www.mediafire.com Open in urlscan Pro
104.16.203.237 Public Scan

URL: http://download2389.mediafire.com/6e4bow33uoug/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip
Title: Download (77.24KB)

URL: https://facebook.com/share.php?u=https://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Title: Post to Facebook

URL: https://prf.hn/click/camref:1011ldfGq/destination:https%3A%2F%2Fstore.winzip.com%2F852%2Fpurl-mediafire
Title: WinZip for PC

URL: http://blog.mediafire.com/
Title: Company Blog

URL: https://vividengine.com/
Title: On-Demand Video Encoding

URL: https://mediafire.zendesk.com/hc/en-us
Title: Support

URL: https://translate.google.com/
Title: Translate

URL: https://twitter.com/#!/mediafire

URL: https://www.facebook.com/mediafire

URL: https://twitter.com/mediafire
Title: Twitter Page

URL: https://blog.mediafire.com/
Title: MediaFire Blog

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip HTTP 302
http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://translate.google.com/translate_a/element.js?cb=googFooterTranslate HTTP 301
https://translate.google.com/translate_a/element.js?cb=googFooterTranslate

Request Chain 123

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0

Request Chain 124

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YnQ2rG.yLCFodLOQqdxEsgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2

Request Chain 125

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1

Request Chain 126

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D

Request Chain 127

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0

Request Chain 128

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YnQ2rG.yLCFodLOQqdxEsgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2

Request Chain 129

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1

Request Chain 130

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D

Request Chain 131

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0

Request Chain 132

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YnQ2rG.yLCFodLOQqdxEsgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2

Request Chain 133

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1

Request Chain 134

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D

Request Chain 158

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0

Request Chain 159

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YnQ2rG.yLCFodLOQqdxEsgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2

Request Chain 160

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1

Request Chain 161

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D

Request Chain 200

https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID} HTTP 302
https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=cddefabb-d046-0d5e-003b-d744138776dc HTTP 302
https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=cddefabb-d046-0d5e-003b-d744138776dc&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=cddefabb-d046-0d5e-003b-d744138776dc&apid=UPdd72e7ca-ccb3-11ec-ad6d-0e6bcaaa15b3

Request Chain 201

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D HTTP 302
https://id.rlcdn.com/464246.gif?partner_uid=b6dc0654-c56b-0177-0c65-96bdbdbfe36d HTTP 307
https://id.rlcdn.com/1000.gif?memo=CPaqHBIvCisIARCUaxokYjZkYzA2NTQtYzU2Yi0wMTc3LTBjNjUtOTZiZGJkYmZlMzZkEAAaDQiu7dCTBhIFCOgHEABCAEoA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=464d7d30b6518efbba3143bcd2c49557d6f5c4609d8e1f94b6dbe62028b49cb9791426b5417dce21&_=2 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA0NjRkN2QzMGI2NTE4ZWZiYmEzMTQzYmNkMmM0OTU1N2Q2ZjVjNDYwOWQ4ZTFmOTRiNmRiZTYyMDI4YjQ5Y2I5NzkxNDI2YjU0MTdkY2UyMRAAGgwIru3QkwYSBAgCEABCAEoA HTTP 302
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA0NjRkN2QzMGI2NTE4ZWZiYmEzMTQzYmNkMmM0OTU1N2Q2ZjVjNDYwOWQ4ZTFmOTRiNmRiZTYyMDI4YjQ5Y2I5NzkxNDI2YjU0MTdkY2UyMRAAGgwIru3QkwYSBAgCEABCAEoA&google_gid=CAESED2LnKGND2Sxq2QzJb2RlzQ&google_cver=1 HTTP 307
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
https://idsync.rlcdn.com/458249.gif?partner_uid=f0f237e7-d951-4c14-a077-f67d2fa22453

Request Chain 202

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072399&val=7233196276395417059

Request Chain 203

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=bbcc054f-1486-8ced-9312-94d9ec174955 HTTP 302
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=bbcc054f-1486-8ced-9312-94d9ec174955&dcc=t

Request Chain 204

https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537073061&val=4340293576127443608&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 207

https://match.adsrvr.org/track/cmf/openx?oxid=e31a7932-082c-3717-531c-164e842482b5&gdpr=0 HTTP 302
https://match.adsrvr.org/track/cmb/openx?oxid=e31a7932-082c-3717-531c-164e842482b5&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=d4396f28-50d4-4d4e-a51a-cb83679a13f4&ttd_puid=e31a7932-082c-3717-531c-164e842482b5&gdpr=0&gdpr_consent=

Request Chain 209

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECbmQn01s9Kew4Q8ssH23tQ&google_cver=1

Request Chain 212

https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D2947849421455677000V10%26type%3Drkt%26refUrl%3D%26vid%3D17833427812947849421455677000V10%26ovsid%3D%7Buserid%7D HTTP 302
https://contextual.media.net/cksync.html?cs=8&vsid=2947849421455677000V10&type=rkt&refUrl=&vid=17833427812947849421455677000V10&ovsid=978758878463434645

Request Chain 213

https://sync.go.sonobi.com/us?https://contextual.media.net/cksync.php?cs=8&vsid=2947849421455677000V10&type=son&refUrl=&vid=17833427812947849421455677000V10&ovsid=[UID] HTTP 302
https://contextual.media.net/cksync.php?cs=8&vsid=2947849421455677000V10&type=son&refUrl=&vid=17833427812947849421455677000V10&ovsid=3a9cdcbc-0785-40a1-8503-eec7b79ff17e

Request Chain 214

https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=Mjk0Nzg0OTQyMTQ1NTY3NzAwMFYxMA%3D%3D&google_sc=1 HTTP 302
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEDs9jA-JQ_lMJR8uYZ_gRkU&google_cver=1

Request Chain 215

https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2947849421455677000V10%26type%3Ddxu%26refUrl%3D%26vid%3D17833427812947849421455677000V10%26ovsid%3D_wfivefivec_ HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2947849421455677000V10%26type%3Ddxu%26refUrl%3D%26vid%3D17833427812947849421455677000V10%26ovsid%3D_wfivefivec_ HTTP 302
https://contextual.media.net/cksync.php?cs=8&vsid=2947849421455677000V10&type=dxu&refUrl=&vid=17833427812947849421455677000V10&ovsid=YpChVCIA1NMIiO5

Request Chain 216

https://dis.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40 HTTP 302
https://widget.us.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40 HTTP 302
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=7d99c762-cb8f-4e89-b81b-7e4b2c7ad078

Request Chain 217

https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1 HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1 HTTP 302
https://t.pswec.com/bsw_sync?ssp=medianet&bsw_user_id=231be018-78da-479d-904d-594181f00728 HTTP 302
https://t.pswec.com/ul_cb/bsw_sync?ssp=medianet&bsw_user_id=231be018-78da-479d-904d-594181f00728 HTTP 302
https://x.bidswitch.net/sync?dsp_id=2&user_id=a0f47327-9cc8-4074-83df-a631eca8258a&expires=3&user_group=1&ssp=medianet HTTP 302
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=231be018-78da-479d-904d-594181f00728&gdpr=&gdpr_consent=&gdpr_pd=

