b2Bq09gwmI02_yjXtT8&google_cver=1&google_push=AYg5qPJ3RzNVhipZUvvFPn17VGVBKAX07mE-edORMAS9pSEce5KTfop6QzjuPYxzI5VyEI2qZClAX7qXVDHFt82M6QaZMqbDGsJ1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8rOmD_o2S2mWKhI8mYF1fQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ3RzNVhipZUvvFPn17VGVBKAX07mE-edORMAS9pSEce5KTfop6QzjuPYxzI5VyEI2qZClAX7qXVDHFt82M6QaZMqbDGsJ1

Request Chain 195

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENxFRBk4yYwTTZJdUWcz970&google_cver=1&google_push=AYg5qPLwYX9IpK_LODJwTIykLn4PG1672hZiq2B8nisuzqGNxE0xI3ap_RwVHLdmwys_Fwegy7ZVHoVKZAQOZlBF--0ur2B_xTN0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JDMTYwS08tTS1CTlJV&google_push=AYg5qPLwYX9IpK_LODJwTIykLn4PG1672hZiq2B8nisuzqGNxE0xI3ap_RwVHLdmwys_Fwegy7ZVHoVKZAQOZlBF--0ur2B_xTN0

Request Chain 196

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc

Request Chain 199

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 201

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 224

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

233 HTTP transactions
12 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
ondequando.com/ 92 KB
93 KB 2927ms
1981ms Document
text/html 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache / PHP/7.4.11
Resource Hash: 5c9a08f74bb30c290fa2f22d8be1c87ad1ebaa19cdabfcbbd0117caa6538d529

Request headers

Host: ondequando.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:29 GMT
Server: Apache
X-Powered-By: PHP/7.4.11
Cache-Control: no-cache
X-Nitro-Cache: MISS
Link: <https://ondequando.com/wp-json/>; rel="https://api.w.org/"
Content-Length: 94538
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK blocks.style.build.css
ondequando.com/wp-content/plugins/social-warfare/assets/js/post-editor/dist/ 2 KB
2 KB 686ms
235ms Stylesheet
text/css 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/plugins/social-warfare/assets/js/post-editor/dist/blocks.style.build.css?ver=5.7.2
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 4834aa58000857ce42bdc4ae2322104fbbb5c0e96a7dbd4deab73900ae9d23a7

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:32 GMT
Last-Modified: Tue, 06 Jul 2021 21:51:10 GMT
Server: Apache
ETag: "8a1-5c67b6b7a2f80"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 2209

GET
H/1.1 200
OK style.min.css
ondequando.com/wp-includes/css/dist/block-library/ 57 KB
57 KB 692ms
233ms Stylesheet
text/css 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.2
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:32 GMT
Last-Modified: Mon, 12 Jul 2021 17:29:56 GMT
Server: Apache
ETag: "e33b-5c6f0784f8000"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 58171

GET
H/1.1 200
OK style.min.css
ondequando.com/wp-content/plugins/social-warfare/assets/css/ 85 KB
86 KB 689ms
230ms Stylesheet
text/css 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/plugins/social-warfare/assets/css/style.min.css?ver=4.2.1
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 5820216486981914837a6b4f07dc46f6969a726d301a867b6043b149fab43ec7

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:32 GMT
Last-Modified: Tue, 06 Jul 2021 21:51:10 GMT
Server: Apache
ETag: "155ed-5c67b6b7a2f80"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 87533

GET
H/1.1 200
OK bootstrap.min.css
ondequando.com/wp-content/themes/magazinenp/assets/vendor/bootstrap/css/ 141 KB
142 KB 700ms
234ms Stylesheet
text/css 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/bootstrap/css/bootstrap.min.css?ver=4.0.0
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: fea46492526c07103d9d5d0013d41026feb67019fd2466e4bd0466d2879369a3

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:32 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "235c4-5baeb734c1480"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 144836

GET
H/1.1 200
OK font-awesome.css
ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/css/ 73 KB
73 KB 704ms
235ms Stylesheet
text/css 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/css/font-awesome.css?ver=5.7.2
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: be3c2e92383f1bd7f36a2fe433507c3a04963568f322f991cc05b327e090d777

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:32 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "12268-5baeb734c1480"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 74344

GET
H2 200 css
fonts.googleapis.com/ 18 KB
1 KB 16ms
15ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&ver=5.7.2

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2c8371f7333ea7e9e7b7694e28ddc994a68af8537972a631968bdc94f0e98206

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 20 Jul 2021 10:33:17 GMT
server: ESF
date: Tue, 20 Jul 2021 12:25:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 20 Jul 2021 12:25:55 GMT

GET
H/1.1 200
OK owl.carousel.min.css
ondequando.com/wp-content/themes/magazinenp/assets/vendor/owl-carousel/ 3 KB
4 KB 705ms
237ms Stylesheet
text/css 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/owl-carousel/owl.carousel.min.css?ver=2.3.4
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 062368677bcefd9495e8b320e0cf22c4faca9f1bc04666efeb9cd5307cd591a4

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:32 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "d1c-5baeb734c1480"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3356

GET
H/1.1 200
OK magazinenp.css
ondequando.com/wp-content/themes/magazinenp/assets/css/ 99 KB
99 KB 920ms
235ms Stylesheet
text/css 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/css/magazinenp.css?ver=1.1.5
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: eba8b365bc41d6fd429e0a8af3cec81f1ed553b2dbfebe997c4d381d48cf3d41

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:32 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "18a4b-5baeb734c1480"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 100939

GET
H/1.1 200
OK wp-emoji-release.min.js Show response
ondequando.com/wp-includes/js/ 14 KB
14 KB 231ms
231ms Script
application/javascript 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-includes/js/wp-emoji-release.min.js?ver=5.7.2
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://ondequando.com/
Cookie: _ga_28P0FD8DZ8=GS1.1.1626783957.1.0.1626783957.0; _ga=GA1.1.572248462.1626783957
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Mon, 12 Jul 2021 17:25:33 GMT
Server: Apache
ETag: "3795-5c6f0689e78a0"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 14229

GET
H/1.1 200
OK style.css
ondequando.com/wp-content/themes/magazinenp/ 2 KB
2 KB 722ms
236ms Stylesheet
text/css 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/style.css?ver=5.7.2
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 87ea00897f4e3c60c390adfd29fdaf1ff8063f5d50a1a7f43572858892547bf8

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:32 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "653-5baeb734c1480"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1619

GET
H/1.1 200
OK jquery.min.js Show response
ondequando.com/wp-includes/js/jquery/ 87 KB
88 KB 941ms
235ms Script
application/javascript 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:32 GMT
Last-Modified: Mon, 12 Jul 2021 17:28:03 GMT
Server: Apache
ETag: "15d98-5c6f071967de0"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 89496

GET
H/1.1 200
OK jquery-migrate.min.js Show response
ondequando.com/wp-includes/js/jquery/ 11 KB
11 KB 958ms
236ms Script
application/javascript 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:32 GMT
Last-Modified: Mon, 12 Jul 2021 17:28:02 GMT
Server: Apache
ETag: "2bd8-5c6f071847c80"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 11224

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 31ms
31ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-189729766-1

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

05833c23cd103d9e23eb9e95d75dce1b2fc9b12bb83ae3edd196eeaf9e0caac6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:56 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39695
x-xss-protection: 0
last-modified: Tue, 20 Jul 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 20 Jul 2021 12:25:56 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 134 KB
48 KB 43ms
23ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

79aa2ea675fee615ed72d18532ada370afa3486a35a0d3e367c81dbbc679ab4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48349
x-xss-protection: 0
server: cafe
etag: 2378802026447261366
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 20 Jul 2021 12:25:56 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 126 KB
49 KB 23ms
22ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-28P0FD8DZ8

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

042241b05794b40afd81be4b88a728b7244f74a758e62085b07f40c1f7dc2c30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:56 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50535
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:25:56 GMT

GET
H/1.1 200
OK image-2nd-banner-maxresdefault.jpg
ondequando.com/wp-content/uploads/2021/07/ 96 KB
96 KB 234ms
234ms Image
image/jpeg 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ondequando.com/wp-content/uploads/2021/07/image-2nd-banner-maxresdefault.jpg
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: cfc2c67f6c3d4cf6b501a0432e846b533ee5aad4ed97b3fbe5eb1015d87689dd

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://ondequando.com/
Cookie: _ga_28P0FD8DZ8=GS1.1.1626783957.1.0.1626783957.0; _ga=GA1.1.572248462.1626783957
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Thu, 15 Jul 2021 21:43:08 GMT
Server: Apache
ETag: "17f33-5c7305b5bd580"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 98099

GET
H/1.1 200
OK script.min.js Show response
ondequando.com/wp-content/plugins/social-warfare/assets/js/ 17 KB
17 KB 236ms
236ms Script
application/javascript 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/plugins/social-warfare/assets/js/script.min.js?ver=4.2.1
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 244de6960388f992e43c07685dd8c7ca1ee4424d85874a72036f2f8e692bbd7b

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:32 GMT
Last-Modified: Tue, 06 Jul 2021 21:51:10 GMT
Server: Apache
ETag: "4426-5c67b6b7a2f80"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 17446

GET
H/1.1 200
OK bootstrap.min.js Show response
ondequando.com/wp-content/themes/magazinenp/assets/vendor/bootstrap/js/ 48 KB
48 KB 235ms
235ms Script
application/javascript 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/bootstrap/js/bootstrap.min.js?ver=4.0.0
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: de55a09126505ab0d6af77f359a8d02c1bfefe51331a6bd17fba13a03a0247d0

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "bf0b-5baeb734c1480"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 48907

GET
H/1.1 200
OK owl.carousel.min.js Show response
ondequando.com/wp-content/themes/magazinenp/assets/vendor/owl-carousel/ 43 KB
44 KB 235ms
235ms Script
application/javascript 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/owl-carousel/owl.carousel.min.js?ver=2.3.4
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 4e0781bdd2cbb5db04da3b5e059eeca34e325fabb893bee7457b5babf5b7c029

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "ad3c-5baeb734c1480"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 44348

GET
H/1.1 200
OK jquery.matchHeight-min.js Show response
ondequando.com/wp-content/themes/magazinenp/assets/vendor/match-height/ 3 KB
4 KB 238ms
238ms Script
application/javascript 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/match-height/jquery.matchHeight-min.js?ver=0.7.2
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 9b09fb29de36cb7bc57a4df206368485cbfd8b072daabc4e6057789df1075ca3

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "d3f-5baeb734c1480"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 3391

GET
H/1.1 200
OK skip-link-focus-fix.js Show response
ondequando.com/wp-content/themes/magazinenp/assets/js/ 716 B
997 B 230ms
230ms Script
application/javascript 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/js/skip-link-focus-fix.js?ver=20151215
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 93c964e1bd5719c525c73073cf64f4c2b03dd6d4fa846d5bce3142596b3f1e97

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "2cc-5baeb734c1480"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 716

GET
H/1.1 200
OK jquery.marquee.min.js Show response
ondequando.com/wp-content/themes/magazinenp/assets/vendor/jquery.marquee/ 9 KB
9 KB 232ms
231ms Script
application/javascript 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/jquery.marquee/jquery.marquee.min.js?ver=5.7.2
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: f7ec795d6ca0df8d0083c41b1a57aed9a3500897442639a0c24999a749eed08a

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "2383-5baeb734c1480"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 9091

GET
H/1.1 200
OK jquery.sticky.js Show response
ondequando.com/wp-content/themes/magazinenp/assets/vendor/sticky/ 10 KB
10 KB 236ms
235ms Script
application/javascript 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/sticky/jquery.sticky.js?ver=1.0.4
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: b79a0e972fa8ca39bb0ead6c16b1463a49766a5b71f3fd63421a8093c3a0b595

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "276b-5baeb734c1480"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 10091

GET
H/1.1 200
OK magazinenp.js Show response
ondequando.com/wp-content/themes/magazinenp/assets/js/ 9 KB
9 KB 237ms
237ms Script
application/javascript 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/js/magazinenp.js?ver=1.1.5
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 686c99fc0596a370704c29139e82d23bfcfa193e6e4464916c3b91a114ae2242

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "2358-5baeb734c1480"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 9048

GET
H/1.1 200
OK wp-embed.min.js Show response
ondequando.com/wp-includes/js/ 1 KB
2 KB 236ms
235ms Script
application/javascript 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-includes/js/wp-embed.min.js?ver=5.7.2
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Mon, 12 Jul 2021 17:25:32 GMT
Server: Apache
ETag: "592-5c6f0689a2340"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 1426

GET
H/1.1 200
OK image.js Show response
ondequando.com/wp-content/plugins/featured-image-from-url/includes/html/js/ 2 KB
2 KB 238ms
237ms Script
application/javascript 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/plugins/featured-image-from-url/includes/html/js/image.js?ver=3.6.4
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: caacfc6a3602fe9a189a4bd15792c4bed2fce634c04716f515e6c07cda07315a

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://ondequando.com/
Cookie: _ga_28P0FD8DZ8=GS1.1.1626783957.1.0.1626783957.0; _ga=GA1.1.572248462.1626783957
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Sat, 03 Jul 2021 04:03:11 GMT
Server: Apache
ETag: "8df-5c630268c1dc0"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 2271

GET
H/1.1 200
OK header-bg.jpg
ondequando.com/wp-content/uploads/2021/02/ 250 KB
250 KB 386ms
237ms Image
image/jpeg 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ondequando.com/wp-content/uploads/2021/02/header-bg.jpg
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: d072b8763ed1dc4d56de6bd39069a07fb38a4e4e13f87b3f1f27184aeeea146e

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://ondequando.com/
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Tue, 09 Feb 2021 18:29:16 GMT
Server: Apache
ETag: "3e6f8-5baeb76c11700"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 255736

GET
H2 200 6c058ccbc6.jpg
cimg.co/w/articles/0/60f/ 117 KB
117 KB 146ms
120ms Image
image/jpeg 2606:4700:20::681a:f79
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cimg.co/w/articles/0/60f/6c058ccbc6.jpg
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:f79 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 405f7043ce07284aadcd74105c2551a62e9f58d592142d23f709954383665220

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:56 GMT
via: 1.1 varnish-v4
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
content-length: 119493
x-varnish: 821789033
last-modified: Tue, 20 Jul 2021 12:23:52 GMT
server: cloudflare
etag: "1d2c5-5c78d207b8686"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RaQTX7SaPAh8f%2B4Nr0C4RLVPmJq%2FGpQyLGJqfNtcLvGFU84vx94rJu%2FHjb0UpCcygF2nwzdGdyI122jITQJZfkCDOZR0BkZSIpCwA6jXmLj7LtGneMuWBNxiWoVgagLj9WCiZ%2Bk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 671c2cd218414eaf-FRA

GET
H2 200 1df69490-e940-11eb-9737-afa020043d52
s.yimg.com/os/creatr-uploaded-images/2021-07/ 4 MB
4 MB 23ms
9ms Image
image/jpeg 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/os/creatr-uploaded-images/2021-07/1df69490-e940-11eb-9737-afa020043d52

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

368dc1e44e63278240899b9def832d0036482f9e5c7f2eb281961cab15e570f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 10:55:05 GMT
x-content-type-options: nosniff
age: 5453
x-amz-server-side-encryption: AES256
strict-transport-security: max-age=15552000
content-length: 3672731
x-amz-id-2: bcY0Yh8pFaimx26n3ZBqkPG2ibJq3HLdZ1J8OC9xe0ZDtdXeLQLI12VGb2wUQd93h9Mx9Z8ZbNM=
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 20 Jul 2021 09:52:04 GMT
server: ATS
etag: "1c8a2840863f4ba8ea14e7f7fea4ec6d"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin
x-amz-request-id: T19BSRVXV5J469RJ
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=604800
x-amz-version-id: YiLZT2KzzsGHatfxoJmCk59p7dc.T6Wr
accept-ranges: bytes
content-type: image/jpeg

GET
H2 200 backtonormal915.png
images.dailykos.com/images/967975/story_image/ 116 KB
117 KB 700ms
674ms Image
image/png 151.101.194.109
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.dailykos.com/images/967975/story_image/backtonormal915.png?1626764318
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.109 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 99983406ef0086522602b03f6a0ced605347721777f81799a03acb9bb16d8e48

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: LHLx535dnhNbFu7lEELcVKiJo0IEIOpL
via: 1.1 varnish
etag: "d99c886a4c773d606f807b3b4ed3bcaf"
age: 0
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 118948
x-amz-id-2: bgU+PLRzlUMOn5lvVJFdbbjtGvjmJDOtgG7D8uKHL90UJQgR8fcMI0gbe8Pic1oC/3fFaT+JJTU=
x-served-by: cache-fra19138-FRA
last-modified: Tue, 20 Jul 2021 06:59:21 GMT
server: AmazonS3
x-timer: S1626783957.832817,VS0,VE668
date: Tue, 20 Jul 2021 12:25:57 GMT
x-amz-request-id: 6WZB93M5C1VSKFND
cache-control: max-age=86401
accept-ranges: bytes
content-type: image/png
x-cache-hits: 1

GET
H2 200 Coinbase-Dogecoin-1.jpg
en.cryptonomist.ch/wp-content/uploads/2021/07/ 38 KB
39 KB 97ms
43ms Image
image/jpeg 2606:4700:3031::6815:1f21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://en.cryptonomist.ch/wp-content/uploads/2021/07/Coinbase-Dogecoin-1.jpg

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::6815:1f21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41cc00cdd89e57c3642515cb75ce51a7547713f3b8e649d7d6bc738750960064

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:56 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 10202
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 39404
expires: Thu, 19 Aug 2021 09:35:54 GMT
last-modified: Tue, 20 Jul 2021 09:34:53 GMT
server: cloudflare
etag: "60f698bd-99ec"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=czxF0Z87xMCX4yu%2FQlm4rVSu1JYSBhNI3KkKGQsb3Zq%2BzqdVJZv1rb9IUxprsJdaOsQNlcDv9mFLjyw9ky%2Fs58yjzW3eYHfX1bWvqEC2%2Faerw5Dhke2XUDLxrtLngXYhhMa7r%2F1LMR0BhJBShrulHik%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: https://en.cryptonomist.ch
vary: Accept-Encoding
cache-control: max-age=2592000, max-age=31536000
accept-ranges: bytes
cf-ray: 671c2cd27c642bc2-FRA
cf-bgj: h2pri