Request Chain 218

https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2947849421455677000V10%26type%3Dzem%26refUrl%3D%26vid%3D17833427812947849421455677000V10%26ovsid%3D__ZUID__ HTTP 302
https://stags.bluekai.com/site/23178?id=VNQ85x4uTrTd9yHMbrFh&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPKWJZITQNLYGR2VI4SUMQ4XSSCNMJZEM2BGOJSWMVLSNQ6SM5DZOBST26TFNUTHM2LEHUYTOOBTGM2DENZYGEZDSNBXHA2DSNBSGE2DKNJWG43TAMBQKYYTAJTWONUWIPJSHE2DOOBUHE2DEMJUGU2TMNZXGAYDAVRRGA HTTP 302
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPKWJZITQNLYGR2VI4SUMQ4XSSCNMJZEM2BGOJSWMVLSNQ6SM5DZOBST26TFNUTHM2LEHUYTOOBTGM2DENZYGEZDSNBXHA2DSNBSGE2DKNJWG43TAMBQKYYTAJTWONUWIPJSHE2DOOBUHE2DEMJUGU2TMNZXGAYDAVRRGA HTTP 302
https://contextual.media.net/cksync.php?cs=8&ovsid=VNQ85x4uTrTd9yHMbrFh&refUrl=&type=zem&vid=17833427812947849421455677000V10&vsid=2947849421455677000V10

Request Chain 219

https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=2947849421455677000V10 HTTP 302
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=medianet&ssp_user_id=2947849421455677000V10 HTTP 302
https://contextual.media.net/cksync.php?type=mf&ovsid=34b37528-e7c1-4006-82da-eb64ea64bb68&cs=1

Request Chain 220

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1 HTTP 302
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=d4396f28-50d4-4d4e-a51a-cb83679a13f4

Request Chain 221

https://ad.turn.com/r/cs?pid=59&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2947849421455677000V10%26type%3Damb%26refUrl%3D%26vid%3D17833427812947849421455677000V10%26ovsid%3D%23USER_ID%23 HTTP 302
https://contextual.media.net/cksync.php?cs=8&vsid=2947849421455677000V10&type=amb&refUrl=&vid=17833427812947849421455677000V10&ovsid=4210252136887120536

Request Chain 222

https://c1.adform.net/serving/cookie/match?party=14&cid=2BD6383B-EB9B-4D75-BC9B-303FC59BA72A HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=2BD6383B-EB9B-4D75-BC9B-303FC59BA72A

Request Chain 224

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:e29b6274-36af-4600-9bee-c9975b7a0515&gdpr=0&gdpr_consent=

Request Chain 225

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent= HTTP 303
https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1 HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCU0hrN0U2RzBBQUNSenN2endzdw&bee_sync_partners=sas%2Cpp%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABSHk7E6G0AACRzsvzwsw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Csyn%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2%26userid%3DSMART_USER_ID HTTP 302
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pp%2Csyn%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=1530009351359445541 HTTP 303
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AABSHk7E6G0AACRzsvzwsw&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D1530009351359445541%26bee_sync_partners%3Dsyn%252Cpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3 HTTP 302
https://match.prod.bidr.io/cookie-sync?userid=1530009351359445541&bee_sync_partners=syn%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=3&ev=AABSHk7E6G0AACRzsvzwsw&pid=558502&do=add HTTP 303
https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AABSHk7E6G0AACRzsvzwsw&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D1530009351359445541%26bee_sync_partners%3Dpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4 HTTP 307
https://match.prod.bidr.io/cookie-sync?userid=1530009351359445541&bee_sync_partners=pm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=4 HTTP 303
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABSHk7E6G0AACRzsvzwsw

Request Chain 226

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=K9Y4O-ubTXW8mzA_xZunKg%3D%3D HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

Request Chain 227

https://idsync.rlcdn.com/420486.gif?partner_uid=2BD6383B-EB9B-4D75-BC9B-303FC59BA72A HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=464d7d30b6518efbba3143bcd2c49557d6f5c4609d8e1f94b6dbe62028b49cb9791426b5417dce21&_=2 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA0NjRkN2QzMGI2NTE4ZWZiYmEzMTQzYmNkMmM0OTU1N2Q2ZjVjNDYwOWQ4ZTFmOTRiNmRiZTYyMDI4YjQ5Y2I5NzkxNDI2YjU0MTdkY2UyMRAAGgwIru3QkwYSBAgCEABCAEoA HTTP 302
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA0NjRkN2QzMGI2NTE4ZWZiYmEzMTQzYmNkMmM0OTU1N2Q2ZjVjNDYwOWQ4ZTFmOTRiNmRiZTYyMDI4YjQ5Y2I5NzkxNDI2YjU0MTdkY2UyMRAAGgwIru3QkwYSBAgCEABCAEoA&google_gid=CAESED2LnKGND2Sxq2QzJb2RlzQ&google_cver=1 HTTP 307
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
https://idsync.rlcdn.com/458249.gif?partner_uid=e89162e0-3f04-498e-94da-f5ce22164bb0

Request Chain 228

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=e5d86274-36af-4800-8053-1675195b2126

Request Chain 229

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MkJENjM4M0ItRUI5Qi00RDc1LUJDOUItMzAzRkM1OUJBNzJB&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 230

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEPb1SulgVnyDh5SJA2xEads&google_cver=1

Request Chain 231

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:10F3DF466C594944ACE9202DECB587F8

Request Chain 232

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4210252136887120536&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 233

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=d4396f28-50d4-4d4e-a51a-cb83679a13f4

Request Chain 235

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=2BD6383B-EB9B-4D75-BC9B-303FC59BA72A&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-dAJTAjJE2uXua4NbCf.hq2_DuoTedyk-~A&gdpr=0&gdpr_consent=

234 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request file Show response
www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/
Redirect Chain

http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip
http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

306 KB
86 KB

317ms
317ms

Document
text/html

104.16.203.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

HTTP/1.1

Server

104.16.203.237 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

921e9070ad54217fe2d1d8c809671d76e46ea3b420485abe58bf839954a68572

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin: http://www.mediafire.com
CF-Cache-Status: DYNAMIC
CF-RAY: 706c4d48aaa8a1e0-YYZ
Cache-Control: no-cache, no-store, must-revalidate, max-age=0 post-check=0, pre-check=0
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 05 May 2022 20:42:18 GMT
Expires: 0
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}
Pragma: no-cache
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-Robots-Tag: noindex, nofollow

Redirect headers

Access-Control-Allow-Origin: http://www.mediafire.com
CF-Cache-Status: MISS
CF-RAY: 706c4d45eef6a1e0-YYZ
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Thu, 05 May 2022 20:42:18 GMT
Location: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 104 KB
40 KB 102ms
54ms Script
application/javascript 2607:f8b0:4006:822::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-829541-1