GET
H2 200 Samsung-Galaxy-S21-Ultra-back-in-hand-1.jpg
cdn57.androidauthority.net/wp-content/uploads/2021/01/ 319 KB
320 KB 24ms
6ms Image
image/jpeg 94.31.29.250
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn57.androidauthority.net/wp-content/uploads/2021/01/Samsung-Galaxy-S21-Ultra-back-in-hand-1.jpg
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.250 , United Kingdom, ASN33438 (HIGHWINDS2, US),
Reverse DNS: 94.31.29.250.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 29cf8017e7feb7027456e22eec498f7a49e7f4a522c964c8fe77c3881545d0c0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:56 GMT
last-modified: Sun, 18 Apr 2021 22:37:42 GMT
server: NetDNA-cache/2.2
etag: "607cb4b6-4fd00"
vary: Accept
x-cache: HIT
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 326912
expires: Wed, 20 Jul 2022 12:14:06 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 9ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&ver=5.7.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://ondequando.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 18:26:24 GMT
x-content-type-options: nosniff
age: 64772
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 18:26:24 GMT

GET
H/1.1 200
OK fa-solid-900.woff2
ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/webfonts/ 74 KB
74 KB 427ms
236ms Font
application/octet-stream 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/webfonts/fa-solid-900.woff2
Requested by: Host: ondequando.com
URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/css/font-awesome.css?ver=5.7.2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: cd398be1a91817126cef10224738e624358edf6f08043abad7e60c1aaeccc8d0

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://ondequando.com
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/css/font-awesome.css?ver=5.7.2
Connection: keep-alive
Origin: https://ondequando.com
Referer: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/css/font-awesome.css?ver=5.7.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "126b0-5baeb734c1480"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 75440

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
16 KB 8ms
5ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&ver=5.7.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://ondequando.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:00:01 GMT
x-content-type-options: nosniff
age: 1555
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 12:00:01 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 16 KB
16 KB 9ms
7ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&ver=5.7.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://ondequando.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 17:17:27 GMT
x-content-type-options: nosniff
age: 587309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Jul 2022 17:17:27 GMT

GET
H/1.1 200
OK fa-regular-400.woff2
ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/webfonts/ 13 KB
14 KB 400ms
231ms Font
application/octet-stream 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/webfonts/fa-regular-400.woff2
Requested by: Host: ondequando.com
URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/css/font-awesome.css?ver=5.7.2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 6a16c04229bc2b4da226eb97e68d94f49ba6437b7b5e16c14a101b21a29384e9

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://ondequando.com
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/css/font-awesome.css?ver=5.7.2
Connection: keep-alive
Origin: https://ondequando.com
Referer: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/css/font-awesome.css?ver=5.7.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "350c-5baeb734c1480"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 13580

GET
H2 200 keto-diet-fb-banner-1.jpg
customketodiet.com/uploads/banners/en/ 220 KB
221 KB 67ms
42ms Image
image/jpeg 2606:4700:20::681a:276
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://customketodiet.com/uploads/banners/en/keto-diet-fb-banner-1.jpg
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:276 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bf338602193a1ec3cc1ecf26b314d4ca247d13fd78a76657f453a8658830c8a3

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:56 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=240940
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 225534
last-modified: Mon, 16 Dec 2019 09:13:49 GMT
server: cloudflare
etag: "e60f2-3ad2c-599cea1272ab9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G911razy27T0Q8whR%2BBVsbjoH6qVBFUE7op8bv8Mkqa0JrQOkogeIpoaBVyppOMHMRmvOtFsfYQveJQN94wJOjBbyX4QwU%2BYCGEldWAELChfPB%2FawbKVhRV1qY2bAwfe8q3tZ2Z8%2BP0cJKm1Tobh3A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 671c2cd28bc70614-FRA
cf-bgj: imgq:100,h2pri

POST
H/1.1 200
OK /
ondequando.com/ 15 B
305 B 1460ms
1460ms Ping
text/html 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache / PHP/7.4.11
Resource Hash: 88aaa00ed63445a1d87d9d2c4473d0b8ed19a8365c8fdfa5b4ce13580229fcc7

Request headers

Sec-Fetch-Mode: no-cors
Origin: https://ondequando.com
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Sec-Fetch-Dest: empty
Cookie: _ga_28P0FD8DZ8=GS1.1.1626783957.1.0.1626783957.0; _ga=GA1.1.572248462.1626783957
Connection: keep-alive
Content-Length: 714
Pragma: no-cache
Host: ondequando.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH1cBrwxo81W7rrU3
Accept: */*
Cache-Control: no-cache
Referer: https://ondequando.com/
Sec-Fetch-Site: same-origin
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH1cBrwxo81W7rrU3

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Server: Apache
X-Powered-By: PHP/7.4.11
X-Nitro-Beacon: FORWARD
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache
X-Nitro-Proxy-Purge: true
Connection: Keep-Alive
Keep-Alive: timeout=5, max=94
Content-Length: 15

GET
H/1.1 200
OK fashion3.jpg
ondequando.com/wp-content/uploads/2021/02/ 275 KB
275 KB 236ms
235ms Image
image/jpeg 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ondequando.com/wp-content/uploads/2021/02/fashion3.jpg
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 8ca82708deb53fb3752e69904826d70c4d303a60186b5a06c94a497e54ff9344

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://ondequando.com/
Cookie: _ga_28P0FD8DZ8=GS1.1.1626783957.1.0.1626783957.0; _ga=GA1.1.572248462.1626783957
Connection: keep-alive
Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Tue, 09 Feb 2021 18:29:18 GMT
Server: Apache
ETag: "44bc3-5baeb76df9b80"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 281539

GET
H/1.1 200
OK fa-brands-400.woff2
ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/webfonts/ 73 KB
73 KB 362ms
233ms Font
application/octet-stream 179.188.52.153
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/webfonts/fa-brands-400.woff2
Requested by: Host: ondequando.com
URL: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/css/font-awesome.css?ver=5.7.2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 179.188.52.153 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS: vpshost4091.publiccloud.com.br
Software: Apache /
Resource Hash: 1f49b8706547682e2c5ed6642a2f2dcbd287da458314b967c60d774aa7edb473

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://ondequando.com
Accept-Encoding: gzip, deflate, br
Host: ondequando.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/css/font-awesome.css?ver=5.7.2
Connection: keep-alive
Origin: https://ondequando.com
Referer: https://ondequando.com/wp-content/themes/magazinenp/assets/vendor/font-awesome/css/font-awesome.css?ver=5.7.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 12:25:33 GMT
Last-Modified: Tue, 09 Feb 2021 18:28:18 GMT
Server: Apache
ETag: "1230c-5baeb734c1480"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 74508

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210712/r20190131/ 244 KB
90 KB 44ms
30ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210712/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6047861554805866&plah=ondequando.com&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e5ecfcec3e27fe9897118aabcbd06b14a055e27fdff3fbfd82e4b35336c3f7fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 92395
x-xss-protection: 0
server: cafe
etag: 7826786853314341384
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 20 Jul 2021 12:25:56 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/ Frame A4F8 10 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210712/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ondequando.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ondequando.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 20 Jul 2021 04:16:37 GMT
expires: Tue, 03 Aug 2021 04:16:37 GMT
content-type: text/html; charset=ISO-8859-7
etag: 15579341980913220427
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4579
x-xss-protection: 0
age: 29359
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 56ms
41ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-189729766-1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-28P0FD8DZ8

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cedbe4172f9b07ffce42070f81251af7ab3fc0d3bc5f49e46888f3aa06d8bdfe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:57 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39715
x-xss-protection: 0
last-modified: Tue, 20 Jul 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 20 Jul 2021 12:25:57 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 18ms
10ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-189729766-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 1119
date: Tue, 20 Jul 2021 12:07:18 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Tue, 20 Jul 2021 14:07:18 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
73 B 13ms
12ms Ping
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-28P0FD8DZ8&gtm=2oe7j0&_p=1884704555&sr=1600x1200&ul=en-us&cid=572248462.1626783957&_s=1&dl=https%3A%2F%2Fondequando.com%2F&dt=ondequando%20-%20every%20news%20you%20want&sid=1626783957&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-28P0FD8DZ8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:57 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ondequando.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 204 B
659 B 36ms
15ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=ondequando.com&callback=_gfp_s_&client=ca-pub-6047861554805866

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210712/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6047861554805866&plah=ondequando.com&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

8ff3cc1fa2ce18f109e6332945beecffbead0cf2b99041ce6facfa98c4a15cef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 193
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 39ms
14ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=ondequando.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 20 Jul 2021 12:25:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 39ms
15ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=ondequando.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 20 Jul 2021 12:25:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B7F4 94 KB
27 KB 369ms
355ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&adk=1812271804&adf=3025194257&lmt=1626783957&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fondequando.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783956914&bpp=5&bdt=1551&idt=318&shv=r20210712&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4379787723602&frm=20&pv=2&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=352

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a6781d697ce6a9cdd009991f9c23e9051714ccec7d44c13927369b458b1fb7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6047861554805866&output=html&adk=1812271804&adf=3025194257&lmt=1626783957&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fondequando.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783956914&bpp=5&bdt=1551&idt=318&shv=r20210712&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4379787723602&frm=20&pv=2&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=352
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ondequando.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ondequando.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 20 Jul 2021 12:25:57 GMT
server: cafe
content-length: 27641
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Tue, 20-Jul-2021 12:40:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:57 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 35ms
13ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee07009e9fe79b9909bafdb282106c95dac83f905c6ac665e1257ac862ed50e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:57 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626434913869424"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28061
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:25:57 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 35ms
13ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&aip=1&a=1884704555&t=pageview&_s=1&dl=https%3A%2F%2Fondequando.com%2F&ul=en-us&de=UTF-8&dt=ondequando%20-%20every%20news%20you%20want&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACUABBAAAAC~&jid=242594765&gjid=193782834&cid=572248462.1626783957&tid=UA-189729766-1&_gid=403865495.1626783957&_r=1&gtm=2ou7j0&did=dZTNiMT&z=1385211620

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:57 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ondequando.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210712/r20190131/ 144 KB
52 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210712/r20190131/reactive_library_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

beeb3034dc9ef41ff7c3b82a8f7df118fa46581fe24702196ead6b49d9217b27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52918
x-xss-protection: 0
server: cafe
etag: 5138967520495652988
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Jul 2021 12:25:57 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 28ms
14ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=ondequando.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 20 Jul 2021 12:25:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 29ms
15ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=ondequando.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 20 Jul 2021 12:25:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 226B 70 KB
25 KB 744ms
743ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=472073290&adf=2330585139&pi=t.aa~a.3817703234~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=3&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0&nras=2&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=1296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=M7jxOLt4kW&p=https%3A//ondequando.com&dtd=24

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e9a5501e7bf12574279eba4363d517cf7e73b55156446f65b12f5d7874cc0a70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=472073290&adf=2330585139&pi=t.aa~a.3817703234~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=3&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0&nras=2&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=1296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=M7jxOLt4kW&p=https%3A//ondequando.com&dtd=24
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ondequando.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ondequando.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 20 Jul 2021 12:25:58 GMT
server: cafe
content-length: 25347
x-xss-protection: 0
set-cookie: IDE=AHWqTUlah6-45-1yowZXpr8VESKwTBKJ2dM7D0M2R9M1J32UJ_L0r6voTQ1OfXcHFCQ; expires=Sun, 14-Aug-2022 12:25:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:58 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 03D8 56 KB
24 KB 799ms
799ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3828852411&adf=346089256&pi=t.aa~a.1421695759~rp.4&w=947&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=947x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280&nras=3&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=75&ady=1618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=pb3qJyBEdn&p=https%3A//ondequando.com&dtd=31

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d4fb515f61558f8d6347fb3bec9e43cc94a3dededdb1abc1845af203314ef51b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3828852411&adf=346089256&pi=t.aa~a.1421695759~rp.4&w=947&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=947x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280&nras=3&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=75&ady=1618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=pb3qJyBEdn&p=https%3A//ondequando.com&dtd=31
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ondequando.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ondequando.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 20 Jul 2021 12:25:58 GMT
server: cafe
content-length: 24833
x-xss-protection: 0
set-cookie: IDE=AHWqTUmUD3sqfrt3KNmN3q8DbrOeqrfKkuYrYQ8F4Nirmt0k8TmrCmb1Z-a6QaGsu3g; expires=Sun, 14-Aug-2022 12:25:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:58 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 496B 109 KB
35 KB 687ms
687ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=651220815&adf=2407669957&pi=t.aa~a.2618034162~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280&nras=4&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=2069&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=oEOeuwDnkZ&p=https%3A//ondequando.com&dtd=37

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e2dfb831202ab583e5140739b58d3bd1c3a2897ab1a4bc0a61bb9bda3710ff92

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CND7vL_S8fECFU0E4AodxogLkg&gqi=1cD2YLn6M97K7_UPudm7UA&layout=/sadbundle/%24csp%253Der3%24/3857642822384818841/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=651220815&adf=2407669957&pi=t.aa~a.2618034162~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280&nras=4&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=2069&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=oEOeuwDnkZ&p=https%3A//ondequando.com&dtd=37
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ondequando.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ondequando.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CND7vL_S8fECFU0E4AodxogLkg&gqi=1cD2YLn6M97K7_UPudm7UA&layout=/sadbundle/%24csp%253Der3%24/3857642822384818841/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 20 Jul 2021 12:25:58 GMT
server: cafe
content-length: 35847
x-xss-protection: 0
set-cookie: IDE=AHWqTUlzukVPmwp43Iqki1Qfu2edzTfnLiMcYMefYZz-P97HeBAY-mZZgwp1Bz2T3G8; expires=Sun, 14-Aug-2022 12:25:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:58 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2696 110 KB
35 KB 1011ms
1011ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3160215234&adf=2049820743&pi=t.aa~a.2560532834~rp.4&w=947&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=947x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280&nras=5&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=75&ady=2402&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=wisURkTwgi&p=https%3A//ondequando.com&dtd=41

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

276a16a80fbc4e1d4cc2b7519af58b07356eb23f0ff74ff5752e0bda14f63086

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJiYvb_S8fECFYk14Aody0sPug&gqi=1cD2YM-UNPqh7_UPv_6GgAM&layout=/sadbundle/%24csp%253Der3%24/6024863510128231961/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3160215234&adf=2049820743&pi=t.aa~a.2560532834~rp.4&w=947&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=947x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280&nras=5&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=75&ady=2402&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=wisURkTwgi&p=https%3A//ondequando.com&dtd=41
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ondequando.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ondequando.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJiYvb_S8fECFYk14Aody0sPug&gqi=1cD2YM-UNPqh7_UPv_6GgAM&layout=/sadbundle/%24csp%253Der3%24/6024863510128231961/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 20 Jul 2021 12:25:58 GMT
server: cafe
content-length: 35949
x-xss-protection: 0
set-cookie: IDE=AHWqTUkc2K_KnIrKTuVROp-JvszBMbW8rTa2a5yct4uhjE6gF-o9sa-kjAdUrNtlgEc; expires=Sun, 14-Aug-2022 12:25:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:58 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame CF83 85 KB
26 KB 634ms
634ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3862781926&adf=1775375230&pi=t.aa~a.4198048424~rp.1&w=991&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=991x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280&nras=6&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=53&ady=3296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=Nwpj28KFaH&p=https%3A//ondequando.com&dtd=46

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4821efbb365f98b9800907f50ab15ddb3b93b0f1e81f81cb5da717977203f31

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKbEvb_S8fECFclA4AodticOkQ&gqi=1cD2YK63NJWS7_UP8aS5wAc&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3862781926&adf=1775375230&pi=t.aa~a.4198048424~rp.1&w=991&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=991x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280&nras=6&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=53&ady=3296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=Nwpj28KFaH&p=https%3A//ondequando.com&dtd=46
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ondequando.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ondequando.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKbEvb_S8fECFclA4AodticOkQ&gqi=1cD2YK63NJWS7_UP8aS5wAc&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 20 Jul 2021 12:25:58 GMT
server: cafe
content-length: 26894
x-xss-protection: 0
set-cookie: IDE=AHWqTUnEnQVm5IBGgX08PhyVHr8GdarKBnOn8czCGpXmXaThYxq-wcJ5Nt9Lv1mgHME; expires=Sun, 14-Aug-2022 12:25:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:58 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C81C 60 KB
24 KB 406ms
406ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=2335843837&adf=1207670937&pi=t.aa~a.3775770939~rp.4&w=487&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=487x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280&nras=7&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=3500&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=SfBAjp0a9Z&p=https%3A//ondequando.com&dtd=50

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a3c29f0c95c05e40b01032aa3667d9a109f5eba5dd9fe585506b4d2d871b196

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=2335843837&adf=1207670937&pi=t.aa~a.3775770939~rp.4&w=487&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=487x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280&nras=7&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=3500&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=SfBAjp0a9Z&p=https%3A//ondequando.com&dtd=50
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ondequando.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ondequando.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 20 Jul 2021 12:25:58 GMT
server: cafe
content-length: 24607
x-xss-protection: 0
set-cookie: IDE=AHWqTUkpxxey1tYzMUG2dtCWp9VQ6bxwuWZgtcypAH8cUdTBHJ1V9TiurBHGPxzUsWI; expires=Sun, 14-Aug-2022 12:25:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:58 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AA8F 109 KB
35 KB 501ms
501ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=90&adk=3403801137&adf=436985940&pi=t.aa~a.1188756047~rp.4&w=977&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=977x90&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=2&bdt=2443&idt=2&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280%2C487x280&nras=8&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=60&ady=4517&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=7&fsb=1&xpc=boah1urc7z&p=https%3A//ondequando.com&dtd=56

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

27486204566d22226bf08f48892760acda399a742aa746f69ffc7e784588dcff

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPKLvr_S8fECFbDBEQgd_WwPhw&gqi=1cD2YKaHNZjl7_UPqIWJoAc&layout=/sadbundle/%24csp%253Der3%24/7339872129542829077/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6047861554805866&output=html&h=90&adk=3403801137&adf=436985940&pi=t.aa~a.1188756047~rp.4&w=977&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=977x90&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=2&bdt=2443&idt=2&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280%2C487x280&nras=8&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=60&ady=4517&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=7&fsb=1&xpc=boah1urc7z&p=https%3A//ondequando.com&dtd=56
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ondequando.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ondequando.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPKLvr_S8fECFbDBEQgd_WwPhw&gqi=1cD2YKaHNZjl7_UPqIWJoAc&layout=/sadbundle/%24csp%253Der3%24/7339872129542829077/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 20 Jul 2021 12:25:58 GMT
server: cafe
content-length: 35636
x-xss-protection: 0
set-cookie: IDE=AHWqTUmUxLaZnaVvGQ-LB4vyvb23N5mRkM4XFR9xqCoM8yxaNCF1ZCIfI7UL5VWVSlE; expires=Sun, 14-Aug-2022 12:25:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:58 GMT
cache-control: private