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2008 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d42426d5191a98fe39cb7cb62c929fefceb725138fc3e50fb6136d2e018ce7f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:18 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40763
x-xss-protection: 0
last-modified: Thu, 05 May 2022 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 05 May 2022 20:42:18 GMT

GET
H2

200

element.js Show response
translate.google.com/translate_a/
Redirect Chain

http://translate.google.com/translate_a/element.js?cb=googFooterTranslate
https://translate.google.com/translate_a/element.js?cb=googFooterTranslate

76 KB
26 KB

46ms
46ms

Script
text/javascript

2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://translate.google.com/translate_a/element.js?cb=googFooterTranslate

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

88f69d70811bd74df10660445af604961709c749144a332f3179d51d05f29709

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:18 GMT
X-Content-Type-Options: nosniff
Server: ESF
Cross-Origin-Opener-Policy: same-origin-allow-popups
X-Frame-Options: SAMEORIGIN
Content-Type: application/binary
Location: https://translate.google.com/translate_a/element.js?cb=googFooterTranslate
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Length: 0
X-XSS-Protection: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 AGSKWxXxhCjA0376PEJRKvPbYABIeaqFcJOARWkOOyVBNfrKKqu3hGNujPnDlFLsbJnzVyv6SNOTkimv2wm82c-AdjA= Show response
fundingchoicesmessages.google.com/f/ 91 KB
33 KB 114ms
58ms Script
application/javascript 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXxhCjA0376PEJRKvPbYABIeaqFcJOARWkOOyVBNfrKKqu3hGNujPnDlFLsbJnzVyv6SNOTkimv2wm82c-AdjA=

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1a9610cf75575f3a148de94b8c19c859bc704cd724bcbc68314767992b5db78b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-qKVCAcgt82QT1Ax0ebfxzQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-qKVCAcgt82QT1Ax0ebfxzQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-qKVCAcgt82QT1Ax0ebfxzQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-qKVCAcgt82QT1Ax0ebfxzQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
date: Thu, 05 May 2022 20:42:18 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
28 KB 93ms
37ms Script
text/javascript 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a104-77-243-115.deploy.static.akamaitechnologies.com

Software

sffe /

Resource Hash

3807cb26c5451c583121fc1f10dda31d3a1a8648e0f83bb7a447c865df5d16e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28365
x-xss-protection: 0
server: sffe
etag: "1206 / 489 of 1000 / last-modified: 1651780199"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 05 May 2022 20:42:18 GMT

GET
H/1.1 200
OK prebid5.17.0.js Show response
www.mediafire.com/js/ 263 KB
79 KB 36ms
35ms Script
application/x-javascript 104.16.203.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.mediafire.com/js/prebid5.17.0.js
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.203.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6dc7917529ca101209b15752c61816375bbbb8b7b9809efb540ccacf45748d09

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:18 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}
Age: 267626
Cf-Polished: origSize=269036
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 25 Oct 2021 17:23:40 GMT
Server: cloudflare
ETag: W/"6176e81c-41aec"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Expires: Wed, 01 Jun 2022 18:21:52 GMT
Cache-Control: max-age=2592000
CF-RAY: 706c4d4aedf1a1e0-YYZ
Cf-Bgj: minify

GET
H2 200 amplitude-8.5.0-min.gz.js Show response
cdn.amplitude.com/libs/ 68 KB
22 KB 74ms
21ms Script
application/javascript 13.225.231.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.231.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-231-16.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4

Request headers

Referer: http://www.mediafire.com/
Origin: http://www.mediafire.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 15:38:36 GMT
content-encoding: gzip
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 16952623
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 22154
access-control-allow-origin: *
last-modified: Fri, 13 Aug 2021 22:37:42 GMT
server: AmazonS3
etag: "660c3b546f2a131de50b69b91f26c636"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
x-amz-version-id: NY8_7uBz3xoXYJBVsMSBAGHOz8ixMBS3
via: 1.1 0abfc04b3868b6760be5e12dccdfc7d4.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: JFK51-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: VOqWlhpmC1o5bhU2UiWlLu8HdfibxGwH9Mb6AMO3kXiGSDdUHsrXAw==

GET
H2 200 aax.js Show response
c.aaxads.com/ 628 KB
156 KB 199ms
131ms Script
text/javascript 104.77.243.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://c.aaxads.com/aax.js?pub=AAX3221EY&hst=www.mediafire.com&ver=1.2

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.243.115 Billerica, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

002895cfc155db599a8a5646ebe526bb033e4272493f3480c6de28fed4f28648

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Thu, 05 May 2022 20:42:18 GMT
vary: Accept-Encoding
x-mnet-h: E
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=1800
content-type: text/javascript; charset=utf-8
expires: Thu, 05 May 2022 21:12:18 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 205 KB
65 KB 69ms
34ms Script
application/javascript 2607:f8b0:4006:822::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2008 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

797098e82eb4061fe455f0775bf3308cd80bf7d5413cb6ef1420e66067c33bdf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:18 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66124
x-xss-protection: 0
last-modified: Thu, 05 May 2022 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 05 May 2022 20:42:18 GMT

GET
H/1.1 200
OK mf_logo_full_color.svg
static.mediafire.com/images/backgrounds/header/ 3 KB
2 KB 72ms
44ms Image
image/svg+xml 104.16.202.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://static.mediafire.com/images/backgrounds/header/mf_logo_full_color.svg
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.202.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:18 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Fri, 28 Oct 2016 22:22:42 GMT
Server: cloudflare
Age: 6171
ETag: W/"5813cfb2-d1d"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 706c4d4b1811f995-YYZ
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}

GET
H/1.1 200
OK file-zip-v3.png
static.mediafire.com/images/filetype/ 2 KB
3 KB 63ms
34ms Image
image/png 104.16.202.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://static.mediafire.com/images/filetype/file-zip-v3.png
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.202.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:18 GMT
CF-Cache-Status: HIT
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}
Age: 447777
Cf-Polished: status=not_needed
Connection: keep-alive
Content-Length: 1872
Last-Modified: Fri, 11 Mar 2016 23:22:56 GMT
Server: cloudflare
ETag: "56e35350-750"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/png
Access-Control-Allow-Origin: *
Expires: Mon, 30 May 2022 16:19:21 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
CF-RAY: 706c4d4b281154cd-YYZ
Cf-Bgj: imgq:100,h2pri

GET
H/1.1 200
OK icons_sprite.svg
www.mediafire.com/images/icons/svg_light/ 36 KB
9 KB 62ms
46ms Image
image/svg+xml 104.16.203.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.203.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:18 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Mon, 27 Sep 2021 17:45:30 GMT
Server: cloudflare
Age: 6833
ETag: W/"6152033a-90ab"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 706c4d4b2e0554d3-YYZ
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}

GET
H/1.1 200
OK dl_promo_logo.png
static.mediafire.com/images/backgrounds/download/ 945 B
2 KB 56ms
39ms Image
image/png 104.16.202.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://static.mediafire.com/images/backgrounds/download/dl_promo_logo.png
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.202.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 98294feb8fda8507671a762aea3e7fc0b27bb20ad97fec3ebf56a6572493c447