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=ondequando.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 20 Jul 2021 12:25:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=ondequando.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 20 Jul 2021 12:25:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/ Frame 89A7 10 KB
4 KB 6ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ondequando.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ondequando.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 20 Jul 2021 03:57:24 GMT
expires: Tue, 03 Aug 2021 03:57:24 GMT
content-type: text/html; charset=UTF-8
etag: 15579341980913220427
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4579
x-xss-protection: 0
age: 30513
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 89A7 0
0 17ms
17ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cgwj-1cD2YIePEo2Y-gaJnYmwDoqKtMthyrvg7boN8qXL4o4OEAEg7pWqgQFglQKgAZ2w7qEDyAECqQL3HCdRgsuzPqgDAcgDyQSqBLMBT9DNoQcp6pU7Vt1CyARDiHAfiQZgbI8Yb47caSGrKsU-NNizqsC3_P6QnMvFfzPNQRFMg6w5JexwWAH5d_R0R0hvlvdpwM2V__XLFagrkMfrL_O8NCxYM6Uu-hFygsD9wVV4Q7RrXjOr_gdvCQ3Xm0YunqcUb2Lpyo3zTLHxhoAmidkeNox_Ar1MdzfMX5YnukvIX-jXHrmSDIUZAPgJXCHsXwKMnWc2tUKZTGRFyBduQVfABJqZmsPrAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYCgAf1tJteqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEPb4RNIICQiA4YAQEAEYH4AKAcgLAdgTDNAVAYAXAbIXGgoYCAASFHB1Yi02MDQ3ODYxNTU0ODA1ODY2&sigh=YRvqLBxtgW8

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 20 Jul 2021 12:25:57 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:25:57 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/ Frame 89A7 18 KB
8 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8240ea20f4bb5fcc00f41228776b641b2128fccc99bc520497c13128a1fa304c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:21:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 241
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 6317884472378718772
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:21:56 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 89A7 2 KB
1 KB 34ms
12ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:23:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 149
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:23:28 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 89A7 124 KB
37 KB 31ms
15ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

743c8064e2b1f38a1b44de4d4ac3a99bb9c11a69a16360433076b5d93b815181

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:57 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626434926419779"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:25:57 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 89A7 14 KB
6 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6904dd3786abf2a13d9e3eebc371d27f65ffa4bae3d23ce1aa3f69b8b4962a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6221
x-xss-protection: 0
server: cafe
etag: 7452675974595557415
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:21 GMT

GET
H2 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 89A7 26 KB
11 KB 36ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a56c62be9652c7b6b85be1e24dab707f15623d73cde436958c4ef74e3b5b68d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 03:40:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31540
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10748
x-xss-protection: 0
server: cafe
etag: 11229175930449698035
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 03:40:17 GMT

GET
H2 200 16323101646619125957
tpc.googlesyndication.com/simgad/ Frame 89A7 24 KB
24 KB 33ms
13ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16323101646619125957?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qlnEW309WD12xLSGg3oh2RjgSGHeg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a2450a9523ba4d5b6d6dac5f7a86da5927b3e35e8592b57167636adca203d4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 07:14:33 GMT
x-content-type-options: nosniff
last-modified: Tue, 29 Jun 2021 11:22:38 GMT
server: sffe
age: 18684
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24820
x-xss-protection: 0
expires: Wed, 20 Jul 2022 07:14:33 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7683 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmZd9dWWJKZTjvgwmB8j7_ACzIYOxBJ4gKS7eRAhUoXWdYBn8xnLAfwtd4UZVQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 20 Jul 2021 12:16:24 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 573
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 89A7 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e7ecc7541c3f4b77619a8f7a13e2b97d8286b5e1752fec07cc440b7e93b23d67

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7683
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

15ms
14ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmZd9dWWJKZTjvgwmB8j7_ACzIYOxBJ4gKS7eRAhUoXWdYBn8xnLAfwtd4UZVQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:58 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 20-Jul-2021 12:26:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:58 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:58 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js Show response
pagead2.googlesyndication.com/bg/ Frame 77F5 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210712/r20190131/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1916d5a5a97048327e74b168dd38fe0067ac06db81f57f72108f23410cff79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:12:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 788
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Jul 2022 12:12:50 GMT

GET
H3-29 200 6693110880397976896
tpc.googlesyndication.com/simgad/ Frame C81C 13 KB
13 KB 24ms
9ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6693110880397976896?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qmjL8nDztjPD542PnfHba0TQGiQJw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=2335843837&adf=1207670937&pi=t.aa~a.3775770939~rp.4&w=487&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=487x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280&nras=7&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=3500&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=SfBAjp0a9Z&p=https%3A//ondequando.com&dtd=50

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6e7a70a04633375adce73fc0d2daad4617fd0103970e4b13a9a938c7db14d9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 01:26:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 07:57:52 GMT
server: sffe
age: 39546
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13641
x-xss-protection: 0
expires: Wed, 20 Jul 2022 01:26:52 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/ Frame C81C 18 KB
7 KB 27ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8240ea20f4bb5fcc00f41228776b641b2128fccc99bc520497c13128a1fa304c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:21:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 6317884472378718772
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:21:56 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame C81C 2 KB
1 KB 19ms
9ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:54 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C81C 124 KB
37 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

743c8064e2b1f38a1b44de4d4ac3a99bb9c11a69a16360433076b5d93b815181

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:58 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626434926419779"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:25:58 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame C81C 14 KB
6 KB 19ms
8ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6904dd3786abf2a13d9e3eebc371d27f65ffa4bae3d23ce1aa3f69b8b4962a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6221
x-xss-protection: 0
server: cafe
etag: 7452675974595557415
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:21 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame C81C 0
0 18ms
16ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQsBt7U6ji5_t6negtz1OBswyT-Df0jANFrwm3ki7MhOjDMFCxPgxfNCERaAmKQFeICLNzGZOEvmTcTEd_mldbO-FXLGQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=2335843837&adf=1207670937&pi=t.aa~a.3775770939~rp.4&w=487&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=487x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280&nras=7&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=3500&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=SfBAjp0a9Z&p=https%3A//ondequando.com&dtd=50
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame C81C 26 KB
11 KB 23ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a56c62be9652c7b6b85be1e24dab707f15623d73cde436958c4ef74e3b5b68d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 03:40:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31541
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10748
x-xss-protection: 0
server: cafe
etag: 11229175930449698035
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 03:40:17 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame C81C 0
0 20ms
19ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CJOCy1cD2YLytNduLx_AP1r2i6ALVi4DJY5iHw4eYDtrZHhABIO6VqoEBYJUCoAGGivDoA8gBAqgDAcgDyQSqBKoBT9Dt3QlOXMpiM0bOOg0fSxpmAWGeFMz6qYr66uJy3hT3szGHrv9TS4Vmk2IJ0duyOGK0oPQu8F09m6kAs2RzIWaow7ISytvdcX6kVBbaNE0xiib_vA6JVjJRSwWpN31SAq2Ree4RdSk_CbhFJjR-XYgvkO7mEjnzIdhlhlMszX-_KA-NEcoqiQrr8jehHZ2Xx9bhZTY3Be5DcB0YvkbB2CAA5wzNfHC7TszABI_h-8LFA5IFBAgEGAGSBQQIBRgEoAYCgAfi9Y8XqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEJDjedIICQiA4YAQEAEYH4AKAcgLAdgTAtAVAZgWAYAXAbIXGgoYCAASFHB1Yi02MDQ3ODYxNTU0ODA1ODY2&sigh=m2qykVGE7Ls

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=2335843837&adf=1207670937&pi=t.aa~a.3775770939~rp.4&w=487&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=487x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280&nras=7&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=3500&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=SfBAjp0a9Z&p=https%3A//ondequando.com&dtd=50
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 20 Jul 2021 12:25:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6C55 143 B
163 B 7ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=2335843837&adf=1207670937&pi=t.aa~a.3775770939~rp.4&w=487&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=487x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280&nras=7&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=3500&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=SfBAjp0a9Z&p=https%3A//ondequando.com&dtd=50
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUkpxxey1tYzMUG2dtCWp9VQ6bxwuWZgtcypAH8cUdTBHJ1V9TiurBHGPxzUsWI
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=2335843837&adf=1207670937&pi=t.aa~a.3775770939~rp.4&w=487&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=487x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280&nras=7&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=3500&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=SfBAjp0a9Z&p=https%3A//ondequando.com&dtd=50

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 20 Jul 2021 12:16:24 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 574
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 redir.html Show response
p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 25FF 247 B
807 B 51ms
15ms Document
text/html 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

47c3fa441133af75607d03448b95de43df4b6aba921c71e3e9a68055f8db06e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com
:scheme: https
:path: /v6exp3/redir.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-N5Vl066ZwCl52FluzUThhg' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
content-length: 205
date: Tue, 20 Jul 2021 12:25:58 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Mon, 02 Dec 2019 20:15:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2BDC 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 20 Jul 2021 11:56:19 GMT
expires: Wed, 21 Jul 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 1779
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame C81C 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 903503fef0e56dba480f01ad5236530913c604a000e3faf8f053a75d35779b33

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 iframe.html Show response
p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 25FF 4 KB
2 KB 29ms
14ms Document
text/html 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

561dd6ae411549407cbdb04459b7774cdca219e8dbbeddc16d2443eb12e43a31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com
:scheme: https
:path: /v6exp3/iframe.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-_OPg6f5F6-JZUBXaF-p7Cw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
content-length: 1863
date: Tue, 20 Jul 2021 12:25:58 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Thu, 29 Apr 2021 21:38:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dpixel
cms.quantserve.com/ Frame 2BDC 35 B
463 B 29ms
8ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEB4i6jWajVQW9NcM-CO3Xmw&google_cver=1&google_push=AYg5qPL21Ka1D3MrymcI8TN7TGo2VfnzwRE4_rE7QYtuQ8oSysKBJf-eS07Y1Qi09_Ebiz9nmZ1cPOp_hF8dvH_byJio2mYjR6UU

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:58 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2BDC
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPLIoJrIKOziEipngztFH-kDBtm4P_4dXypLsni...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVBiQTFnQUFCVEpHcFRoRQ&google_push=AYg5qPLIoJrIKOziEipngztFH-kDBtm4P_4dXypLsniJ3NrRsJHCUEuMESnvwfM-0jSBxA9ZWnZOYI-ORXoNP2QpZvqLXYbNJ2N-

170 B
188 B

19ms
19ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVBiQTFnQUFCVEpHcFRoRQ&google_push=AYg5qPLIoJrIKOziEipngztFH-kDBtm4P_4dXypLsniJ3NrRsJHCUEuMESnvwfM-0jSBxA9ZWnZOYI-ORXoNP2QpZvqLXYbNJ2N-

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVBiQTFnQUFCVEpHcFRoRQ&google_push=AYg5qPLIoJrIKOziEipngztFH-kDBtm4P_4dXypLsniJ3NrRsJHCUEuMESnvwfM-0jSBxA9ZWnZOYI-ORXoNP2QpZvqLXYbNJ2N-
Date: Tue, 20 Jul 2021 12:25:58 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 2BDC
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJCNpJV...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJCNpJV...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA3MjAxMjI1NTgwMDAxMTAxODQ2NDUxMg%3D%3D&google_push=AYg5qPJCNpJVNGpVFjYJUMOmONScEtwHf06CogKRjQnaiTeL3_wQnAao_Xqv39Pb0Q5VAw...

170 B
243 B

21ms
15ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA3MjAxMjI1NTgwMDAxMTAxODQ2NDUxMg%3D%3D&google_push=AYg5qPJCNpJVNGpVFjYJUMOmONScEtwHf06CogKRjQnaiTeL3_wQnAao_Xqv39Pb0Q5VAwV0k-K7VspZNFVsqhFEAO-px6FWkQX2

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA3MjAxMjI1NTgwMDAxMTAxODQ2NDUxMg%3D%3D&google_push=AYg5qPJCNpJVNGpVFjYJUMOmONScEtwHf06CogKRjQnaiTeL3_wQnAao_Xqv39Pb0Q5VAwV0k-K7VspZNFVsqhFEAO-px6FWkQX2
pragma: no-cache
date: Tue, 20 Jul 2021 12:25:58 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Tue, 20 Jul 2021 12:25:58 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2BDC
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEF2xCUlcN7CTrwYURCJ0c3A&google_cver=1&google_push=AYg5qPLV_RugGLgovo9l3gmV3dOf9JK4O35xar3kA_fdgaJ0zgMKDGI31oxOQOmfCGQYAHALoj73ohMyY6LGe7mySY9tFzhsGHp_
https://rtb.openx.net/sync/dds?google_gid=CAESEF2xCUlcN7CTrwYURCJ0c3A&google_cver=1&google_push=AYg5qPLV_RugGLgovo9l3gmV3dOf9JK4O35xar3kA_fdgaJ0zgMKDGI31oxOQOmfCGQYAHALoj73ohMyY6LGe7mySY9tFzhsGHp_&...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLV_RugGLgovo9l3gmV3dOf9JK4O35xar3kA_fdgaJ0zgMKDGI31oxOQOmfCGQYAHALoj73ohMyY6LGe7mySY9tFzhsGHp_&google_hm=5lDSosNMzCIZP4WQ3J9mgQ==

170 B
188 B

53ms
38ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLV_RugGLgovo9l3gmV3dOf9JK4O35xar3kA_fdgaJ0zgMKDGI31oxOQOmfCGQYAHALoj73ohMyY6LGe7mySY9tFzhsGHp_&google_hm=5lDSosNMzCIZP4WQ3J9mgQ==

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:57 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLV_RugGLgovo9l3gmV3dOf9JK4O35xar3kA_fdgaJ0zgMKDGI31oxOQOmfCGQYAHALoj73ohMyY6LGe7mySY9tFzhsGHp_&google_hm=5lDSosNMzCIZP4WQ3J9mgQ==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 8jdi885083r48c9dc3h71omc2t6gfucq

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2BDC
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_kbEnL4FTqe5Q1vWjPZjQQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

16ms
16ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_kbEnL4FTqe5Q1vWjPZjQQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPI7ElHNnZTbDj4lOZ1MDGfO_Rnn9x-8tbKsRp-QtCJtTcsCwfndeTW2YHBC9YAXkW4h1UsiJPSqKKXGbmi7u1NKllPI__cx

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_kbEnL4FTqe5Q1vWjPZjQQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPI7ElHNnZTbDj4lOZ1MDGfO_Rnn9x-8tbKsRp-QtCJtTcsCwfndeTW2YHBC9YAXkW4h1UsiJPSqKKXGbmi7u1NKllPI__cx
date: Tue, 20 Jul 2021 12:25:57 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2BDC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBlKMxo9mlFaCyNLP7-Hj7Y&google_cver=1&google_push=AYg5qPLxgPVJ4WYeHp-ljEeSl24hNSDzItZWnN5KtWjILNYmqAFlVK2HvuxjaeXYDeJ21ul3Qiv...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JDMTVaVTktMVItNVBCTQ==&google_push=AYg5qPLxgPVJ4WYeHp-ljEeSl24hNSDzItZWnN5KtWjILNYmqAFlVK2HvuxjaeXYDeJ21ul3QivYE-cHZPk5w26_hjNb4Rzfv0N-

170 B
188 B

25ms
16ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JDMTVaVTktMVItNVBCTQ==&google_push=AYg5qPLxgPVJ4WYeHp-ljEeSl24hNSDzItZWnN5KtWjILNYmqAFlVK2HvuxjaeXYDeJ21ul3QivYE-cHZPk5w26_hjNb4Rzfv0N-

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JDMTVaVTktMVItNVBCTQ==&google_push=AYg5qPLxgPVJ4WYeHp-ljEeSl24hNSDzItZWnN5KtWjILNYmqAFlVK2HvuxjaeXYDeJ21ul3QivYE-cHZPk5w26_hjNb4Rzfv0N-
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 2BDC
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6L...

0
0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 2BDC 0
253 B 44ms
14ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IYT-rGVv6bXqtFwECL1m4Wmjlf5PezZOaiXttvvOsjwGGvC1YvHZnc2pwUY1C0aJ43bqk8

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:58 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6C55
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

15ms
15ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUmUxLaZnaVvGQ-LB4vyvb23N5mRkM4XFR9xqCoM8yxaNCF1ZCIfI7UL5VWVSlE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:58 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 20-Jul-2021 13:25:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:58 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:58 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/ Frame 75DA 2 KB
1 KB 7ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/index.html

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

406075ccf8524e6303e954e8d3147a67a0836fd8203eebfc952dbeaaf7bd99ea

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/7339872129542829077/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1162
date: Tue, 20 Jul 2021 07:41:03 GMT
expires: Wed, 20 Jul 2022 07:41:03 GMT
last-modified: Thu, 15 Apr 2021 13:48:12 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
age: 17095
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4986 0
0 20ms
17ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CIMHf1cD2YLLNNbCDx_AP_dm9uAj804rCY4Of0s7dDejHlZhDEAEg7pWqgQFglQKgAf-Ere0DyAEJqAMByANIqgSsAU_Q3zaAibr1m1YqmnzVmyXwbHsxOddCqph8apVK9tNZDfj0poN8qi7-IfQ4iQDGWOUehLBb0fYUmKPeoYPIW4FKLd8B5dPAq37RUKEcyERPTyCildcEghKFi5FG7O9qW3TOS6tTF0eBias3-6qLuzLCyUPnWZ9r8kh5N9SAZzV11nnSMD-8eVfS1jGxb8fCA4JDIXXC9FYjUMTLf2uZPU34tnXOqTmW8IuZ9ufABISAx8L4ApIFBAgEGAGSBQQIBRgEoAYugAeS-5odqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEMeJM9IICQiA4YAQEAEYH4AKAcgLAdgTDNAVAYAXAbIXGgoYCAASFHB1Yi02MDQ3ODYxNTU0ODA1ODY2&sigh=3rFBSgE2AG4&template_id=419

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=90&adk=3403801137&adf=436985940&pi=t.aa~a.1188756047~rp.4&w=977&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=977x90&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=2&bdt=2443&idt=2&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280%2C487x280&nras=8&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=60&ady=4517&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=7&fsb=1&xpc=boah1urc7z&p=https%3A//ondequando.com&dtd=56
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 20 Jul 2021 12:25:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/ Frame 4986 18 KB
7 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=90&adk=3403801137&adf=436985940&pi=t.aa~a.1188756047~rp.4&w=977&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=977x90&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=2&bdt=2443&idt=2&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280%2C487x280&nras=8&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=60&ady=4517&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=7&fsb=1&xpc=boah1urc7z&p=https%3A//ondequando.com&dtd=56

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8240ea20f4bb5fcc00f41228776b641b2128fccc99bc520497c13128a1fa304c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:21:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 6317884472378718772
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:21:56 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 4986 2 KB
1 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:54 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4986 124 KB
37 KB 17ms
15ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