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:18 GMT
CF-Cache-Status: HIT
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}
Age: 447743
Cf-Polished: origSize=2240
Connection: keep-alive
Content-Length: 945
Last-Modified: Fri, 11 Mar 2016 23:22:56 GMT
Server: cloudflare
ETag: "56e35350-8c0"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/png
Access-Control-Allow-Origin: *
Expires: Mon, 30 May 2022 16:19:55 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
CF-RAY: 706c4d4b5c48a1f2-YYZ
Cf-Bgj: imgq:100,h2pri

GET
H/1.1 200
OK apps_list_sprite-v6.png
static.mediafire.com/images/backgrounds/download/ 8 KB
9 KB 49ms
29ms Image
image/png 104.16.202.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://static.mediafire.com/images/backgrounds/download/apps_list_sprite-v6.png
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.202.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc54b817820f14ce6395ba2a037f37d4bb0af75d5b017336140793fbe2f7f738

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:18 GMT
CF-Cache-Status: HIT
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}
Age: 447743
Cf-Polished: status=not_needed
Connection: keep-alive
Content-Length: 8145
Last-Modified: Tue, 05 Oct 2021 21:36:28 GMT
Server: cloudflare
ETag: "615cc55c-1fd1"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/png
Access-Control-Allow-Origin: *
Expires: Mon, 30 May 2022 16:19:55 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
CF-RAY: 706c4d4b585354cd-YYZ
Cf-Bgj: imgq:100,h2pri

GET
H/1.1 200
OK arrow_dropdown.svg
www.mediafire.com/images/icons/svg_dark/ 315 B
1 KB 28ms
28ms Image
image/svg+xml 104.16.203.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.mediafire.com/images/icons/svg_dark/arrow_dropdown.svg
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.203.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:18 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Tue, 18 Dec 2018 18:09:53 GMT
Server: cloudflare
Age: 2629
ETag: W/"5c1937f1-13b"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 706c4d4b3e4fa1e0-YYZ
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}

GET
H/1.1 200
OK check_circle_green.svg
static.mediafire.com/images/icons/svg_dark/ 444 B
1 KB 37ms
32ms Image
image/svg+xml 104.16.202.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://static.mediafire.com/images/icons/svg_dark/check_circle_green.svg
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.202.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:18 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Tue, 17 Jul 2018 20:30:14 GMT
Server: cloudflare
Age: 3789
ETag: W/"5b4e51d6-1bc"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 706c4d4b5fb2a232-YYZ
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}

GET
H/1.1 200
OK fb_16x16.png
static.mediafire.com/images/backgrounds/download/social/ 181 B
1 KB 64ms
59ms Image
image/png 104.16.202.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.202.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:18 GMT
CF-Cache-Status: HIT
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}
Age: 447774
Cf-Polished: status=not_needed
Connection: keep-alive
Content-Length: 181
Last-Modified: Fri, 11 Mar 2016 23:22:56 GMT
Server: cloudflare
ETag: "56e35350-b5"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/png
Access-Control-Allow-Origin: *
Expires: Mon, 30 May 2022 16:19:24 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
CF-RAY: 706c4d4b6c81a22c-YYZ
Cf-Bgj: imgq:100,h2pri

GET
H2 200 infinity.js.aspx Show response
cdn.otnolatrnup.com/Scripts/ 193 KB
66 KB 74ms
33ms Script
application/x-javascript 2606:4700::6813:d625
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.otnolatrnup.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:d625 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 39823274361ed8a4b95439efca2e5bb626ae9c4abd9b275a5cf1138d8a699c46

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:18 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 20:38:31 GMT
server: cloudflare
age: 195
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="CAO PSA OUR IND"
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, no-transform, max-age=900
cf-ray: 706c4d4be84a7148-YUL
content-type: application/x-javascript; charset=utf-8

GET
H/1.1 200
OK footerIcons.png
static.mediafire.com/images/backgrounds/footer/social/ 504 B
1 KB 45ms
45ms Image
image/png 104.16.202.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://static.mediafire.com/images/backgrounds/footer/social/footerIcons.png
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.202.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ead29755d607f44ae932646ccde384e04b666bd25433ab9bf5e53fb9296745bb

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:18 GMT
CF-Cache-Status: HIT
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}
Age: 447776
Cf-Polished: origSize=583
Connection: keep-alive
Content-Length: 504
Last-Modified: Fri, 11 Mar 2016 23:22:56 GMT
Server: cloudflare
ETag: "56e35350-247"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/png
Access-Control-Allow-Origin: *
Expires: Mon, 30 May 2022 16:19:22 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
CF-RAY: 706c4d4bbcc1a1f2-YYZ
Cf-Bgj: imgq:100,h2pri

GET
H2 200 v652eace1692a40cfa3763df669d7439c1639079717194 Show response
static.cloudflareinsights.com/beacon.min.js/ 14 KB
5 KB 77ms
52ms Script
text/javascript 2606:4700:440e::6812:2fe6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:440e::6812:2fe6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Referer: http://www.mediafire.com/
Origin: http://www.mediafire.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:18 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 706c4d4bddce4bd1-YUL

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
817 B 106ms
77ms XHR
application/json 34.107.148.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUO2689O
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/js/prebid5.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9e02b3113679914a15a22517d9527e85a3f81d61c21db8c43c7425a66a476e08

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:18 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: http://www.mediafire.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
114 B 390ms
187ms XHR
text/plain 3.123.118.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/js/prebid5.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.118.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-118-27.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: http://www.mediafire.com
date: Thu, 05 May 2022 20:42:19 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
114 B 402ms
199ms XHR
text/plain 3.123.118.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/js/prebid5.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.118.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-118-27.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: http://www.mediafire.com
date: Thu, 05 May 2022 20:42:19 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
114 B 485ms
282ms XHR
text/plain 3.123.118.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/js/prebid5.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.118.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-118-27.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: http://www.mediafire.com
date: Thu, 05 May 2022 20:42:19 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
114 B 472ms
270ms XHR
text/plain 3.123.118.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/js/prebid5.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.118.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-118-27.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: http://www.mediafire.com
date: Thu, 05 May 2022 20:42:19 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
115 B 380ms
179ms XHR
text/plain 3.123.118.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/js/prebid5.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.118.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-118-27.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: http://www.mediafire.com
date: Thu, 05 May 2022 20:42:19 GMT
access-control-allow-credentials: true
vary: Origin