743c8064e2b1f38a1b44de4d4ac3a99bb9c11a69a16360433076b5d93b815181

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:58 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626434926419779"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:25:58 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 4986 14 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6904dd3786abf2a13d9e3eebc371d27f65ffa4bae3d23ce1aa3f69b8b4962a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6221
x-xss-protection: 0
server: cafe
etag: 7452675974595557415
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:21 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 4986 0
0 17ms
15ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTHhCfXc2bfBRR9dcOlwt_uTxKmQszyrTsxa9q9Lg-8g_eLMd4g_FlqAcH2SGV5UXg5id-mbDauTeMWLjXsK_cITs4SaQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=90&adk=3403801137&adf=436985940&pi=t.aa~a.1188756047~rp.4&w=977&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=977x90&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=2&bdt=2443&idt=2&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280%2C487x280&nras=8&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=60&ady=4517&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=7&fsb=1&xpc=boah1urc7z&p=https%3A//ondequando.com&dtd=56
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame FD3B 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=90&adk=3403801137&adf=436985940&pi=t.aa~a.1188756047~rp.4&w=977&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=977x90&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=2&bdt=2443&idt=2&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280%2C487x280&nras=8&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=60&ady=4517&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=7&fsb=1&xpc=boah1urc7z&p=https%3A//ondequando.com&dtd=56
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUmUxLaZnaVvGQ-LB4vyvb23N5mRkM4XFR9xqCoM8yxaNCF1ZCIfI7UL5VWVSlE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=90&adk=3403801137&adf=436985940&pi=t.aa~a.1188756047~rp.4&w=977&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=977x90&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=2&bdt=2443&idt=2&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280%2C991x280%2C487x280&nras=8&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=60&ady=4517&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=7&fsb=1&xpc=boah1urc7z&p=https%3A//ondequando.com&dtd=56

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 20 Jul 2021 12:16:24 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 574
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 75DA 9 KB
3 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 23:05:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48010
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 20 Jul 2021 23:05:48 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 75DA 26 KB
10 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 18:31:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64485
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 20 Jul 2021 18:31:13 GMT

GET
H2 200 createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 75DA 186 KB
48 KB 38ms
16ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49100
x-xss-protection: 0
last-modified: Wed, 16 Mar 2016 13:51:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 20 Jul 2021 12:25:58 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ Frame 75DA 84 KB
29 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:11:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 867
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 12:11:31 GMT

GET
H3-29 200 index.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/ Frame 75DA 234 KB
52 KB 11ms
9ms Script
application/x-javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/index.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7339872129542829077/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7442bdc19b28d69a3c440ac966444e5a94f209b2441102de9395dd282f223275

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17095
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53688
x-xss-protection: 0
last-modified: Thu, 15 Apr 2021 13:48:12 GMT
server: sffe
date: Tue, 20 Jul 2021 07:41:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 07:41:03 GMT

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame 4986 0
20 B 58ms
44ms Other
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPKLvr_S8fECFbDBEQgd_WwPhw&gqi=1cD2YKaHNZjl7_UPqIWJoAc&layout=/sadbundle/%24csp%253Der3%24/7339872129542829077/index.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 4986 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ffc9421da7060c0407a14a74ada1902a7cd5571c16340451eda1ae0d3d4b8a67

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js Show response
pagead2.googlesyndication.com/bg/ Frame 9F8D 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1916d5a5a97048327e74b168dd38fe0067ac06db81f57f72108f23410cff79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:12:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 788
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Jul 2022 12:12:50 GMT

GET
H3-29 200 ssrh.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame CF83 84 KB
29 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/ssrh.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3862781926&adf=1775375230&pi=t.aa~a.4198048424~rp.1&w=991&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=991x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280&nras=6&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=53&ady=3296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=Nwpj28KFaH&p=https%3A//ondequando.com&dtd=46

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b5312cb2f154f2bd64ee8746195a63df254d10bfd107a61eec3d5d38dd48bff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 22:20:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50718
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30063
x-xss-protection: 0
server: cafe
etag: 16132151104434394549
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 20 Jul 2021 22:20:40 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame FD3B
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

14ms
14ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUmUD3sqfrt3KNmN3q8DbrOeqrfKkuYrYQ8F4Nirmt0k8TmrCmb1Z-a6QaGsu3g
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:58 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 20-Jul-2021 13:25:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:58 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:58 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 css
fonts.googleapis.com/ Frame 226B 3 KB
674 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=472073290&adf=2330585139&pi=t.aa~a.3817703234~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=3&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0&nras=2&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=1296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=M7jxOLt4kW&p=https%3A//ondequando.com&dtd=24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 20 Jul 2021 10:26:50 GMT
server: ESF
date: Tue, 20 Jul 2021 12:25:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 20 Jul 2021 12:25:58 GMT

GET
H3-29 200 exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js Show response
pagead2.googlesyndication.com/bg/ Frame 75DA 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1916d5a5a97048327e74b168dd38fe0067ac06db81f57f72108f23410cff79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:12:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 788
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Jul 2022 12:12:50 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 226B 1 KB
861 B 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:21:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 257
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 830
x-xss-protection: 0
server: cafe
etag: 3558876194914413708
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:21:41 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/ Frame 226B 18 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8240ea20f4bb5fcc00f41228776b641b2128fccc99bc520497c13128a1fa304c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:21:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 6317884472378718772
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:21:56 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 226B 2 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:54 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 226B 124 KB
37 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

743c8064e2b1f38a1b44de4d4ac3a99bb9c11a69a16360433076b5d93b815181

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:58 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626434926419779"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:25:58 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 226B 14 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6904dd3786abf2a13d9e3eebc371d27f65ffa4bae3d23ce1aa3f69b8b4962a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6221
x-xss-protection: 0
server: cafe
etag: 7452675974595557415
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:21 GMT

GET
H2 200 4661e2b537cafc373934756b83790a75.js Show response
www.gstatic.com/mysidia/ Frame 226B 26 KB
11 KB 29ms
8ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/4661e2b537cafc373934756b83790a75.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d450db79b0f7039b6486a399d93ebe1efa7a81e0f7b1170931b8b3dddf4a31d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Jul 2021 11:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 435930
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10780
x-xss-protection: 0
last-modified: Thu, 15 Jul 2021 11:10:31 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 13 Oct 2021 11:20:28 GMT

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/ Frame 7AC1 3 KB
3 KB 9ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d125872944107e62b360bd1c4472ca833c0b113ef2b51270b31e1cdcb3312982

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/3857642822384818841/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1369
date: Tue, 20 Jul 2021 11:13:51 GMT
expires: Wed, 20 Jul 2022 11:13:51 GMT
last-modified: Thu, 15 Apr 2021 13:44:52 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
age: 4327
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 adview
googleads.g.doubleclick.net/pagead/ Frame A356 0
0 16ms
16ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cq-4t1cD2YJC9NM2IgAfGka6QCfzTisJjrqqWy80N6MeVmEMQASDulaqBAWCVAqAB_4St7QPIAQmoAwHIA0iqBK0BT9CIW_K8208z2A10Sds1FzPwL4feTiMfl38iIZu8rMc5wbInDRl0JTz-KaGac6fGvomqAMEKJ4Pws7pOlqavFfLLb74dDfduPJZ9Kye_6DQfsF8YVDC2CC1RrJ89qgXd8R3iezjbSJ_ndcKP_5E-F_jwcFq1l3ct_tHu08WlRtIYufqcXt4e0-g-ND5GVTP6_l_36gPqt9JV3uReItEjIBuvUvWsDbzQH1kCxFPABISAx8L4ApIFBAgEGAGSBQQIBRgEoAYugAeS-5odqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEPDDI9IICQiA4YAQEAEYH4AKAcgLAdgTDNAVAYAXAbIXGgoYCAASFHB1Yi02MDQ3ODYxNTU0ODA1ODY2&sigh=PTmmKW7RIg0&template_id=419

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=651220815&adf=2407669957&pi=t.aa~a.2618034162~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280&nras=4&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=2069&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=oEOeuwDnkZ&p=https%3A//ondequando.com&dtd=37
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 20 Jul 2021 12:25:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:25:58 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/ Frame A356 18 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=651220815&adf=2407669957&pi=t.aa~a.2618034162~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280&nras=4&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=2069&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=oEOeuwDnkZ&p=https%3A//ondequando.com&dtd=37

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8240ea20f4bb5fcc00f41228776b641b2128fccc99bc520497c13128a1fa304c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:21:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 6317884472378718772
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:21:56 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame A356 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:23:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 150
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:23:28 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A356 124 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

743c8064e2b1f38a1b44de4d4ac3a99bb9c11a69a16360433076b5d93b815181

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:58 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626434926419779"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:25:58 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame A356 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6904dd3786abf2a13d9e3eebc371d27f65ffa4bae3d23ce1aa3f69b8b4962a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6221
x-xss-protection: 0
server: cafe
etag: 7452675974595557415
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:21 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame A356 0
0 15ms
14ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTpdsCGMuEL8lOaLI-sew6U98zdo2dhjOxJfLsJhKXg1GX8IWcU1Rw1oHHuShDHu_gGXVYySBW_eRSq89nB3ckemVn9XQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=651220815&adf=2407669957&pi=t.aa~a.2618034162~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280&nras=4&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=2069&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=oEOeuwDnkZ&p=https%3A//ondequando.com&dtd=37
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 adview
googleads.g.doubleclick.net/pagead/ Frame 226B 0
0 17ms
17ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CGu2m1cD2YN7eM9mx-gaP6oKgBtu4u-tjzZek2L4Nn9WxlI8OEAEg7pWqgQFglQKgAbuarNwCyAEBqQLFf4M9EcGzPqgDAcgDwwSqBK8BT9BfE8yh1KrQCi0TooKJXIBhx2j8uNNkTRt-TVFAmnYjHWb--HGooNilJCJX7PLnHaxiI2XpfGbzpPd-M6bBaNFyvsuuikLIiJNDdKMufYsyegTNVfdvSxUoEGTcR8HFSopUrBZKQTaT3R_dudjJPnThZQG8OQ4fhNKhuxXMIhD4rOZMcGhct68WroEZqpvlGOn8udeEOfHxiP4cf91hu3b3HDwOVj5Alswx7oq3bsAEmum-uccDkgUECAQYAZIFBAgFGASgBlGAB63l06MBqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEMTXXtIICQiA4YAQEAEYH4AKAcgLAdgTDNAVAYAXAbIXGgoYCAASFHB1Yi02MDQ3ODYxNTU0ODA1ODY2&sigh=UYfS97sYmOc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=472073290&adf=2330585139&pi=t.aa~a.3817703234~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=3&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0&nras=2&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=1296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=M7jxOLt4kW&p=https%3A//ondequando.com&dtd=24
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 20 Jul 2021 12:25:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:25:58 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9A35 0
0 69ms
44ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstkVnMSnMhKIKClwiHUebU7hebzP8wKqdHggnxgdX_nPyG4pkrYGeEjYuvwjISxU40XYs2e3ZjyTlNtQ2wxNjuTKNNEJtWgUEMEF3fhJ8UPMSc6E0EEvJM8mJTrQAE8mRG0H92ZfVduBvmUO0ZhTVHkHVs2yXlOniqW9_JpjPveH9K4keT1ivD-weXJ5jl7-LoWD6MNls8TpiyIc-N2tFnaebaBPaCfbR3QMkrNa9gimNeJapNdlKYsotZxhkXSju8iRx5HazYK18GqgaMsHIkZK3qWdOx1OmsVqI3dlHagGCpR8XXboL8pxVyZ2gHQQ2Qtprv_QtRNHZbjJ4e60Bx-7EUCDzm8taLW-k-KOOg_bNO7LQMbxl8zX2znmzqh6pXx8bVtV9uT2996RDAHtJvID9-JKxX34rpQ71Lu52kgYDoA0-z4ZtLcwbz__mXbZf7w7GcsDE4Rv-l5U27SiXM8mL9dnUUjRpQja03bPynpiQc30StlIYW-On1b-IdleJKhe0817wEJJqAs8UVkjfxiZMX4eR1OuqkyF32OAcBJIE8XYRS4fAV7u_x46WeMVet7OuaKLfyghShC8EAXv3PQVR-cRUELj6QyDar5NLcNAiRG82imEVQSXRTAiKVHiU1BuEKvWCKncee-oWXQYjFC0Y1pFAjhbhe5CVr_ZfWS69hfim6N80lsfnGMpbK2N0ur1MEcSvsz8hEmhM0qAWu6OGRzgkodUc7Ag8sMZVvV1i1Xeb4ILSdN7oW56pogV3j2-VkjrLrU1yQNTf3TekUal8qz_0PfwtVGUcZyrefyQpbjNqcmB_9iJt5zUQLc6un9Y4xeyFBNYn8QNUlmPvUDWRqfEuJqyGZ1MFPba19sZ0MGvMZiGN1WkInuKAFaMQQJ2IxWB2b9EeWXaLH2L2cZxr5Lf1M_2UQPj0sj_I_gw8uKhoc98Q&sig=Cg0ArKJSzD1Q_6PtzoJlEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 20 Jul 2021 12:25:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 20 Jul 2021 12:25:58 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 9A35 111 KB
39 KB 27ms
5ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 10:01:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8668
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Jul 2021 10:01:30 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9A35 41 KB
15 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 01:12:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40385
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 01:12:53 GMT

GET
H3-29 200 m_js_controller_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 9A35 31 KB
12 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/m_js_controller_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3828852411&adf=346089256&pi=t.aa~a.1421695759~rp.4&w=947&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=947x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280&nras=3&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=75&ady=1618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=pb3qJyBEdn&p=https%3A//ondequando.com&dtd=31

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

76ec101fa2e578dd3742058d953aed16b74efa3552eeab3b3f669543e9d0bfa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12646
x-xss-protection: 0
server: cafe
etag: 18353003104956614534
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:35 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 9A35 2 KB
1 KB 14ms
11ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:54 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9A35 124 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

743c8064e2b1f38a1b44de4d4ac3a99bb9c11a69a16360433076b5d93b815181

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:58 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626434926419779"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:25:58 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame 9A35 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6904dd3786abf2a13d9e3eebc371d27f65ffa4bae3d23ce1aa3f69b8b4962a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6221
x-xss-protection: 0
server: cafe
etag: 7452675974595557415
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:21 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 9A35 0
0 18ms
15ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQwLJlLzQExMvY0U9Cf1Vb-aJ2-jG_tCM6BEFNA_XEmiLVojdO9JiFsc3SWYzJZMLUQKr6InL3IxYa-cs_-oueQ-SSUDA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3828852411&adf=346089256&pi=t.aa~a.1421695759~rp.4&w=947&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=947x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280&nras=3&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=75&ady=1618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=pb3qJyBEdn&p=https%3A//ondequando.com&dtd=31
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/ Frame 9A35 18 KB
7 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8240ea20f4bb5fcc00f41228776b641b2128fccc99bc520497c13128a1fa304c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:21:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 6317884472378718772
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:21:56 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/ Frame CF83 18 KB
7 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8240ea20f4bb5fcc00f41228776b641b2128fccc99bc520497c13128a1fa304c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:21:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 6317884472378718772
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:21:56 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame CF83 2 KB
1 KB 11ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:54 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CF83 124 KB
37 KB 22ms
18ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

743c8064e2b1f38a1b44de4d4ac3a99bb9c11a69a16360433076b5d93b815181

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:58 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626434926419779"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:25:58 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame CF83 14 KB
6 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6904dd3786abf2a13d9e3eebc371d27f65ffa4bae3d23ce1aa3f69b8b4962a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6221
x-xss-protection: 0
server: cafe
etag: 7452675974595557415
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:21 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame CF83 0
0 19ms
14ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTcp64vYhySRr-itbSsk4yMb86sFx9fOh7EgkaUiIuY1r7ne9qTtQZsS-SjFiQF3dOD2xlNglSOcf-1RK6n0tT9-ggAng
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3862781926&adf=1775375230&pi=t.aa~a.4198048424~rp.1&w=991&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=991x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280&nras=6&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=53&ady=3296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=Nwpj28KFaH&p=https%3A//ondequando.com&dtd=46
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 2394816620757213722_700648559148696719.jpeg
static.doubleclick.net/dynamic/5/303287473/ Frame CF83 151 KB
151 KB 34ms
7ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/303287473/2394816620757213722_700648559148696719.jpeg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c2fc8ddf1d2d2373f21d8f2f72734359815e93337497e68178cb04c839c8635

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 00:39:12 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Jun 2021 10:35:26 GMT
server: sffe
age: 42406
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 154437
x-xss-protection: 0
expires: Wed, 20 Jul 2022 00:39:12 GMT

GET
H2 200 9382290177676921245_5575620666522366649.jpeg
static.doubleclick.net/dynamic/5/303287473/ Frame CF83 139 KB
140 KB 45ms
19ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/303287473/9382290177676921245_5575620666522366649.jpeg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4429cf5dcd1953008d758abb183364604906af06b8fdfbfd5ccd61956f3b1e9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 05:32:51 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Jun 2021 10:35:27 GMT
server: sffe
age: 24787
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 142745
x-xss-protection: 0
expires: Wed, 20 Jul 2022 05:32:51 GMT

GET
H2 200 7835705025348240782_2450409459957312248.jpeg
static.doubleclick.net/dynamic/5/303287473/ Frame CF83 114 KB
114 KB 41ms
15ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/303287473/7835705025348240782_2450409459957312248.jpeg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec5e59043b1f3481947f7b56c5287599d0ca6a2c3f0d1bf79049d662a4ba1ef0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 01:13:08 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Jun 2021 10:35:24 GMT
server: sffe
age: 40370
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 116660
x-xss-protection: 0
expires: Wed, 20 Jul 2022 01:13:08 GMT

GET
H2 200 10617304528330289865_11008544559307872908.jpeg
static.doubleclick.net/dynamic/5/303287473/ Frame CF83 134 KB
134 KB 50ms
26ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/303287473/10617304528330289865_11008544559307872908.jpeg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae239fe133ab8e6a3798abc3029c4717ef0d59c744425413fe16a200aedd46d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 22:03:23 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Jun 2021 10:35:23 GMT
server: sffe
age: 51755
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 137262
x-xss-protection: 0
expires: Tue, 19 Jul 2022 22:03:23 GMT

GET
H3-29 200 4431040525798050197
tpc.googlesyndication.com/simgad/ Frame CF83 15 KB
15 KB 11ms
6ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4431040525798050197

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d1d7fbe6bec9bd03e502a969d897fe72fab54b4ea09152e633525a6ed39624ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 03:25:47 GMT
x-content-type-options: nosniff
age: 32411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15165
x-xss-protection: 0
last-modified: Mon, 22 Mar 2021 10:25:59 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 03:25:47 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 91D2 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=472073290&adf=2330585139&pi=t.aa~a.3817703234~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=3&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0&nras=2&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=1296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=M7jxOLt4kW&p=https%3A//ondequando.com&dtd=24
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkc2K_KnIrKTuVROp-JvszBMbW8rTa2a5yct4uhjE6gF-o9sa-kjAdUrNtlgEc
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=472073290&adf=2330585139&pi=t.aa~a.3817703234~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=3&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0&nras=2&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=1296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=M7jxOLt4kW&p=https%3A//ondequando.com&dtd=24

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 20 Jul 2021 12:16:24 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 574
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6F0A 1 KB
863 B 6ms
6ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 20 Jul 2021 11:56:19 GMT
expires: Wed, 21 Jul 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 1779
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame CF83 0
0 18ms
17ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CcP2V1cD2YOaFNcmBgQe2z7iICbrhl_Ng3YimkP4I3JTH4I4JEAEg7pWqgQFglQKgAe_n75oDyAEJqQLx9Vf5JsOzPqgDAcgDywSqBLwBT9B902RMimcNl-UN6J5rQ6U_C5tnTUiWtHhrLK0Gz2NMDUE7WCLk4JLQE37uvXOAppAyFT_LMn4CbXFcUUgxLESGAE9Tf_ecN0VPDw-s3NRq8pdd-5_ZCPDUXZziAhVjyZfy68BGTt9DBSW0YoV7_sc8HRYgK03blsXBCyIoiPydsaKyeD4ahnGAOe1NFSzKY27ZWWRcZerqWefcVaD6GZdgiv5fvqiY9EG5Uyvm8hbqiJ4UFxy7aSxykQzABIPTy7adAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAfAh45gqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBBCMnxHSCAkIgOGAEBABGB-ACgHICwHYEwyIFBPQFQGAFwGyFxoKGAgAEhRwdWItNjA0Nzg2MTU1NDgwNTg2Ng&sigh=yXMgJS5lU8I&template_id=494

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3862781926&adf=1775375230&pi=t.aa~a.4198048424~rp.1&w=991&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=991x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280&nras=6&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=53&ady=3296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=Nwpj28KFaH&p=https%3A//ondequando.com&dtd=46
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 20 Jul 2021 12:25:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 226B 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0572434f304cd5ec69c30c963c92e5b13d59eaff0648dd6eb7f8c6e4e87c7375

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 86FF 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=651220815&adf=2407669957&pi=t.aa~a.2618034162~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280&nras=4&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=2069&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=oEOeuwDnkZ&p=https%3A//ondequando.com&dtd=37
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkc2K_KnIrKTuVROp-JvszBMbW8rTa2a5yct4uhjE6gF-o9sa-kjAdUrNtlgEc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=651220815&adf=2407669957&pi=t.aa~a.2618034162~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280&nras=4&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=2069&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=oEOeuwDnkZ&p=https%3A//ondequando.com&dtd=37

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 20 Jul 2021 12:16:24 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 574
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame A356 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d67db8df40e5c7ba3989412bb48c5db9cd64179c9d9207205fa9dce811b4d09a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B4D3 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3862781926&adf=1775375230&pi=t.aa~a.4198048424~rp.1&w=991&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=991x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280&nras=6&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=53&ady=3296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=Nwpj28KFaH&p=https%3A//ondequando.com&dtd=46
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkc2K_KnIrKTuVROp-JvszBMbW8rTa2a5yct4uhjE6gF-o9sa-kjAdUrNtlgEc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3862781926&adf=1775375230&pi=t.aa~a.4198048424~rp.1&w=991&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=991x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280%2C947x280&nras=6&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=53&ady=3296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=Nwpj28KFaH&p=https%3A//ondequando.com&dtd=46

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 20 Jul 2021 12:16:24 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 575
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6FC1 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 20 Jul 2021 11:56:19 GMT
expires: Wed, 21 Jul 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 1780
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 9A35 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5338e3d28fb742ee332b4ca0bcfa0b383fed8c021540bc8c7ef75ded7cca749c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame A356 0
20 B 39ms
39ms Other
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CND7vL_S8fECFU0E4AodxogLkg&gqi=1cD2YLn6M97K7_UPudm7UA&layout=/sadbundle/%24csp%253Der3%24/3857642822384818841/index.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame CF83 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 98b8f9bfd539b6cbc2e9799145d307afb6d75dd8b7b945e421e0aaccac254570

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D078 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 19 Jul 2021 11:19:01 GMT
expires: Tue, 19 Jul 2022 11:19:01 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 90418
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame CF83 0
20 B 41ms
41ms Other
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKbEvb_S8fECFclA4AodticOkQ&gqi=1cD2YK63NJWS7_UP8aS5wAc&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 7AC1 9 KB
3 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 23:05:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48011
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 20 Jul 2021 23:05:48 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 7AC1 26 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 18:31:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64486
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 20 Jul 2021 18:31:13 GMT

GET
H3-29 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 7AC1 236 KB
63 KB 31ms
15ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 20 Jul 2021 12:25:59 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ Frame 7AC1 84 KB
29 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:11:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 868
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 12:11:31 GMT

GET
H3-29 200 index.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/ Frame 7AC1 191 KB
45 KB 11ms
10ms Script
application/x-javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77d2cbdd8a3d06678d37227e4f4b8dc09cb17619d8364b84a0ad14b4b6f5652a

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 46285
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46040
x-xss-protection: 0
last-modified: Thu, 15 Apr 2021 13:44:52 GMT
server: sffe
date: Mon, 19 Jul 2021 23:34:34 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 23:34:34 GMT

GET
H3-29 200 DE_T2_Indices_Germany30_spreads_prospecting-1-German-970x250-637473572063783250-8f138022-363b-4089-90b9-4ee4520246de.html Show response
s0.2mdn.net/6418128/1611760407800/ Frame 0EE2 4 KB
1 KB 7ms
7ms Document
text/html 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/6418128/1611760407800/DE_T2_Indices_Germany30_spreads_prospecting-1-German-970x250-637473572063783250-8f138022-363b-4089-90b9-4ee4520246de.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbb8aa2fb97998bb9c3e02047bd6629438c209e65be31f2ffeee514ea19b2a44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /6418128/1611760407800/DE_T2_Indices_Germany30_spreads_prospecting-1-German-970x250-637473572063783250-8f138022-363b-4089-90b9-4ee4520246de.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 1428
date: Mon, 19 Jul 2021 15:55:43 GMT
expires: Tue, 20 Jul 2021 15:55:43 GMT
last-modified: Wed, 27 Jan 2021 15:13:27 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=86400
age: 73816
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 226B 21 KB
21 KB 9ms
5ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 02:22:18 GMT
x-content-type-options: nosniff
age: 36221
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 02:22:18 GMT

GET
H2 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 226B 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 13:46:22 GMT
x-content-type-options: nosniff
age: 599977
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Jul 2022 13:46:22 GMT

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/ Frame 68C7 33 KB
6 KB 7ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f78d9baf1bfc9f2b6acde94750d85c1ae6d397b2c617ab3021b4b4d16470004

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/6024863510128231961/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Tue, 20 Jul 2021 01:13:21 GMT
expires: Wed, 20 Jul 2022 01:13:21 GMT
last-modified: Wed, 30 Jun 2021 08:35:09 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
content-length: 6595
age: 40358
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame A23D 0
0 18ms
18ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CZhlo1cD2YNjZNInrgAfLl73QC8XV9c5j7-27oNIO6Kq2lYsDEAEg7pWqgQFglQKgAb38_JwDyAEJqQLx9Vf5JsOzPqgDAcgDSKoEsAFP0CRB_N7mqI37sbBzVGy2AxVQG7vHP5suaFhMv5tAx-iXaQCgpq6z81shp-ylhbg2jFu_Y0E9XgGLDrSikC2fTmXlohoaHxy1Ho5F3ZAncZN9ekH_2TYiJwRwdU_A0F42NwC7-9qX5fJkwMUft4hIg1Em6TFBpmQFAc69mQiZbO4gBuHCkPGu-5dGsaqgSfua9XEOiCNJ9P3UVf5LgWfYbQ4D5QWv1RvMc9nuZoJ_HMAE3fa328gDkgUECAQYAZIFBAgFGASgBi6AB6uDg2OoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwUQl6GaAdIICQiA4YAQEAEYH4AKAcgLAdgTDdAVAYAXAbIXGgoYCAASFHB1Yi02MDQ3ODYxNTU0ODA1ODY2&sigh=UHEFQZ-fgNs&template_id=419

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3160215234&adf=2049820743&pi=t.aa~a.2560532834~rp.4&w=947&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=947x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280&nras=5&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=75&ady=2402&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=wisURkTwgi&p=https%3A//ondequando.com&dtd=41
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 20 Jul 2021 12:25:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/ Frame A23D 18 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3160215234&adf=2049820743&pi=t.aa~a.2560532834~rp.4&w=947&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=947x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280&nras=5&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=75&ady=2402&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=wisURkTwgi&p=https%3A//ondequando.com&dtd=41

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8240ea20f4bb5fcc00f41228776b641b2128fccc99bc520497c13128a1fa304c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:21:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 243
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7637
x-xss-protection: 0
server: cafe
etag: 6317884472378718772
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:21:56 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame A23D 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:54 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A23D 124 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

743c8064e2b1f38a1b44de4d4ac3a99bb9c11a69a16360433076b5d93b815181

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:59 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1626434926419779"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:25:59 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/ Frame A23D 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210712/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6904dd3786abf2a13d9e3eebc371d27f65ffa4bae3d23ce1aa3f69b8b4962a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6221
x-xss-protection: 0
server: cafe
etag: 7452675974595557415
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 12:25:21 GMT

GET
H3-29 200 index_atlas_1.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/ Frame 7AC1 41 KB
41 KB 7ms
7ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index_atlas_1.png?1616060212154

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b72cbad51b7a44789fcce6b237621a000e9a9e59c5cb1a2a98b38fec5842ccf6

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 28818
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41918
x-xss-protection: 0
last-modified: Thu, 15 Apr 2021 13:44:52 GMT
server: sffe
date: Tue, 20 Jul 2021 04:25:41 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 04:25:41 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 6F0A 35 B
462 B 11ms
9ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEHNPEO4UMJZieZFSSFwZ7_M&google_cver=1&google_push=AYg5qPLLqemyaO_RAzSus5gOfmBrCtin1Wz-X4vEBJBuJQGdgo02JziSCLkOozdttfEZz8ouLsdsBgoDyMHeAtf14Zs9vvsblfxY

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6F0A
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEECyrBNDYIpqeStcvyN-als&google_cver=1&google_push=AYg5qPKSoQSeaubxfz4Qaemz_9vROtCXiFLlIGoDoPeqTNwatMW-jyQLgV_9htuHDjDgOSjzwVppuOxqpNnfzwMF06RYHi-P6-0F
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKSoQSeaubxfz4Qaemz_9vROtCXiFLlIGoDoPeqTNwatMW-jyQLgV_9htuHDjDgOSjzwVppuOxqpNnfzwMF06RYHi-P6-0F&google_hm=Q0FFU0VFQ3lyQk5EWUlwc...

170 B
188 B

16ms
15ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKSoQSeaubxfz4Qaemz_9vROtCXiFLlIGoDoPeqTNwatMW-jyQLgV_9htuHDjDgOSjzwVppuOxqpNnfzwMF06RYHi-P6-0F&google_hm=Q0FFU0VFQ3lyQk5EWUlwcWVTdGN2eU4tYWxz

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 20 Jul 2021 12:25:58 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKSoQSeaubxfz4Qaemz_9vROtCXiFLlIGoDoPeqTNwatMW-jyQLgV_9htuHDjDgOSjzwVppuOxqpNnfzwMF06RYHi-P6-0F&google_hm=Q0FFU0VFQ3lyQk5EWUlwcWVTdGN2eU4tYWxz
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6F0A
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEPIs4Mor5jPQ0-EXEgUTu2E&google_cver=1&google_push=AYg5qPKv0qKTlmGEU7u9NZi44bVvVwGYyt3sdTcyHuMOzDNqD8aL-WRXMGAqRWDxlmdP4231D4htCHAuJVLX-40MEJtT9HYKod8Q
https://rtb.openx.net/sync/dds?google_gid=CAESEPIs4Mor5jPQ0-EXEgUTu2E&google_cver=1&google_push=AYg5qPKv0qKTlmGEU7u9NZi44bVvVwGYyt3sdTcyHuMOzDNqD8aL-WRXMGAqRWDxlmdP4231D4htCHAuJVLX-40MEJtT9HYKod8Q&...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKv0qKTlmGEU7u9NZi44bVvVwGYyt3sdTcyHuMOzDNqD8aL-WRXMGAqRWDxlmdP4231D4htCHAuJVLX-40MEJtT9HYKod8Q&google_hm=kRDYtQF1yPULik2X9083zg==

170 B
188 B

16ms
16ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKv0qKTlmGEU7u9NZi44bVvVwGYyt3sdTcyHuMOzDNqD8aL-WRXMGAqRWDxlmdP4231D4htCHAuJVLX-40MEJtT9HYKod8Q&google_hm=kRDYtQF1yPULik2X9083zg==

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:58 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKv0qKTlmGEU7u9NZi44bVvVwGYyt3sdTcyHuMOzDNqD8aL-WRXMGAqRWDxlmdP4231D4htCHAuJVLX-40MEJtT9HYKod8Q&google_hm=kRDYtQF1yPULik2X9083zg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 9drorti1uqualedfd6hr5bkmh5g79jlo

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6F0A
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8rOmD_o2S2mWKhI8mYF1fQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

16ms
16ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8rOmD_o2S2mWKhI8mYF1fQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLLMnmg8dyZxPOvjyxUOs6t42gv9C7j26YcNOI1KusuP-M9jItz4f6zbWWgUdEGZ2RRZrtGZTnKa2IDVX21TGVTjw_fF3YMtw

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8rOmD_o2S2mWKhI8mYF1fQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLLMnmg8dyZxPOvjyxUOs6t42gv9C7j26YcNOI1KusuP-M9jItz4f6zbWWgUdEGZ2RRZrtGZTnKa2IDVX21TGVTjw_fF3YMtw
date: Tue, 20 Jul 2021 12:25:57 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6F0A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBljemKD7qjevp58ueJMYao&google_cver=1&google_push=AYg5qPKLXly7X4tx1SEp7DiV62X2_LUCrtfJs6SkNqBED2b8fFr6uYZVlFtL_vm46S3hQC1FwXg...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JDMTYwSTEtNy05U040&google_push=AYg5qPKLXly7X4tx1SEp7DiV62X2_LUCrtfJs6SkNqBED2b8fFr6uYZVlFtL_vm46S3hQC1FwXgmP2vxac0SxqpQQQmFHtJvPd5tOA

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JDMTYwSTEtNy05U040&google_push=AYg5qPKLXly7X4tx1SEp7DiV62X2_LUCrtfJs6SkNqBED2b8fFr6uYZVlFtL_vm46S3hQC1FwXgmP2vxac0SxqpQQQmFHtJvPd5tOA

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JDMTYwSTEtNy05U040&google_push=AYg5qPKLXly7X4tx1SEp7DiV62X2_LUCrtfJs6SkNqBED2b8fFr6uYZVlFtL_vm46S3hQC1FwXgmP2vxac0SxqpQQQmFHtJvPd5tOA
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 6F0A
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJ...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 6F0A 43 B
297 B 66ms
21ms Image
image/gif 2a05:d01c:1d8:8102:3268:e5ec:7f57:13ef
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEAWFMzIFOiA42w4WNTiEQZY&google_cver=1&google_push=AYg5qPILnaxFftjiRa_cvPcIqR2dU1HBS6t5OolOCyXxzjlGxQt3yZI43k1PYTiDqKrBr1m2uOmCE4nSJcLisy1YW4SZ169Cl2rc
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=472073290&adf=2330585139&pi=t.aa~a.3817703234~rp.4&w=473&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=473x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=3&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0&nras=2&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1067&ady=1296&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=M7jxOLt4kW&p=https%3A//ondequando.com&dtd=24
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8102:3268:e5ec:7f57:13ef London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 6F0A 0
12 B 15ms
14ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L9j0lgMGeAyy_KMbTaAsUTVKgit8XCZYqZol51JW5IEojbYx5ftP-L-fc1NOByCgaRsSu9

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 91D2
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

15ms
14ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkc2K_KnIrKTuVROp-JvszBMbW8rTa2a5yct4uhjE6gF-o9sa-kjAdUrNtlgEc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:59 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 20-Jul-2021 13:25:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:59 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:59 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2535 143 B
163 B 14ms
10ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3160215234&adf=2049820743&pi=t.aa~a.2560532834~rp.4&w=947&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=947x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280&nras=5&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=75&ady=2402&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=wisURkTwgi&p=https%3A//ondequando.com&dtd=41
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkc2K_KnIrKTuVROp-JvszBMbW8rTa2a5yct4uhjE6gF-o9sa-kjAdUrNtlgEc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3160215234&adf=2049820743&pi=t.aa~a.2560532834~rp.4&w=947&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=947x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280%2C947x280%2C473x280&nras=5&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=75&ady=2402&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=wisURkTwgi&p=https%3A//ondequando.com&dtd=41

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 20 Jul 2021 12:16:24 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 575
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame A23D 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: de55a1d585b98ab3be04fd9d7e0cebc80b5c42ebbaedd70a1106ebfaa12961b7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js Show response
pagead2.googlesyndication.com/bg/ Frame 6E90 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1916d5a5a97048327e74b168dd38fe0067ac06db81f57f72108f23410cff79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:12:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 789
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Jul 2022 12:12:50 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6FC1
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEF-Eet_Mr7xgANSq6HLT958&google_cver=1&google_push=AYg5qPL6_gDdrPLoXnSpc__KM18KrrEfIIaZYmj2uAQvC7PyPYrT40ix0O...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL6_gDdrPLoXnSpc__KM18KrrEfIIaZYmj2uAQvC7PyPYrT40ix0O-g7eijkwRFBeFYZN2aVX3LxJkttoTMqOxa96HiliRf&google_hm=jzErQ7...

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL6_gDdrPLoXnSpc__KM18KrrEfIIaZYmj2uAQvC7PyPYrT40ix0O-g7eijkwRFBeFYZN2aVX3LxJkttoTMqOxa96HiliRf&google_hm=jzErQ72gSrYioeu2PZlxRA

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL6_gDdrPLoXnSpc__KM18KrrEfIIaZYmj2uAQvC7PyPYrT40ix0O-g7eijkwRFBeFYZN2aVX3LxJkttoTMqOxa96HiliRf&google_hm=jzErQ72gSrYioeu2PZlxRA
pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6FC1
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEKcSpZt8MWq301FASVLssTs&google_cver=1&google_push=AYg5qPIY5Qe4kTFDN5lr-oscyKJ5-YgZskERwwPX2hQFSu9DfSNrv0BSjl7c5g93_19iQxSpmcJMxo3toR8IQJB6evkbvFvVZrKp
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIY5Qe4kTFDN5lr-oscyKJ5-YgZskERwwPX2hQFSu9DfSNrv0BSjl7c5g93_19iQxSpmcJMxo3toR8IQJB6evkbvFvVZrKp&google_hm=Q0FFU0VLY1NwWnQ4TVdxM...