GET
H2 200 arj Show response
mediafire-d.openx.net/w/1.0/ 175 B
593 B 219ms
187ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://mediafire-d.openx.net/w/1.0/arj?ju=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Ffij49akvtgn6y78%2Fwmpband-dll-64bit-x64.zip%2Ffile&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=80432feb-0aea-4a47-b338-e23d64fe1b21%2Ccb54c9f4-33e1-4b4b-9ec5-9c458213236e%2C76f79988-9473-44cf-9148-da810b6304b2%2C39312b4b-b7b0-433e-9cc0-32e9f12186c6%2C8319b0ba-db78-4307-9b19-419416ccb370&nocache=1651783338902&aus=728x90%7C336x280%2C300x250%7C336x280%2C300x250%7C728x90%7C728x90&divids=div-gpt-ad-1583943974201-0%2Cdiv-gpt-ad-1583943910909-0%2Cdiv-gpt-ad-1583943842379-0%2Cdiv-gpt-ad-1583943738910-0%2Cdiv-gpt-ad-1573581836508-0&aucs=div-gpt-ad-1583943974201-0%2Cdiv-gpt-ad-1583943910909-0%2Cdiv-gpt-ad-1583943842379-0%2Cdiv-gpt-ad-1583943738910-0%2Cdiv-gpt-ad-1573581836508-0&auid=539074863%2C539074864%2C539074865%2C539074866%2C539074866
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/js/prebid5.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/18.1.0 /
Resource Hash: b22d188a35f0a40dbdd70f7b4bcdc0291ffa5a159ae3eb59822a28672111f95b

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:19 GMT
content-encoding: gzip
server: OXGW/18.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: http://www.mediafire.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 165
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
363 B 33ms
10ms XHR
application/json 51.222.39.186
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/js/prebid5.17.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.186 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip186.ip-51-222-39.net

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: http://www.mediafire.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
117 B 87ms
35ms XHR
text/plain 104.36.115.98
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/js/prebid5.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.98 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: http://www.mediafire.com
date: Thu, 05 May 2022 20:42:18 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 like.php Show response
www.facebook.com/plugins/ Frame 5E98 42 KB
16 KB 110ms
61ms Document
text/html 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

680f2e2d5cb0c0cd22c351c08c1a41dda3e50ba8e9c11ead5af393d54fe59b92

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
date: Thu, 05 May 2022 20:42:19 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
priority: u=3,i
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: B5KUjQwHAw+BtIQxnqDORaQ9AW/o++CqjRd4NWkCU1nIBBU68foVzWKcOetGsxPBj+1XcX8Kdofj4DwOzWUrXA==
x-fb-rlafr: 0
x-xss-protection: 0

POST
H2 200 / Show response
api.amplitude.com/ 7 B
168 B 241ms
85ms XHR
text/html 34.208.96.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.amplitude.com/

Requested by

Host: cdn.amplitude.com
URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.208.96.37 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-208-96-37.us-west-2.compute.amazonaws.com

Software

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 05 May 2022 20:42:19 GMT
content-length: 7
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST
content-type: text/html;charset=utf-8

GET
H/1.1 200
OK world.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 143 KB
53 KB 41ms
40ms Image
image/svg+xml 104.16.202.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://static.mediafire.com/images/backgrounds/download/additional_content/world.svg
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.202.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:18 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Tue, 17 Jul 2018 20:30:14 GMT
Server: cloudflare
Age: 5715
ETag: W/"5b4e51d6-23ce2"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 706c4d4c8defa1f2-YYZ
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}

GET
H/1.1 200
OK continent-as.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 43 KB
17 KB 75ms
73ms Image
image/svg+xml 104.16.202.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://static.mediafire.com/images/backgrounds/download/additional_content/continent-as.svg
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.202.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 082cecf2da70da88efb1db41dd0096deb999b7b7d1cf8344ca2b37930739a377

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:19 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Tue, 17 Jul 2018 20:30:14 GMT
Server: cloudflare
Age: 3158
ETag: W/"5b4e51d6-aae3"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 706c4d4c8e01a22c-YYZ
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}

GET
H/1.1 200
OK ind.svg
static.mediafire.com/images/flags_svg/ 849 B
1 KB 28ms
27ms Image
image/svg+xml 104.16.202.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://static.mediafire.com/images/flags_svg/ind.svg
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.202.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ac1799decc6c8d7306eb692459b4f75240db6069211c91e917e92d7c184f609a

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:18 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Tue, 17 Jul 2018 20:30:14 GMT
Server: cloudflare
Age: 7037
ETag: W/"5b4e51d6-351"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 706c4d4c89ae54cd-YYZ
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}

GET
H/1.1 200
OK flag.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 234 B
1 KB 44ms
42ms Image
image/svg+xml 104.16.202.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://static.mediafire.com/images/backgrounds/download/additional_content/flag.svg
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 104.16.202.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:18 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Tue, 17 Jul 2018 20:30:14 GMT
Server: cloudflare
Age: 3090
ETag: W/"5b4e51d6-ea"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 706c4d4c897ca232-YYZ
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}

GET
H2 200 pubads_impl_2022050301.js Show response
securepubads.g.doubleclick.net/gpt/ 368 KB
125 KB 21ms
20ms Script
text/javascript 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8cc13350e5c65223229a458ee1986bd13f4914bf953484681d70665643669c02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 13:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 24630
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 127789
x-xss-protection: 0
last-modified: Tue, 03 May 2022 08:34:29 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 05 May 2023 13:51:48 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 364 B
195 B 77ms
35ms XHR
application/json 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.mediafire.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a104-77-243-115.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

fe16621a66d5c7a745d4b785dc1776abeb64e4593817a48b39f43e21af6b0ca9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 05 May 2022 20:42:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Thu, 05 May 2022 20:42:19 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 66ms
19ms Script
text/javascript 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-829541-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 6898
date: Thu, 05 May 2022 18:47:21 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 05 May 2022 20:47:21 GMT

GET
H2 200 translateelement.css
translate.googleapis.com/translate_static/css/ 18 KB
4 KB 82ms
19ms Stylesheet
text/css 2607:f8b0:4006:81d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://translate.googleapis.com/translate_static/css/translateelement.css

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.LkmHQCG-HWA.O/d=1/rs=AN8SPfoo2erHqkBEzrOadeJlFkS675EyAQ/m=el_conf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200a Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d0a6e3bc914db376bf187c380750b197c317e1bf40fab9ad959ad5facd8f9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:30:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 715
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3130
x-xss-protection: 0
last-modified: Wed, 24 Feb 2021 19:45:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="rosetta"
vary: Accept-Encoding
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Thu, 05 May 2022 21:30:24 GMT

GET
H2 200 m=el_main Show response
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.LkmHQCG-HWA.O/am=Bg/d=1/exm=el_conf/ed=1/rs=AN8SPfrcq5GlJjKOeRCFI5zxZrVlHtLIIQ/ 222 KB
76 KB 83ms
20ms Script
text/javascript 2607:f8b0:4006:81d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.LkmHQCG-HWA.O/am=Bg/d=1/exm=el_conf/ed=1/rs=AN8SPfrcq5GlJjKOeRCFI5zxZrVlHtLIIQ/m=el_main

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.LkmHQCG-HWA.O/d=1/rs=AN8SPfoo2erHqkBEzrOadeJlFkS675EyAQ/m=el_conf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200a Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7cd5d893f8c8f3d809e0195249a84b362760d1121b1e134f6b5bc60d4bddeaa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 18:13:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8950
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 77567
x-xss-protection: 0
last-modified: Wed, 04 May 2022 07:14:04 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="rosetta"
vary: Accept-Encoding
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 05 May 2023 18:13:09 GMT

POST
H3 204 AGSKWxXwIfs5dVXyCX_5CQsOENCemsnJh8LzLwNS0BaxFRGFbZM1f5u8Oar_v83gb4byJLJwtFqLqMLfkrffsas4I_47XLbHeo_qAURID2n9VzAoxFXDd0mJmgHdvP60lcrbGQAM0qACBNygJu9Ckep5UmRLQxf52SrZEiqIzWbAft3zOT7asfIn5rYP6p1C Show response
fundingchoicesmessages.google.com/el/ 0
29 B 101ms
60ms XHR
text/html 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXwIfs5dVXyCX_5CQsOENCemsnJh8LzLwNS0BaxFRGFbZM1f5u8Oar_v83gb4byJLJwtFqLqMLfkrffsas4I_47XLbHeo_qAURID2n9VzAoxFXDd0mJmgHdvP60lcrbGQAM0qACBNygJu9Ckep5UmRLQxf52SrZEiqIzWbAft3zOT7asfIn5rYP6p1C

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.hjTj44Nn9DU.es5.O/d=1/rs=AJlcJMxBpF6mCyPjRPS08YhadJP0Ca2_Mw/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-9PDEwf3bWMoS789kv2zU0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-9PDEwf3bWMoS789kv2zU0Q' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 05 May 2022 20:42:19 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: http://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-9PDEwf3bWMoS789kv2zU0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-9PDEwf3bWMoS789kv2zU0Q' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxXwIfs5dVXyCX_5CQsOENCemsnJh8LzLwNS0BaxFRGFbZM1f5u8Oar_v83gb4byJLJwtFqLqMLfkrffsas4I_47XLbHeo_qAURID2n9VzAoxFXDd0mJmgHdvP60lcrbGQAM0qACBNygJu9Ckep5UmRLQxf52SrZEiqIzWbAft3zOT7asfIn5rYP6p1C Show response
fundingchoicesmessages.google.com/el/ 0
28 B 101ms
61ms XHR
text/html 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-RZ5YOaqyECkDPEpriTuZiA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-RZ5YOaqyECkDPEpriTuZiA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 05 May 2022 20:42:19 GMT
x-content-type-options: nosniff
access-control-allow-origin: http://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-RZ5YOaqyECkDPEpriTuZiA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-RZ5YOaqyECkDPEpriTuZiA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVYbEWdLwbYzzPJYVRld4b8QOC40Wi1g87h6997j6zUkZ6hfD_S5iN11wclPZfrXeRJsdFPB68ossB0u84dJpmsgcNWkWhq9_F0fha1nkSBmGOppPZd-aaAFEMuTIqQojT8RMxJrovYHFzQyOSX8y9koCsOvoFiPknixHIJ8DUmt1OPoGJPvOkvjo-K Show response
fundingchoicesmessages.google.com/el/ 0
28 B 54ms
48ms XHR
text/html 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVYbEWdLwbYzzPJYVRld4b8QOC40Wi1g87h6997j6zUkZ6hfD_S5iN11wclPZfrXeRJsdFPB68ossB0u84dJpmsgcNWkWhq9_F0fha1nkSBmGOppPZd-aaAFEMuTIqQojT8RMxJrovYHFzQyOSX8y9koCsOvoFiPknixHIJ8DUmt1OPoGJPvOkvjo-K

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-DHXVjS1MryK8rwZt84xpog' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-DHXVjS1MryK8rwZt84xpog' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 05 May 2022 20:42:19 GMT
x-content-type-options: nosniff
access-control-allow-origin: http://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-DHXVjS1MryK8rwZt84xpog' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-DHXVjS1MryK8rwZt84xpog' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxU88coM9FFLWvmHP6x-NSTS0ZUukjAuiCA8AgYMBlOueKXgZkT3eftBUBPp2MHXqcbgrqlA4dnBKvUE7uBgBJYBffjYyeGMQotKbT794qlpIJFoZj2LxWa8HkmLaCkGMbsBgdees98I7Mew-wcD29-GrjYcmKT2e298Vduz9flSaRuOw3FkqAt9Wm9U Show response
fundingchoicesmessages.google.com/f/ 63 KB
23 KB 98ms
58ms Script
application/javascript 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxU88coM9FFLWvmHP6x-NSTS0ZUukjAuiCA8AgYMBlOueKXgZkT3eftBUBPp2MHXqcbgrqlA4dnBKvUE7uBgBJYBffjYyeGMQotKbT794qlpIJFoZj2LxWa8HkmLaCkGMbsBgdees98I7Mew-wcD29-GrjYcmKT2e298Vduz9flSaRuOw3FkqAt9Wm9U?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjUxNzgzMzM5LDU1MDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbN11dLCJodHRwOi8vd3d3Lm1lZGlhZmlyZS5jb20vZmlsZS9maWo0OWFrdnRnbjZ5Nzgvd21wYmFuZC1kbGwtNjRiaXQteDY0LnppcC9maWxlIixudWxsLFtdXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

560dc4798f07a20132d706ece518486b8198cb65ebccdeead9b9ef501df940e9

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-AuBpiQiDZm9wG0ssPqdUMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-AuBpiQiDZm9wG0ssPqdUMQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-AuBpiQiDZm9wG0ssPqdUMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-AuBpiQiDZm9wG0ssPqdUMQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options: SAMEORIGIN
date: Thu, 05 May 2022 20:42:19 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
report-to: {"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
c.adsco.re/ 63 KB
23 KB 66ms
26ms Script
text/html 2606:4700::6811:a7ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.adsco.re/
Requested by: Host: cdn.otnolatrnup.com
URL: https://cdn.otnolatrnup.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:a7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da1bc24aeafec2701dbdeed0d9f37421252a140e3307a71e4bc5fec4cec377e5

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:19 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 3193319
etag: W/"WtfcKMteYs2dCZjgNMzUmw=="
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html
link: <//6.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//4.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//adsco.re/>;rel=dns-prefetch
cache-control: public, max-age=2678400
cf-ray: 706c4d4dacba4bca-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sun, 05 Jun 2022 20:42:19 GMT

GET
H2 200 pxusr.gif
c.aaxads.com/ 43 B
205 B 22ms
22ms Image
image/gif 104.77.243.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.aaxads.com/pxusr.gif

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.243.115 Billerica, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:19 GMT
last-modified: Mon, 26 Feb 2018 13:29:58 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: image/gif
cache-control: max-age=701076
accept-ranges: bytes
content-length: 43
expires: Fri, 13 May 2022 23:26:55 GMT

GET
H/1.1 200
OK pxext.gif
www.aaxdetect.com/ 43 B
323 B 91ms
21ms Image
image/gif 104.77.233.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.aaxdetect.com/pxext.gif
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.77.233.28 Billerica, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-233-28.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:19 GMT
Last-Modified: Mon, 26 Feb 2018 13:29:58 GMT
Server: Apache
Content-Type: image/gif
Cache-Control: max-age=917439
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Mon, 16 May 2022 11:32:58 GMT