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIY5Qe4kTFDN5lr-oscyKJ5-YgZskERwwPX2hQFSu9DfSNrv0BSjl7c5g93_19iQxSpmcJMxo3toR8IQJB6evkbvFvVZrKp&google_hm=Q0FFU0VLY1NwWnQ4TVdxMzAxRkFTVkxzc1Rz

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 20 Jul 2021 12:25:58 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIY5Qe4kTFDN5lr-oscyKJ5-YgZskERwwPX2hQFSu9DfSNrv0BSjl7c5g93_19iQxSpmcJMxo3toR8IQJB6evkbvFvVZrKp&google_hm=Q0FFU0VLY1NwWnQ4TVdxMzAxRkFTVkxzc1Rz
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6FC1
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESECAOH998xQlXkUjXJs6wLko&google_cver=1&google_push=AYg5qPI1hbKnQE4i7aiL2a002DNp5UGkB2D67PvhFpb7UUs9Z5W_qtwiZLeELEj2A-c-czUeS6PeCYY4ydTJKhgWlH6q36Xy8K_P
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI1hbKnQE4i7aiL2a002DNp5UGkB2D67PvhFpb7UUs9Z5W_qtwiZLeELEj2A-c-czUeS6PeCYY4ydTJKhgWlH6q36Xy8K_P&google_hm=kRDYtQF1yPULik2X9083zg==

170 B
188 B

17ms
16ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI1hbKnQE4i7aiL2a002DNp5UGkB2D67PvhFpb7UUs9Z5W_qtwiZLeELEj2A-c-czUeS6PeCYY4ydTJKhgWlH6q36Xy8K_P&google_hm=kRDYtQF1yPULik2X9083zg==

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:58 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI1hbKnQE4i7aiL2a002DNp5UGkB2D67PvhFpb7UUs9Z5W_qtwiZLeELEj2A-c-czUeS6PeCYY4ydTJKhgWlH6q36Xy8K_P&google_hm=kRDYtQF1yPULik2X9083zg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 3lhge7hqp9ckis53cl8e5avb5tjrsvbq

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6FC1
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8rOmD_o2S2mWKhI8mYF1fQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

16ms
16ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8rOmD_o2S2mWKhI8mYF1fQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ3RzNVhipZUvvFPn17VGVBKAX07mE-edORMAS9pSEce5KTfop6QzjuPYxzI5VyEI2qZClAX7qXVDHFt82M6QaZMqbDGsJ1

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8rOmD_o2S2mWKhI8mYF1fQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ3RzNVhipZUvvFPn17VGVBKAX07mE-edORMAS9pSEce5KTfop6QzjuPYxzI5VyEI2qZClAX7qXVDHFt82M6QaZMqbDGsJ1
date: Tue, 20 Jul 2021 12:25:57 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6FC1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENxFRBk4yYwTTZJdUWcz970&google_cver=1&google_push=AYg5qPLwYX9IpK_LODJwTIykLn4PG1672hZiq2B8nisuzqGNxE0xI3ap_RwVHLdmwys_Fwegy7Z...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JDMTYwS08tTS1CTlJV&google_push=AYg5qPLwYX9IpK_LODJwTIykLn4PG1672hZiq2B8nisuzqGNxE0xI3ap_RwVHLdmwys_Fwegy7ZVHoVKZAQOZlBF--0ur2B_xTN0

170 B
188 B

16ms
16ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JDMTYwS08tTS1CTlJV&google_push=AYg5qPLwYX9IpK_LODJwTIykLn4PG1672hZiq2B8nisuzqGNxE0xI3ap_RwVHLdmwys_Fwegy7ZVHoVKZAQOZlBF--0ur2B_xTN0

Requested by

Host: ondequando.com
URL: https://ondequando.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JDMTYwS08tTS1CTlJV&google_push=AYg5qPLwYX9IpK_LODJwTIykLn4PG1672hZiq2B8nisuzqGNxE0xI3ap_RwVHLdmwys_Fwegy7ZVHoVKZAQOZlBF--0ur2B_xTN0
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 6FC1
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 6FC1 43 B
295 B 22ms
21ms Image
image/gif 2a05:d01c:1d8:8102:3268:e5ec:7f57:13ef
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEEUAgzGJ16KZeURSi6vmabo&google_cver=1&google_push=AYg5qPJ3OQGnRH2gcxpl7E7fr9rFJt4BIDc2ukfIpITF2K2DQ1OS86aEJs0nDQQcWPhWFe7StQKy4wHeAldXaquC6iHmd7mzNFBF
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6047861554805866&output=html&h=280&adk=3828852411&adf=346089256&pi=t.aa~a.1421695759~rp.4&w=947&fwrn=4&fwrnh=100&lmt=1626783957&rafmt=1&to=qs&pwprc=3672257616&psa=0&format=947x280&url=https%3A%2F%2Fondequando.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1626783957806&bpp=1&bdt=2443&idt=-M&shv=r20210712&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53c4e88bc66b590d-225c6ea680c80005%3AT%3D1626783957%3ART%3D1626783957%3AS%3DALNI_Mboa48JLnVAavQeh0rqFbVXeUx_Fg&prev_fmts=0x0%2C473x280&nras=3&correlator=4379787723602&frm=20&pv=1&ga_vid=572248462.1626783957&ga_sid=1626783957&ga_hid=1884704555&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=75&ady=1618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C20211866&oid=3&pvsid=1916660871290691&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=pb3qJyBEdn&p=https%3A//ondequando.com&dtd=31
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8102:3268:e5ec:7f57:13ef London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 6FC1 0
12 B 15ms
14ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JS8CosMChvybPYloNMLEgf-4hf_tiqLDL09s9yvVwvtkMscd2poZSD_16WCgbwdnxTcAU1

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 86FF
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

14ms
14ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkc2K_KnIrKTuVROp-JvszBMbW8rTa2a5yct4uhjE6gF-o9sa-kjAdUrNtlgEc; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:59 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 20-Jul-2021 13:25:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:59 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:59 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame A23D 0
20 B 39ms
39ms Other
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJiYvb_S8fECFYk14Aody0sPug&gqi=1cD2YM-UNPqh7_UPv_6GgAM&layout=/sadbundle/%24csp%253Der3%24/6024863510128231961/index.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B4D3
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

15ms
15ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkc2K_KnIrKTuVROp-JvszBMbW8rTa2a5yct4uhjE6gF-o9sa-kjAdUrNtlgEc; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:59 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 20-Jul-2021 13:25:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:59 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:59 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 89A7 42 B
64 B 40ms
40ms Fetch
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstb3lwwHHOF8ZObL2_-15Nk5clECgBI6vwd1FQgqX64mTLkLBK169jzSl4iaKcbWHTtm9rRJzw0P4DTm7LXbRNQ4xXioHB2u7WZSAOUEYajZziEaCMqWsHgnGQ1qA&sai=AMfl-YSHLRsi05KQsSwgOhIjqTi1dHw0W-xPfqcaxEufDxK6a_stTE_KDPE68ego1VxNr9nzlfPpql_oh7Ce&sig=Cg0ArKJSzH4cv94pdCqTEAE&id=lidar2&mcvt=1091&p=1103,298,1227,1303&mtos=148,741,1091,1245,1383&tos=148,593,350,154,138&v=20210716&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=4&adk=1812271801&rs=2&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1626783957924&dlt=9&rpt=2&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:25:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js Show response
pagead2.googlesyndication.com/bg/ Frame ECDD 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1916d5a5a97048327e74b168dd38fe0067ac06db81f57f72108f23410cff79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:12:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 789
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Jul 2022 12:12:50 GMT

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 68C7 9 KB
3 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 23:05:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48011
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 20 Jul 2021 23:05:48 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 68C7 26 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 18:31:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64486
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 20 Jul 2021 18:31:13 GMT

GET
H3-29 200 f26fdea10cef6ab9d68e407cf7c21487.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/ Frame 68C7 74 KB
19 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/f26fdea10cef6ab9d68e407cf7c21487.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4427a7a29dd9086c912a5c9ae99901585889e2e24f4120a13c69e8c13a49ce88

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 12698
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19283
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 08:35:09 GMT
server: sffe
date: Tue, 20 Jul 2021 08:54:21 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 08:54:21 GMT

GET
H3-29 200 exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js Show response
pagead2.googlesyndication.com/bg/ Frame D078 35 KB
13 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1916d5a5a97048327e74b168dd38fe0067ac06db81f57f72108f23410cff79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:12:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 789
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Jul 2022 12:12:50 GMT

GET
H3-29 200 exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js Show response
pagead2.googlesyndication.com/bg/ Frame 7AC1 35 KB
13 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1916d5a5a97048327e74b168dd38fe0067ac06db81f57f72108f23410cff79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:12:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 789
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Jul 2022 12:12:50 GMT

GET
H2 200 601182a03f381269088756dc Show response
c.bannerflow.net/a/ Frame 0EE2 58 KB
20 KB 53ms
37ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/a/601182a03f381269088756dc?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssgziGHEK8sYLoVQ9dqzuBKDrZVfnh-xQY21IswE9TehEvV2W0kAakfCU4Kwhyk_Ku0b6XWE8IquBl1gIfrxJ_IxfCkt8asKRwdtZB7uVT0KKH7RoiCRT21aO5KLSQS76HXWjpzEDDoBzuZOnlfDwue7Wi0UhwBimRc_A0c8FH_AplnSD_06MCRq2VwSs0H9y9EklqNdzVQgskBtfnbvrY_7pAarlKvoeweO7WGA97jtrl8BOLD983WlGLqEghr__QtIUl6JYOGra1dDxGZMlqDDmCXmnFBq6k_KTcCgxG6V8JF2q8Oi7VKqRohagqPFE8XCM6zH0nlR5HlHS2LqwsESrU_xU3eevMvNuBDnGb4dXx9t3zsmBibi1zmnXS-eArJFww5seZlDLk0ijE6BLVL-ty848QQtUFw6-KLWKZ68e7bZcUggRGA64MWsFocsSyNJtLdzltl04JD18B4jykKQvNz9-to6mOD4-p1P0h3mrW8zxQdznHJ0bf6NexDcytB-QVXsQdISbjfVg4y-1SUazsMIQZ0s6bj8Jfupvvo0DIIsuTzp4h-n4peTaJcMaDeYJDZRIrprodeKJm2GUpQnyv46l-NTyh42eHo4EB-kY3hmSuPYadPDiJ6pjJQQXpXqcuKPQnkULBujAbhrXfwSQz8lnCmwF71DrRuzEmuA68Yobce7R-MHU24YNEAgfbRuxiX2P7xjZH9gVnKnmmyRcxm7b3lt3a5YuKpVvfT7ODhJ5zxPeC9lo4EoBy_devUCgKZdOJ3OhN1aekNtlR94DfPMisZMcAmNU9-yWKUjhu-g0I5qHcjsrRwyyNh7pxDpptpb9ovGWtDRjxwUh2eGcWU12EOufnPKU9DsgHFT5I5En8OHQIdUeifqj4DOAxCgk13hHzn8t_NRlzW12W--Gmeei2A4cTSsUk%26sig%3DCg0ArKJSzII6z-1Q4lqxEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgermany-30-traden-v2%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-germany30-prospecting
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/6418128/1611760407800/DE_T2_Indices_Germany30_spreads_prospecting-1-German-970x250-637473572063783250-8f138022-363b-4089-90b9-4ee4520246de.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ecf3fc806320c52bb5999a10cedb7d54d084bb394b9941d2d055181dedc4ee70

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:25:59 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/javascript
cf-ray: 671c2ce2ede82c26-FRA
link: <https://c.bannerflow.net/accounts/cmc-markets/560bd8d24d47fc28fc84259d/published/419131/1132165/preload.jpg>; rel=preload; as=image
request-context: appId=cid-v1:8ccc0d93-c9cf-4965-a9de-1823f9df557e

GET
H2 200 css
fonts.googleapis.com/ Frame 68C7 5 KB
786 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:400|Montserrat:800|Roboto:700

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/f26fdea10cef6ab9d68e407cf7c21487.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3be417f455129283fc4fb8f9ee5bc2af0572838dc65f2dd6ab7daa6202cba6c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 20 Jul 2021 12:07:42 GMT
server: ESF
date: Tue, 20 Jul 2021 12:25:59 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 20 Jul 2021 12:25:59 GMT

GET
H3-29 200 1d8b54700cd75c928712301fafc6e3c9.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/media/ Frame 68C7 53 KB
53 KB 9ms
8ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/media/1d8b54700cd75c928712301fafc6e3c9.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ada3dee5caeaa7b6531724b208f952faec6476488bc8479a26faf59a94384607

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 29333
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54597
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 08:35:09 GMT
server: sffe
date: Tue, 20 Jul 2021 04:17:06 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 04:17:06 GMT

GET
H3-29 200 3b749e2a3b687be203005f8ecef7f6fd.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/media/ Frame 68C7 679 B
469 B 7ms
7ms Image
image/svg+xml 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/media/3b749e2a3b687be203005f8ecef7f6fd.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

52cba504db8540c0ce693d325ae20b20730dbe808cd3f57706d38371c7c19932

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 74093
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 434
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 08:35:09 GMT
server: sffe
date: Mon, 19 Jul 2021 15:51:06 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 15:51:06 GMT

GET
H3-29 200 db5f570a11c2c19132aaf376e837f669.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/media/ Frame 68C7 3 KB
2 KB 8ms
8ms Image
image/svg+xml 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/media/db5f570a11c2c19132aaf376e837f669.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f0fb5e7aee1812174996e6d522c9920704a3c9397d1599000fa9a79070e446d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 74093
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1527
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 08:35:09 GMT
server: sffe
date: Mon, 19 Jul 2021 15:51:06 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 15:51:06 GMT

GET
H2 200 preload.jpg
c.bannerflow.net/accounts/cmc-markets/560bd8d24d47fc28fc84259d/published/419131/1132165/ Frame 0EE2 26 KB
26 KB 17ms
17ms Image
image/jpeg 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/cmc-markets/560bd8d24d47fc28fc84259d/published/419131/1132165/preload.jpg
Requested by: Host: ondequando.com
URL: https://ondequando.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3d962b24494e71668adc2978469676925b153faa1de0d801b84c4ad125262c47

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 20 Jul 2021 12:25:59 GMT
cf-cache-status: HIT
age: 680004
content-length: 26146
x-ms-lease-status: unlocked
last-modified: Mon, 12 Jul 2021 15:31:59 GMT
server: cloudflare
etag: 0x8D9454A30ADCF64
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-ms-request-id: 136aef8e-f01e-0014-7e33-77a549000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 671c2ce39fb02c26-FRA
cf-bgj: h2pri

GET
H2 200 feed.2678f6b68fa42dd5932e.js Show response
c.bannerflow.net/scripts/ Frame 0EE2 5 KB
3 KB 19ms
18ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/feed.2678f6b68fa42dd5932e.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/601182a03f381269088756dc?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssgziGHEK8sYLoVQ9dqzuBKDrZVfnh-xQY21IswE9TehEvV2W0kAakfCU4Kwhyk_Ku0b6XWE8IquBl1gIfrxJ_IxfCkt8asKRwdtZB7uVT0KKH7RoiCRT21aO5KLSQS76HXWjpzEDDoBzuZOnlfDwue7Wi0UhwBimRc_A0c8FH_AplnSD_06MCRq2VwSs0H9y9EklqNdzVQgskBtfnbvrY_7pAarlKvoeweO7WGA97jtrl8BOLD983WlGLqEghr__QtIUl6JYOGra1dDxGZMlqDDmCXmnFBq6k_KTcCgxG6V8JF2q8Oi7VKqRohagqPFE8XCM6zH0nlR5HlHS2LqwsESrU_xU3eevMvNuBDnGb4dXx9t3zsmBibi1zmnXS-eArJFww5seZlDLk0ijE6BLVL-ty848QQtUFw6-KLWKZ68e7bZcUggRGA64MWsFocsSyNJtLdzltl04JD18B4jykKQvNz9-to6mOD4-p1P0h3mrW8zxQdznHJ0bf6NexDcytB-QVXsQdISbjfVg4y-1SUazsMIQZ0s6bj8Jfupvvo0DIIsuTzp4h-n4peTaJcMaDeYJDZRIrprodeKJm2GUpQnyv46l-NTyh42eHo4EB-kY3hmSuPYadPDiJ6pjJQQXpXqcuKPQnkULBujAbhrXfwSQz8lnCmwF71DrRuzEmuA68Yobce7R-MHU24YNEAgfbRuxiX2P7xjZH9gVnKnmmyRcxm7b3lt3a5YuKpVvfT7ODhJ5zxPeC9lo4EoBy_devUCgKZdOJ3OhN1aekNtlR94DfPMisZMcAmNU9-yWKUjhu-g0I5qHcjsrRwyyNh7pxDpptpb9ovGWtDRjxwUh2eGcWU12EOufnPKU9DsgHFT5I5En8OHQIdUeifqj4DOAxCgk13hHzn8t_NRlzW12W--Gmeei2A4cTSsUk%26sig%3DCg0ArKJSzII6z-1Q4lqxEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgermany-30-traden-v2%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-germany30-prospecting
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c69df3576451f8ece9a8486a4bdda41819546aa2d6683a0147c933a2ff4d87b2

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 20 Jul 2021 12:25:59 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: LCAHA5QmCEeFWxMDlbeyfQ==
age: 1621630
cf-polished: origSize=5321
x-ms-lease-status: unlocked
last-modified: Thu, 01 Jul 2021 10:33:56 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 6ed5527b-f01e-0059-80a2-6e6aa5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
cf-ray: 671c2ce51bc02c26-FRA
cf-bgj: minify

GET
H2 200 document.f7241c5c3e.js Show response
c.bannerflow.net/accounts/cmc-markets/560bd8d24d47fc28fc84259d/published/419131/1132165/ Frame 0EE2 35 KB
4 KB 22ms
22ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/accounts/cmc-markets/560bd8d24d47fc28fc84259d/published/419131/1132165/document.f7241c5c3e.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/601182a03f381269088756dc?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssgziGHEK8sYLoVQ9dqzuBKDrZVfnh-xQY21IswE9TehEvV2W0kAakfCU4Kwhyk_Ku0b6XWE8IquBl1gIfrxJ_IxfCkt8asKRwdtZB7uVT0KKH7RoiCRT21aO5KLSQS76HXWjpzEDDoBzuZOnlfDwue7Wi0UhwBimRc_A0c8FH_AplnSD_06MCRq2VwSs0H9y9EklqNdzVQgskBtfnbvrY_7pAarlKvoeweO7WGA97jtrl8BOLD983WlGLqEghr__QtIUl6JYOGra1dDxGZMlqDDmCXmnFBq6k_KTcCgxG6V8JF2q8Oi7VKqRohagqPFE8XCM6zH0nlR5HlHS2LqwsESrU_xU3eevMvNuBDnGb4dXx9t3zsmBibi1zmnXS-eArJFww5seZlDLk0ijE6BLVL-ty848QQtUFw6-KLWKZ68e7bZcUggRGA64MWsFocsSyNJtLdzltl04JD18B4jykKQvNz9-to6mOD4-p1P0h3mrW8zxQdznHJ0bf6NexDcytB-QVXsQdISbjfVg4y-1SUazsMIQZ0s6bj8Jfupvvo0DIIsuTzp4h-n4peTaJcMaDeYJDZRIrprodeKJm2GUpQnyv46l-NTyh42eHo4EB-kY3hmSuPYadPDiJ6pjJQQXpXqcuKPQnkULBujAbhrXfwSQz8lnCmwF71DrRuzEmuA68Yobce7R-MHU24YNEAgfbRuxiX2P7xjZH9gVnKnmmyRcxm7b3lt3a5YuKpVvfT7ODhJ5zxPeC9lo4EoBy_devUCgKZdOJ3OhN1aekNtlR94DfPMisZMcAmNU9-yWKUjhu-g0I5qHcjsrRwyyNh7pxDpptpb9ovGWtDRjxwUh2eGcWU12EOufnPKU9DsgHFT5I5En8OHQIdUeifqj4DOAxCgk13hHzn8t_NRlzW12W--Gmeei2A4cTSsUk%26sig%3DCg0ArKJSzII6z-1Q4lqxEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgermany-30-traden-v2%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-germany30-prospecting
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b45d96980648bb952dc5e4f3aa047b147ad990e2d9092b5d974489278e56ba4

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 20 Jul 2021 12:25:59 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 9yQcXD5ewMTvvOmHZFTd+w==
age: 680004
cf-polished: origSize=40646
x-ms-lease-status: unlocked
last-modified: Mon, 12 Jul 2021 15:32:01 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: ed91074a-201e-0038-7e33-7749e6000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
cf-ray: 671c2ce51bc32c26-FRA
cf-bgj: minify

GET
H2 200 animated-creative.ae0dd63dbe542648d6b7.js Show response
c.bannerflow.net/scripts/ Frame 0EE2 130 KB
44 KB 25ms
25ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/animated-creative.ae0dd63dbe542648d6b7.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/601182a03f381269088756dc?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssgziGHEK8sYLoVQ9dqzuBKDrZVfnh-xQY21IswE9TehEvV2W0kAakfCU4Kwhyk_Ku0b6XWE8IquBl1gIfrxJ_IxfCkt8asKRwdtZB7uVT0KKH7RoiCRT21aO5KLSQS76HXWjpzEDDoBzuZOnlfDwue7Wi0UhwBimRc_A0c8FH_AplnSD_06MCRq2VwSs0H9y9EklqNdzVQgskBtfnbvrY_7pAarlKvoeweO7WGA97jtrl8BOLD983WlGLqEghr__QtIUl6JYOGra1dDxGZMlqDDmCXmnFBq6k_KTcCgxG6V8JF2q8Oi7VKqRohagqPFE8XCM6zH0nlR5HlHS2LqwsESrU_xU3eevMvNuBDnGb4dXx9t3zsmBibi1zmnXS-eArJFww5seZlDLk0ijE6BLVL-ty848QQtUFw6-KLWKZ68e7bZcUggRGA64MWsFocsSyNJtLdzltl04JD18B4jykKQvNz9-to6mOD4-p1P0h3mrW8zxQdznHJ0bf6NexDcytB-QVXsQdISbjfVg4y-1SUazsMIQZ0s6bj8Jfupvvo0DIIsuTzp4h-n4peTaJcMaDeYJDZRIrprodeKJm2GUpQnyv46l-NTyh42eHo4EB-kY3hmSuPYadPDiJ6pjJQQXpXqcuKPQnkULBujAbhrXfwSQz8lnCmwF71DrRuzEmuA68Yobce7R-MHU24YNEAgfbRuxiX2P7xjZH9gVnKnmmyRcxm7b3lt3a5YuKpVvfT7ODhJ5zxPeC9lo4EoBy_devUCgKZdOJ3OhN1aekNtlR94DfPMisZMcAmNU9-yWKUjhu-g0I5qHcjsrRwyyNh7pxDpptpb9ovGWtDRjxwUh2eGcWU12EOufnPKU9DsgHFT5I5En8OHQIdUeifqj4DOAxCgk13hHzn8t_NRlzW12W--Gmeei2A4cTSsUk%26sig%3DCg0ArKJSzII6z-1Q4lqxEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgermany-30-traden-v2%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-germany30-prospecting
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 116acec5db11b97c811de6143642ae413dd788ece902a0272af9580441b30e7c

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 20 Jul 2021 12:25:59 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: +OfEsQmeo8cj6AuyF+j7Bg==
age: 1628875
cf-polished: origSize=133564
x-ms-lease-status: unlocked
last-modified: Thu, 01 Jul 2021 10:33:56 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: b1829eff-b01e-0093-6e91-6e362c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
cf-ray: 671c2ce51bc42c26-FRA
cf-bgj: minify

GET
DATA 200
OK truncated
/ Frame 68C7 356 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a6f8bfaef875088ab0791e9118f7884ddfb82296331ba2b32b5598298c941293

Request headers

Origin: null
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
H3-29 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 68C7 15 KB
15 KB 16ms
14ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400|Montserrat:800|Roboto:700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:00:01 GMT
x-content-type-options: nosniff
age: 1558
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 12:00:01 GMT

GET
H3-29 200 JTURjIg1_i6t8kCHKm45_c5H3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v15/ Frame 68C7 19 KB
19 KB 20ms
19ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_c5H3gnD_g.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400|Montserrat:800|Roboto:700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c623b34dcf729895c3bc9b6e261796bbad69555a21ad6d2f9b4e7bc27b6e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:00:02 GMT
x-content-type-options: nosniff
age: 1557
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19440
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:11:08 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 12:00:02 GMT

GET
H3-29 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v15/ Frame 68C7 19 KB
19 KB 23ms
21ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400|Montserrat:800|Roboto:700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8767f01caa430c5bd4e3b008a8e9dfe022156a4e91a23c394fdcb05c267f1b94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 21:27:07 GMT
x-content-type-options: nosniff
age: 53932
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19172
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:11:52 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 21:27:07 GMT

GET
DATA 200
OK truncated
/ Frame 68C7 13 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d867f01ddeb0046fff1579890a34e0f0aca6b83f0380181c8d81ca38429bd43c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
DATA 200
OK truncated
/ Frame 68C7 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 38817a74140cf776573a0449151634e3b0d493f406326904cd33fdfe93fddb24

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2535
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

15ms
14ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkc2K_KnIrKTuVROp-JvszBMbW8rTa2a5yct4uhjE6gF-o9sa-kjAdUrNtlgEc; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:59 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 20-Jul-2021 13:25:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 20 Jul 2021 12:25:59 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 20 Jul 2021 12:25:59 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 22ms
21ms XHR
application/json 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210712&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

184219666ef52ac2063094d9ca1b1aecdb2bd120365a624f1d7549132b9bb1e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 20 Jul 2021 12:26:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8395
x-xss-protection: 0

GET
H3-29 200 exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js Show response
pagead2.googlesyndication.com/bg/ Frame 68C7 35 KB
13 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1916d5a5a97048327e74b168dd38fe0067ac06db81f57f72108f23410cff79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:12:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 790
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Jul 2022 12:12:50 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:26:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Tue, 20 Jul 2021 12:26:00 GMT

GET
DATA 200
OK truncated
/ Frame 0EE2 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 3563 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ondequando.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ondequando.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Tue, 20 Jul 2021 12:12:49 GMT
expires: Wed, 20 Jul 2022 12:12:49 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 791
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame EEED 783 B
533 B 16ms
15ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

2f63c236aaf495fbaa93be3b203e7721a679fbd60ce63a3f1572403a003719d7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-PwASeG2AS5Dy+tzWMzXr3Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ondequando.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ondequando.com/

Response headers

expires: Tue, 20 Jul 2021 12:26:00 GMT
date: Tue, 20 Jul 2021 12:26:00 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-PwASeG2AS5Dy+tzWMzXr3Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 609a5075653876d7faba9568.json Show response
c.bannerflow.net/sfeeds/560bd8d24d47fc28fc84259d/ Frame 0EE2 3 KB
2 KB 61ms
40ms Fetch
application/json 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/sfeeds/560bd8d24d47fc28fc84259d/609a5075653876d7faba9568.json
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/feed.2678f6b68fa42dd5932e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fae185d1fec7bb099c26b01cc737061adaae5b9fab32fc2e73b1cc185881bb43

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:26:00 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 459
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=600, stale-if-error=28800, stale-while-revalidate=28800
cf-ray: 671c2ce75d102be9-FRA
request-context: appId=cid-v1:75ea8019-1544-4ba8-a6db-e73bdcff9d5b

GET
H2 200 5f830ad4ff43030df4874653.json Show response
c.bannerflow.net/sfeeds/560bd8d24d47fc28fc84259d/ Frame 0EE2 6 KB
897 B 76ms
55ms Fetch
application/json 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/sfeeds/560bd8d24d47fc28fc84259d/5f830ad4ff43030df4874653.json
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/feed.2678f6b68fa42dd5932e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e819f9811f335285d2b5ddbb807fcd28132233534b83f74a1b150897ec528c3

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:26:00 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 384
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=600, stale-if-error=28800, stale-while-revalidate=28800
cf-ray: 671c2ce76d1d2be9-FRA
request-context: appId=cid-v1:75ea8019-1544-4ba8-a6db-e73bdcff9d5b

GET
H3-29 200 exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js Show response
pagead2.googlesyndication.com/bg/ Frame 3563 35 KB
13 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/exkW1aWpcEgyfnSxaN04_gBnrAbbgfV_chCPI0EM_3k.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1916d5a5a97048327e74b168dd38fe0067ac06db81f57f72108f23410cff79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:12:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 790
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Jul 2022 12:12:50 GMT

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 0EE2 10 KB
10 KB 17ms
16ms Font
font/woff 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F550abe329445702310657a53%2F560bd8d24d47fc28fc84259d%2F34270135-00c1-4a61-88c5-45e4f527aa4f.woff&t=%20%25%2C.0123456789%3F%40ABEFGIKNPRSTUVabcdeghiklmnoprstuvwz%C3%B6%C3%BC
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/6418128/1611760407800/DE_T2_Indices_Germany30_spreads_prospecting-1-German-970x250-637473572063783250-8f138022-363b-4089-90b9-4ee4520246de.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90c95710ba1cef9c756a5fd09363d37d85ea65111716455492dbf90e43f00e14

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:26:00 GMT
cf-cache-status: HIT
server: cloudflare
age: 4142275
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=34270135-00c1-4a61-88c5-45e4f527aa4f-subset.woff
cf-ray: 671c2ce7ee6b2be9-FRA
expires: Thu, 02 Jun 2022 13:48:05 GMT

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 0EE2 9 KB
10 KB 16ms
15ms Font
font/woff 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F550abe329445702310657a53%2F560bd8d24d47fc28fc84259d%2F34467d9a-b412-4353-984f-b34c15f2df1c.woff&t=%20%25-.0123456789%40ACDFGHKMPabcdefghiklmnorstvy
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/6418128/1611760407800/DE_T2_Indices_Germany30_spreads_prospecting-1-German-970x250-637473572063783250-8f138022-363b-4089-90b9-4ee4520246de.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 758587a50488b2ccdb343223b165e45a2b7a1ef243360bfb94945918fc5cfb4b

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:26:00 GMT
cf-cache-status: HIT
server: cloudflare
age: 74285
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=34467d9a-b412-4353-984f-b34c15f2df1c-subset.woff
cf-ray: 671c2ce7ee6f2be9-FRA
expires: Tue, 19 Jul 2022 15:47:55 GMT

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 0EE2 3 KB
3 KB 22ms
21ms Font
font/woff 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F550abe329445702310657a53%2F560bd8d24d47fc28fc84259d%2F7937a7cb-b847-47af-b71f-e21aa9cf8ba3.woff&t=DEGINPRSUV%C3%84
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/6418128/1611760407800/DE_T2_Indices_Germany30_spreads_prospecting-1-German-970x250-637473572063783250-8f138022-363b-4089-90b9-4ee4520246de.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13d2e5ddca6bd10344fd7f22f4851ecb93164edd7fa64e8fe7cb119c447bd9d8

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:26:00 GMT
cf-cache-status: HIT
server: cloudflare
age: 4123595
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=7937a7cb-b847-47af-b71f-e21aa9cf8ba3-subset.woff
cf-ray: 671c2ce7ee722be9-FRA
expires: Thu, 02 Jun 2022 18:59:25 GMT

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 7559 2 KB
2 KB 23ms
23ms Image
image/webp 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fcmc-markets%2F560bd8d24d47fc28fc84259d%2Fimages%2F0f7d384c-494d-4b00-b910-80b6777b7929.png&w=127&h=95&q=90&f=webp&rt=contain
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12e58673d51613d17e9cff942a292face4e268e841809201f07c8c34a86c5143

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 12:26:00 GMT
cf-cache-status: HIT
api-supported-versions: 2.0
age: 18970
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 671c2ce90d702c26-FRA
content-length: 1854
server: cloudflare
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D078 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B4T5X1cD2YIWKNLOzx_APp4yJ4A8AAAAAOAHgBAI&bg=!PT6lPnrNAAZjFomlYxY7ACkAdvg8Wra2_Gq-vNhmBWdc4B9HwOfkAYK_Uc1Gkq8LfXSGOpGUo8p4AwIAAAHdUgAAAMJoAQcKACrDlFXGykm765GcdrXopkzpXaUWFF2q9kRyMKGSQzr0HYc1a9icYuW4lRSZAsplvZfG0luThu5dLBdtaEtYS_ksrh3uVRkgqLZf0UgSbL_P3rqItP_XwRNLQCtNxWNGA0jk3zlLOzAEl_MvHn10n7GXF2sfyc-bENi2ljnB9Zl2OVsmGisYbUc-DYeS-uwPVGHih9chbsGX7kn3Pwk6T6yv7hzNxmxGftR6NLT2CcO2G6Y6QJGOimnEBhln2ACv3bsBUCVQ4Ia4gJhun3g6dmKByqIiYAqzxEn7KIM0QI0LzBu8SStxRr7sfKfn5SZPhiSxEphccSXn_2lgX5kxZTOCBO2mDtu4TKD5ahD5euewwLWg2n1w_zLCbfliipbs3D3MZulHRWLncYSEy4Q17_3-yT7R9dZ7M2XJEONOu3_uxeNFfMAHTCGRRWG6sPNe3RebX8Sb1e6olPnO5YVtJxe7x4wz3KodbHg_460xcXlhdk5ghBIcbIMOh0XcYzg7me5aiHJsK8Aq3aI7yqjjDr7gVR6lI6rPMYizct2I7HvOBcIVF_695jSo9jlmmsKKq--WvGj53xUEQInInhBx0gU_rE5ITTv4kKYg9khAuw1sfCfMD-6Jo4fPIJG3d51ra4xybmhLHxmjeSz3TJYEmVBGm6TnqRiYo99z5o1N4ul2LVRxPcMHTo4J-SLEP7sULHRaKZ74cqbJ-eD1XJrZK6PeWtj8UoUFpjdkMwNWwVSb-VtYydKdRYx-qtN0QsO5yLsJ1k9Y7srMqWnqQ1Zj_fpChf7tlAoxz7B9j9rAeSCM3ubx08-5i4mTGJq3i5VnQEa30Dl2qAGWJBBhWImYUMsj2V2eXM9TAeA08gzD_iExfMZrkz07Wt8KjHM1U8n-K9Af4BpEXNPp5w8Txk7iCjgkflvqHzFOD_TUEcZP4AE2xKMUlXMJo1fFMCUWInM1yAnQLDFf-Nf5pBm6NaWRtTAYC07OOkTn4a151xDUtw2tMquamY_DB7Q

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:26:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 pixel
c.bannerflow.net/tr/v2/ Frame 0EE2 0
74 B 35ms
34ms Ping
text/plain 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/tr/v2/pixel
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/601182a03f381269088756dc?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssgziGHEK8sYLoVQ9dqzuBKDrZVfnh-xQY21IswE9TehEvV2W0kAakfCU4Kwhyk_Ku0b6XWE8IquBl1gIfrxJ_IxfCkt8asKRwdtZB7uVT0KKH7RoiCRT21aO5KLSQS76HXWjpzEDDoBzuZOnlfDwue7Wi0UhwBimRc_A0c8FH_AplnSD_06MCRq2VwSs0H9y9EklqNdzVQgskBtfnbvrY_7pAarlKvoeweO7WGA97jtrl8BOLD983WlGLqEghr__QtIUl6JYOGra1dDxGZMlqDDmCXmnFBq6k_KTcCgxG6V8JF2q8Oi7VKqRohagqPFE8XCM6zH0nlR5HlHS2LqwsESrU_xU3eevMvNuBDnGb4dXx9t3zsmBibi1zmnXS-eArJFww5seZlDLk0ijE6BLVL-ty848QQtUFw6-KLWKZ68e7bZcUggRGA64MWsFocsSyNJtLdzltl04JD18B4jykKQvNz9-to6mOD4-p1P0h3mrW8zxQdznHJ0bf6NexDcytB-QVXsQdISbjfVg4y-1SUazsMIQZ0s6bj8Jfupvvo0DIIsuTzp4h-n4peTaJcMaDeYJDZRIrprodeKJm2GUpQnyv46l-NTyh42eHo4EB-kY3hmSuPYadPDiJ6pjJQQXpXqcuKPQnkULBujAbhrXfwSQz8lnCmwF71DrRuzEmuA68Yobce7R-MHU24YNEAgfbRuxiX2P7xjZH9gVnKnmmyRcxm7b3lt3a5YuKpVvfT7ODhJ5zxPeC9lo4EoBy_devUCgKZdOJ3OhN1aekNtlR94DfPMisZMcAmNU9-yWKUjhu-g0I5qHcjsrRwyyNh7pxDpptpb9ovGWtDRjxwUh2eGcWU12EOufnPKU9DsgHFT5I5En8OHQIdUeifqj4DOAxCgk13hHzn8t_NRlzW12W--Gmeei2A4cTSsUk%26sig%3DCg0ArKJSzII6z-1Q4lqxEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgermany-30-traden-v2%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-germany30-prospecting
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 20 Jul 2021 12:26:00 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 671c2ce97e532c26-FRA
content-length: 0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
request-context: appId=cid-v1:1d9bcaa3-5ddc-4e5d-973c-949d7ceab63e