GET
H2 200 OqOE21UvWe3.png
static.xx.fbcdn.net/rsrc.php/v3/y5/r/ Frame 5E98 400 B
825 B 58ms
20ms Image
image/png 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y5/r/OqOE21UvWe3.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ed91fbb0cd9308f91f8e1fd93942c94ee850fc4161ed788b16f801b743c70b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:19 GMT
x-content-type-options: nosniff
content-md5: uF0RL4E+h23ClLQmPOTTMw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 400
x-fb-rlafr: 0
x-fb-debug: swmTI1b5hEUkXKxnbz8GFpw2lQjt4h4rn5RdvltqcOmSCtuK1sUwRqVyZ/6qu56BmZ8peJdFohKtgsLGOzMZHA==
x-fb-trip-id: 1512268381
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Tue, 25 Apr 2023 01:25:44 GMT

GET
H2 200 /
6.adsco.re/ 0
416 B 63ms
20ms Other
text/plain 2606:4700::6811:a7ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://6.adsco.re/
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:a7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.mediafire.com/
Origin: http://www.mediafire.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:19 GMT
content-encoding: br
server: cloudflare
access-control-allow-headers: Content-Type
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/plain;charset=UTF-8
access-control-allow-origin: http://www.mediafire.com
access-control-max-age: 2592000
cache-control: private, max-age=10
cf-ray: 706c4d4e5af6713e-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK /
4.adsco.re/ 0
463 B 119ms
33ms Other
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://4.adsco.re/
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.mediafire.com/
Origin: http://www.mediafire.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:19 GMT
Content-Encoding: gzip
Access-Control-Max-Age: 2592000
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: http://www.mediafire.com
Cache-Control: private, max-age=5
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: Content-Type

GET
H2 200 DT_biggrfFp.js Show response
static.xx.fbcdn.net/rsrc.php/v3i7244/y0/l/en_GB/ Frame 5E98 524 KB
137 KB 55ms
19ms XHR
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3i7244/y0/l/en_GB/DT_biggrfFp.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d311dbaffbf88b425ed5152b1930aa408697ca5dcebef3a821fd1df48bc52784

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:19 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: YhaNZj89QAZNeVa/fBm9Fw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 139688
x-fb-rlafr: 0
x-fb-debug: AyzMsJxrkfcr8NMiLNghLybLVZP05ys9uDyNKX6hdjVmLY01DrQF2OZ1c+EYQeTpBLwnH7ClbUEfj15dBi7nDA==
x-fb-trip-id: 1512268381
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Fri, 05 May 2023 02:41:41 GMT

GET
H3 200 183096492 Show response
fundingchoicesmessages.google.com/i/ 91 KB
32 KB 52ms
52ms Script
application/javascript 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/183096492?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

150b3355d3fa26237c6e4e9d4172ab24e72bc155711ca58b3a9a96c7e165dd0f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-o6+RW/OUJkTLVoY9qHe8xA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'nonce-o6+RW/OUJkTLVoY9qHe8xA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-o6+RW/OUJkTLVoY9qHe8xA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'nonce-o6+RW/OUJkTLVoY9qHe8xA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 76ms
33ms XHR
text/plain 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=806374906&t=pageview&_s=1&dl=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Ffij49akvtgn6y78%2Fwmpband-dll-64bit-x64.zip%2Ffile&ul=en-us&de=UTF-8&dt=wmpband-dll-64bit-x64&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=2048751360&gjid=174082689&cid=229842437.1651783339&tid=UA-829541-1&_gid=1083549052.1651783339&_r=1&gtm=2ou540&cd1=unregistered&cd7=legacy&cd3=archive&cd4=34&cd5=zip&cd8=%2F5%2F10%2F20%2F50%2F100%2F&z=1557768565

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://www.mediafire.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK p Show response
adsco.re/ 0
425 B 73ms
34ms XHR
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://adsco.re/p
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Thu, 05 May 2022 20:42:19 GMT
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
AS-P-4: OK
Transfer-Encoding: chunked
AS-P-1: OK nyc123
Access-Control-Allow-Origin: http://www.mediafire.com
Access-Control-Max-Age: 2592000
Cache-Control: no-transform
Access-Control-Allow-Credentials: true
Connection: keep-alive
AS-E: ND
AS-P-2: OK
AS-P-3: OK

GET
H/1.1 200
OK / Show response
4.adsco.re/ 47 B
463 B 64ms
34ms XHR
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://4.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: ab775dc9ea380db8de8abe22f1081447f904f3d4f71c7b02666cad9ece28d67a

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:19 GMT
Content-Encoding: gzip
Access-Control-Max-Age: 2592000
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: http://www.mediafire.com
Cache-Control: private, max-age=5
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: Content-Type

GET
H/1.1 200
OK / Show response
6.adsco.re/ 53 B
595 B 74ms
62ms XHR
text/plain 2606:4700::6811:a7ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://6.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Server: 2606:4700::6811:a7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 15eb81c897b041df0a525ce58bd67b407e68195add9a2a80bef797745579ce41

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:19 GMT
Content-Encoding: gzip
Server: cloudflare
Access-Control-Allow-Headers: Content-Type
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: http://www.mediafire.com
Access-Control-Max-Age: 2592000
Cache-Control: private, max-age=10
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 706c4d4eaad27139-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H/1.1 200
OK /
rpcjuggv3pun.l4.adsco.re/ 0
464 B 452ms
88ms Ping
text/html 185.200.118.90
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://rpcjuggv3pun.l4.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.200.118.90 London, United Kingdom, ASN9009 (M247, GB),
Reverse DNS: adscore.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Thu, 05 May 2022 20:42:19 GMT
Last-Modified: Tue, 31 Jul 2018 22:16:15 GMT
ETag: "5b60dfaf-0"
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Connection: close
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length: 0

POST
H/1.1 200
OK /
rpcjuggv3pun.n4.adsco.re/ 0
464 B 180ms
53ms Ping
text/html 38.132.109.186
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://rpcjuggv3pun.n4.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 38.132.109.186 New York, United States, ASN9009 (M247, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Thu, 05 May 2022 20:42:19 GMT
Last-Modified: Mon, 30 Jul 2018 15:32:42 GMT
ETag: "5b5f2f9a-0"
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Connection: close
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length: 0

POST
H/1.1 200
OK /
rpcjuggv3pun.s4.adsco.re/ 0
464 B 1376ms
260ms Ping
text/html 185.200.116.90
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://rpcjuggv3pun.s4.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.200.116.90 , Romania, ASN9009 (M247, GB),
Reverse DNS: no-mans-land.m247.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Thu, 05 May 2022 20:42:20 GMT
Last-Modified: Mon, 30 Jul 2018 15:38:01 GMT
ETag: "5b5f30d9-0"
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Connection: close
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length: 0