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20210712&jk=1916660871290691&bg=!9_Sl9LDNAAZjFomlYxY7ACkAdvg8WsvNvboHkxxdvTsLmoqm6mJDz3l7dxe9c4_NdUvDUjpAENM_OQIAAACYUgAAAA1oAQcKABLJ79Rb-5OO0jI2-hFHenN3M9aZAm1JMd9bSi-8T2W8lStnKjnPMd_PHCvao74LuoImsSZPrllGTLwM-g8btgbhNVLrC_HrGOxNo-A5378ix7LAHHoWblBwBCOqThd4GXesksPWbMPezZLrSLkII6OYNWsj9RM-BFdpiWONVcExzMRKeqy7ttJzqOWhItwggsB-LrLjx8z4YcwUrSk_XbKV9a6bh7M95W1f7xYMvPJxvK6fDS38MwRB--7ClmQNB1ETCsU3kvSl28ewsJGEG_Lz47uRlLq-S7ERs5-C_mDGJqJMRPmSM9Ub_x-CSXeVCaXQFHRm3SluV9llNgrWNNe1OR2xyW0tfrZmcg4WKcetxiNHC065E3K6Jjtl8lkVg0tP1qRHIe-q7-HXEdn9Co_zsJ_Nra8-02-Pt7H_obRq_XhYcUyon9CnB7IC8EQNZ-7dx951idYjKbgwOu_PiUYnVlPTY2gFNSqLgTgJcjob3t2l0xlkN8RYWIjdAHumhyA5O1U_Gky_CHXQfLqw4EAvMVt07dUy1ld504ibCmb79MXYZXgOgd0lVzcpeL7WDRTqqGHrR-29lmgEskJxzdf1O6hhwMmPSY51WWcrwhStmDgzrdNy5VqkeMmYe2tYihSWDggmpFS_eluU0y5DjvbLF2X49BpMwPsQf3QprqZeFGGxPuuuYGp9TFPwVHaAxhc_gtQjczx0xsiH8vrfspgkTYwl8lvO1NAKAGX6-erCavOn9ax_IKMxLVJnt3YR4ikLFqSeZ2T6f2KV-NEisZamFPW9SYMAJlVQgmFxwuAJ1FEAewWvJ_N2HspQcISGP5yYuDPLvJprFkx7JHRnBvSZZdM

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ondequando.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:26:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 6.gif
p4-givzykgrqtkzy-nmwjlooz37abvag6-894477-i1-v6exp3.v4.metric.gstatic.com/v6exp3/ Frame 25FF 35 B
427 B 51ms
15ms Image
image/gif 142.250.186.114
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p4-givzykgrqtkzy-nmwjlooz37abvag6-894477-i1-v6exp3.v4.metric.gstatic.com/v6exp3/6.gif

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.114 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f18.1e100.net

Software

sffe /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:26:08 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 6.gif
p4-givzykgrqtkzy-nmwjlooz37abvag6-894477-i2-v6exp3.ds.metric.gstatic.com/v6exp3/ Frame 25FF 35 B
427 B 50ms
14ms Image
image/gif 2a00:1450:4001:808::2012
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p4-givzykgrqtkzy-nmwjlooz37abvag6-894477-i2-v6exp3.ds.metric.gstatic.com/v6exp3/6.gif

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2012 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:26:08 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIxci8v9Lx8QIVs9kRCB0nRgL8EAEYACDfu59F;met=1;&timestamp=1626783969451;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 9A35 42 B
254 B 43ms
41ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIxci8v9Lx8QIVs9kRCB0nRgL8EAEYACDfu59F;met=1;&timestamp=1626783969451;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Jul 2021 12:26:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1q-MyaV8gw3_00MrrwAABHkAAAAB&google_gid=CAESECwWgaBMltRtFXw9YsNs0rs&google_cver=1&google_push=AYg5qPLGueHD41qvs1dPCf4EmFhTzVb4DCN6LMXbAlAKaVt0THo-rDdSx3S14AyuwaIzYbrPSiqc22_EyYHibCXdEYxWRz11OOk

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_cver=1&google_push=AYg5qPKioBPwjYoy-hwPPkGbiEtEOet85U3muvzGsMXzcw7xnFeFA_Lscvcb4xb5YFRg681BYzcJlnRGjLzEmbRkzNXCwT5R9BJq6Q&google_gid=CAESEMDhazBwRaGI2F8smTXHB_k

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YPbA1ycGYPYcT80t4s4nBAAABMQAAAAB&google_gid=CAESEBNhIi1dmMhK4iGqEplN_R4&google_cver=1&google_push=AYg5qPISrgc1GAcm0I5fgmmxt8Q7HeBI4h2c-7LSJhn6ZDrCt69rhufkwO3qCTWiHITrMRsh_IYa39QsYaIOm4N1suRL9CWxalc

Verdicts & Comments Add Verdict or Comment

96 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 19:53:07	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-19 19:53:04	Name: test_cookie Value: CheckForPermission
.doubleclick.net/	1970-01-20 05:14:39	Name: IDE Value: AHWqTUkc2K_KnIrKTuVROp-JvszBMbW8rTa2a5yct4uhjE6gF-o9sa-kjAdUrNtlgEc

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://ondequando.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2(Line 2) Message: JQMIGRATE: Migrate is installed, version 3.3.2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ade.googlesyndication.com
adservice.google.com
adservice.google.de
ag.innovid.com
ajax.googleapis.com
c.bannerflow.net
cdn57.androidauthority.net
cimg.co
cm.g.doubleclick.net
cms.quantserve.com
customketodiet.com
d.agkn.com
e.dlx.addthis.com
en.cryptonomist.ch
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
image6.pubmatic.com
images.dailykos.com
ondequando.com
p4-givzykgrqtkzy-nmwjlooz37abvag6-894477-i1-v6exp3.v4.metric.gstatic.com
p4-givzykgrqtkzy-nmwjlooz37abvag6-894477-i2-v6exp3.ds.metric.gstatic.com
p4-givzykgrqtkzy-nmwjlooz37abvag6-if-v6exp3-v4.metric.gstatic.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
pixel.rubiconproject.com
rtb.openx.net
s.yimg.com
s0.2mdn.net
static.doubleclick.net
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
cm.g.doubleclick.net
142.250.181.226
142.250.184.194
142.250.185.163
142.250.186.114
151.101.194.109
179.188.52.153
18.194.175.178
185.64.190.78
216.58.212.162
23.45.99.241
2606:4700:20::681a:276
2606:4700:20::681a:f79
2606:4700:3031::6815:1f21
2606:4700::6810:c40
2620:116:800d:21:f916:5049:f87f:108e
2a00:1288:80:800::7000
2a00:1450:4001:800::2003
2a00:1450:4001:802::200a
2a00:1450:4001:808::2006
2a00:1450:4001:808::2012
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2002
2a00:1450:4001:812::2002
2a00:1450:4001:812::2003
2a00:1450:4001:813::2002
2a00:1450:4001:827::2004
2a00:1450:4001:827::2006
2a00:1450:4001:827::200e
2a00:1450:4001:82b::2008
2a00:1450:4001:82f::2002
2a00:1450:4001:831::2001
2a00:1450:4001:831::200a
2a05:d01c:1d8:8102:3268:e5ec:7f57:13ef
35.227.252.103
52.18.11.109
69.173.144.138
94.31.29.250
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
042241b05794b40afd81be4b88a728b7244f74a758e62085b07f40c1f7dc2c30
0572434f304cd5ec69c30c963c92e5b13d59eaff0648dd6eb7f8c6e4e87c7375
05833c23cd103d9e23eb9e95d75dce1b2fc9b12bb83ae3edd196eeaf9e0caac6
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
062368677bcefd9495e8b320e0cf22c4faca9f1bc04666efeb9cd5307cd591a4
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
116acec5db11b97c811de6143642ae413dd788ece902a0272af9580441b30e7c
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
12e58673d51613d17e9cff942a292face4e268e841809201f07c8c34a86c5143
13d2e5ddca6bd10344fd7f22f4851ecb93164edd7fa64e8fe7cb119c447bd9d8
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
184219666ef52ac2063094d9ca1b1aecdb2bd120365a624f1d7549132b9bb1e2
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
1f49b8706547682e2c5ed6642a2f2dcbd287da458314b967c60d774aa7edb473
20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4
244de6960388f992e43c07685dd8c7ca1ee4424d85874a72036f2f8e692bbd7b
27486204566d22226bf08f48892760acda399a742aa746f69ffc7e784588dcff
276a16a80fbc4e1d4cc2b7519af58b07356eb23f0ff74ff5752e0bda14f63086
29cf8017e7feb7027456e22eec498f7a49e7f4a522c964c8fe77c3881545d0c0
2c8371f7333ea7e9e7b7694e28ddc994a68af8537972a631968bdc94f0e98206
2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde
2f63c236aaf495fbaa93be3b203e7721a679fbd60ce63a3f1572403a003719d7
2f78d9baf1bfc9f2b6acde94750d85c1ae6d397b2c617ab3021b4b4d16470004
368dc1e44e63278240899b9def832d0036482f9e5c7f2eb281961cab15e570f2
38817a74140cf776573a0449151634e3b0d493f406326904cd33fdfe93fddb24
3a3c29f0c95c05e40b01032aa3667d9a109f5eba5dd9fe585506b4d2d871b196
3a6781d697ce6a9cdd009991f9c23e9051714ccec7d44c13927369b458b1fb7b
3be417f455129283fc4fb8f9ee5bc2af0572838dc65f2dd6ab7daa6202cba6c2
3d962b24494e71668adc2978469676925b153faa1de0d801b84c4ad125262c47
405f7043ce07284aadcd74105c2551a62e9f58d592142d23f709954383665220
406075ccf8524e6303e954e8d3147a67a0836fd8203eebfc952dbeaaf7bd99ea
41cc00cdd89e57c3642515cb75ce51a7547713f3b8e649d7d6bc738750960064
4427a7a29dd9086c912a5c9ae99901585889e2e24f4120a13c69e8c13a49ce88
4429cf5dcd1953008d758abb183364604906af06b8fdfbfd5ccd61956f3b1e9f
47c3fa441133af75607d03448b95de43df4b6aba921c71e3e9a68055f8db06e6
4834aa58000857ce42bdc4ae2322104fbbb5c0e96a7dbd4deab73900ae9d23a7
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e0781bdd2cbb5db04da3b5e059eeca34e325fabb893bee7457b5babf5b7c029
4e819f9811f335285d2b5ddbb807fcd28132233534b83f74a1b150897ec528c3
4f0fb5e7aee1812174996e6d522c9920704a3c9397d1599000fa9a79070e446d
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
52cba504db8540c0ce693d325ae20b20730dbe808cd3f57706d38371c7c19932
5338e3d28fb742ee332b4ca0bcfa0b383fed8c021540bc8c7ef75ded7cca749c
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
561dd6ae411549407cbdb04459b7774cdca219e8dbbeddc16d2443eb12e43a31
575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e
5820216486981914837a6b4f07dc46f6969a726d301a867b6043b149fab43ec7
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
5a8c623b34dcf729895c3bc9b6e261796bbad69555a21ad6d2f9b4e7bc27b6e7
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5c9a08f74bb30c290fa2f22d8be1c87ad1ebaa19cdabfcbbd0117caa6538d529
5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a
60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827
686c99fc0596a370704c29139e82d23bfcfa193e6e4464916c3b91a114ae2242
6a16c04229bc2b4da226eb97e68d94f49ba6437b7b5e16c14a101b21a29384e9
6a2450a9523ba4d5b6d6dac5f7a86da5927b3e35e8592b57167636adca203d4a
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
743c8064e2b1f38a1b44de4d4ac3a99bb9c11a69a16360433076b5d93b815181
7442bdc19b28d69a3c440ac966444e5a94f209b2441102de9395dd282f223275
758587a50488b2ccdb343223b165e45a2b7a1ef243360bfb94945918fc5cfb4b
76ec101fa2e578dd3742058d953aed16b74efa3552eeab3b3f669543e9d0bfa3
77d2cbdd8a3d06678d37227e4f4b8dc09cb17619d8364b84a0ad14b4b6f5652a
79aa2ea675fee615ed72d18532ada370afa3486a35a0d3e367c81dbbc679ab4b
7b1916d5a5a97048327e74b168dd38fe0067ac06db81f57f72108f23410cff79
7b45d96980648bb952dc5e4f3aa047b147ad990e2d9092b5d974489278e56ba4
8240ea20f4bb5fcc00f41228776b641b2128fccc99bc520497c13128a1fa304c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8767f01caa430c5bd4e3b008a8e9dfe022156a4e91a23c394fdcb05c267f1b94
87ea00897f4e3c60c390adfd29fdaf1ff8063f5d50a1a7f43572858892547bf8
88aaa00ed63445a1d87d9d2c4473d0b8ed19a8365c8fdfa5b4ce13580229fcc7
8c2fc8ddf1d2d2373f21d8f2f72734359815e93337497e68178cb04c839c8635
8ca82708deb53fb3752e69904826d70c4d303a60186b5a06c94a497e54ff9344
8d450db79b0f7039b6486a399d93ebe1efa7a81e0f7b1170931b8b3dddf4a31d
8ff3cc1fa2ce18f109e6332945beecffbead0cf2b99041ce6facfa98c4a15cef
903503fef0e56dba480f01ad5236530913c604a000e3faf8f053a75d35779b33
90c95710ba1cef9c756a5fd09363d37d85ea65111716455492dbf90e43f00e14
93c964e1bd5719c525c73073cf64f4c2b03dd6d4fa846d5bce3142596b3f1e97
98b8f9bfd539b6cbc2e9799145d307afb6d75dd8b7b945e421e0aaccac254570
99983406ef0086522602b03f6a0ced605347721777f81799a03acb9bb16d8e48
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b09fb29de36cb7bc57a4df206368485cbfd8b072daabc4e6057789df1075ca3
9b5312cb2f154f2bd64ee8746195a63df254d10bfd107a61eec3d5d38dd48bff
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a4821efbb365f98b9800907f50ab15ddb3b93b0f1e81f81cb5da717977203f31
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a56c62be9652c7b6b85be1e24dab707f15623d73cde436958c4ef74e3b5b68d7
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a6f8bfaef875088ab0791e9118f7884ddfb82296331ba2b32b5598298c941293
ada3dee5caeaa7b6531724b208f952faec6476488bc8479a26faf59a94384607
ae239fe133ab8e6a3798abc3029c4717ef0d59c744425413fe16a200aedd46d6
b6904dd3786abf2a13d9e3eebc371d27f65ffa4bae3d23ce1aa3f69b8b4962a9
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79
b72cbad51b7a44789fcce6b237621a000e9a9e59c5cb1a2a98b38fec5842ccf6
b79a0e972fa8ca39bb0ead6c16b1463a49766a5b71f3fd63421a8093c3a0b595
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27
be3c2e92383f1bd7f36a2fe433507c3a04963568f322f991cc05b327e090d777
beeb3034dc9ef41ff7c3b82a8f7df118fa46581fe24702196ead6b49d9217b27
bf338602193a1ec3cc1ecf26b314d4ca247d13fd78a76657f453a8658830c8a3
c69df3576451f8ece9a8486a4bdda41819546aa2d6683a0147c933a2ff4d87b2
caacfc6a3602fe9a189a4bd15792c4bed2fce634c04716f515e6c07cda07315a
cbb8aa2fb97998bb9c3e02047bd6629438c209e65be31f2ffeee514ea19b2a44
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cd398be1a91817126cef10224738e624358edf6f08043abad7e60c1aaeccc8d0
cedbe4172f9b07ffce42070f81251af7ab3fc0d3bc5f49e46888f3aa06d8bdfe
cfc2c67f6c3d4cf6b501a0432e846b533ee5aad4ed97b3fbe5eb1015d87689dd
d072b8763ed1dc4d56de6bd39069a07fb38a4e4e13f87b3f1f27184aeeea146e
d125872944107e62b360bd1c4472ca833c0b113ef2b51270b31e1cdcb3312982
d1d7fbe6bec9bd03e502a969d897fe72fab54b4ea09152e633525a6ed39624ce
d4fb515f61558f8d6347fb3bec9e43cc94a3dededdb1abc1845af203314ef51b
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d67db8df40e5c7ba3989412bb48c5db9cd64179c9d9207205fa9dce811b4d09a
d6e7a70a04633375adce73fc0d2daad4617fd0103970e4b13a9a938c7db14d9e
d867f01ddeb0046fff1579890a34e0f0aca6b83f0380181c8d81ca38429bd43c
de55a09126505ab0d6af77f359a8d02c1bfefe51331a6bd17fba13a03a0247d0
de55a1d585b98ab3be04fd9d7e0cebc80b5c42ebbaedd70a1106ebfaa12961b7
e2dfb831202ab583e5140739b58d3bd1c3a2897ab1a4bc0a61bb9bda3710ff92
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5ecfcec3e27fe9897118aabcbd06b14a055e27fdff3fbfd82e4b35336c3f7fe
e7ecc7541c3f4b77619a8f7a13e2b97d8286b5e1752fec07cc440b7e93b23d67
e9a5501e7bf12574279eba4363d517cf7e73b55156446f65b12f5d7874cc0a70
eba8b365bc41d6fd429e0a8af3cec81f1ed553b2dbfebe997c4d381d48cf3d41
ec5e59043b1f3481947f7b56c5287599d0ca6a2c3f0d1bf79049d662a4ba1ef0
ecf3fc806320c52bb5999a10cedb7d54d084bb394b9941d2d055181dedc4ee70
ee07009e9fe79b9909bafdb282106c95dac83f905c6ac665e1257ac862ed50e1
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df
f7ec795d6ca0df8d0083c41b1a57aed9a3500897442639a0c24999a749eed08a
fae185d1fec7bb099c26b01cc737061adaae5b9fab32fc2e73b1cc185881bb43
fea46492526c07103d9d5d0013d41026feb67019fd2466e4bd0466d2879369a3
ffc9421da7060c0407a14a74ada1902a7cd5571c16340451eda1ae0d3d4b8a67

ondequando.com Open in urlscan Pro 179.188.52.153 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

233 Requests

99 %HTTPS

62 %IPv6

27 Domains

38 Subdomains

32 IPs

5 Countries

8608 kBTransfer

12067 kBSize

3 Cookies

9 Outgoing links

Redirected requests

233 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 12 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

ondequando.com Open in urlscan Pro
179.188.52.153 Public Scan

Screenshot
Live screenshot

Full Image

233
Requests

99 %
HTTPS

62 %
IPv6

27
Domains

38
Subdomains

32
IPs

5
Countries

8608 kB
Transfer

12067 kB
Size

3
Cookies

233 HTTP transactions
12 data transactions