GET
H/1.1 200
OK / Show response
c.adsco.re/ Frame 8B11 63 KB
25 KB 30ms
19ms Document
text/html 2606:4700::6811:a7ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://c.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Server: 2606:4700::6811:a7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da1bc24aeafec2701dbdeed0d9f37421252a140e3307a71e4bc5fec4cec377e5

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Age: 3193299
CF-Cache-Status: HIT
CF-RAY: 706c4d4ebb8e4bd0-YUL
Cache-Control: public, max-age=2678400
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Thu, 05 May 2022 20:42:19 GMT
ETag: W/"WtfcKMteYs2dCZjgNMzUmw=="
Expires: Sun, 05 Jun 2022 20:42:19 GMT
Link: <//6.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//4.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//adsco.re/>;rel=dns-prefetch
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/1x/ 846 B
961 B 75ms
21ms Image
image/png 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/1x/translate_24dp.png

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Mon, 02 May 2022 06:46:11 GMT
x-content-type-options: nosniff
age: 309368
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 846
x-xss-protection: 0
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 02 May 2023 06:46:11 GMT

GET
H2 200 googlelogo_color_42x16dp.png
www.gstatic.com/images/branding/googlelogo/1x/ 910 B
1 KB 74ms
20ms Image
image/png 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 09:10:11 GMT
x-content-type-options: nosniff
age: 214328
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 910
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 03 May 2023 09:10:11 GMT

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 2 KB
2 KB 75ms
21ms Image
image/png 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/2x/translate_24dp.png

Requested by

Host: translate.googleapis.com
URL: https://translate.googleapis.com/translate_static/css/translateelement.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://translate.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:41:37 GMT
x-content-type-options: nosniff
age: 42
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1842
x-xss-protection: 0
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 05 May 2023 20:41:37 GMT

GET
H/1.1 200
OK /
6.adsco.re/ Frame 8B11 0
588 B 17ms
16ms Other
text/plain 2606:4700::6811:a7ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://6.adsco.re/
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 2606:4700::6811:a7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://c.adsco.re/
Origin: http://c.adsco.re
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:19 GMT
Content-Encoding: gzip
Server: cloudflare
Access-Control-Allow-Headers: Content-Type
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: http://c.adsco.re
Access-Control-Max-Age: 2592000
Cache-Control: private, max-age=10
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 706c4d502e587139-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK /
4.adsco.re/ Frame 8B11 0
456 B 34ms
34ms Other
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://4.adsco.re/
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: HTTP/1.1
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://c.adsco.re/
Origin: http://c.adsco.re
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:19 GMT
Content-Encoding: gzip
Access-Control-Max-Age: 2592000
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: http://c.adsco.re
Cache-Control: private, max-age=5
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: Content-Type

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
443 B 83ms
32ms XHR
text/plain 2607:f8b0:4004:c06::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-829541-1&cid=229842437.1651783339&jid=2048751360&gjid=174082689&_gid=1083549052.1651783339&_u=YEBAAUAAAAAAAC~&z=594937254

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 05 May 2022 20:42:19 GMT
content-type: text/plain
access-control-allow-origin: http://www.mediafire.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 log
l3.aaxads.com/ 35 B
194 B 39ms
27ms Image
image/gif 104.77.243.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l3.aaxads.com/log?___stu13p=aveoaamactga5dnnuee25ti2rm86bcrodqacb&lwbsh=AAX&dgw=desktop&flg=AAX3221EY&fw=MONTREAL&ff=CA&xjg=4&dss=0&skw=1200&slg=8PR6YK195&gq=mediafire.com&vhuyqdph=ssp-serving-55f9d57564-pzjxr&vyu=050516_368_050516_333_ssp&vf=QC&yhuvlrq=4&yk=1200&yz=1600&yvlg=&ylg=00001651783339172025035145562257&vvsDeExfnhw=CONTROL&oz=0&gdss=green&lwbshlg=6&vg=-1&dgeg=0&qsd=0&jgsu=0&fvvwu=&wfi_fps=300&wfi_vwdwxv=loaded&wfi_sus=0000--0--0&vxf=0&wfi_dsl=1&xvs_hqi=1&xvs_vwdwxv=0&xvs_ogi=&xvs_vwulqj=1---&xifd=0&frssd_vwdwxv=&frssd_dssolhg=&lg_ghwdlov=&dewh=SSP_CLIENT_delay300&deg=2&fdeg=0&gdeg=2&ghqg=453&fhqg=50&hqg=90&gvwduw=51&fvwduw=50&vwduw=51&uhtxuo=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Ffij49akvtgn6y78%2Fwmpband-dll-64bit-x64.zip%2Ffile&nzui=
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.77.243.115 Billerica, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-243-115.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:19 GMT
server: Jetty(9.4.35.v20201120)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Thu, 05 May 2022 20:42:19 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 87ms
39ms Script
application/javascript 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.mediafire.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 05 May 2022 20:42:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 14 KB
8 KB 387ms
385ms XHR
text/plain 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=364153125558495&correlator=327611058694469&eid=31067277%2C31067407%2C31064018&output=ldjh&gdfp_req=1&vrg=2022050301&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&iu_parts=183096492%2CMediaFire-Zone1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=1&adks=630197753&sfv=1-0-38&ecs=20220505&fsapi=false&prev_scp=buildnumber%3D121873%26dladtemplate%3D34%26button_delay%3Ddisabled&eri=5&sc=0&cookie_enabled=1&abxe=1&dt=1651783339622&dlt=1651783338658&idt=569&biw=1600&bih=1200&adxs=552&adys=10&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&bc=23&nvt=1&url=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Ffij49akvtgn6y78%2Fwmpband-dll-64bit-x64.zip%2Ffile&frm=20&vis=1&scr_x=0&scr_y=0&psz=960x1500&msz=728x-1&fws=0&ohw=0&ga_vid=229842437.1651783339&ga_sid=1651783340&ga_hid=806374906&ga_fc=true&btvi=0&topics=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

80f3e092e416eb3e90cbaac63a7dea106ef73ad06ab49d29acf93e42d9730a0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7876
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://www.mediafire.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
8 KB 438ms
436ms XHR
text/plain 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=364153125558495&correlator=2934782199744992&eid=31067277%2C31067407%2C31064018&output=ldjh&gdfp_req=1&vrg=2022050301&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&iu_parts=183096492%2CMediaFire-Zone2&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=2&adks=3841872593&sfv=1-0-38&ecs=20220505&fsapi=false&prev_scp=buildnumber%3D121873%26dladtemplate%3D34%26button_delay%3Ddisabled&eri=5&sc=0&cookie_enabled=1&abxe=1&dt=1651783339629&dlt=1651783338658&idt=569&biw=1600&bih=1200&adxs=320&adys=120&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&bc=23&nvt=1&url=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Ffij49akvtgn6y78%2Fwmpband-dll-64bit-x64.zip%2Ffile&frm=20&vis=1&scr_x=0&scr_y=0&psz=960x1500&msz=336x-1&fws=0&ohw=0&ga_vid=229842437.1651783339&ga_sid=1651783340&ga_hid=806374906&ga_fc=true&btvi=0&topics=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eee3c20ffd1b934515f302c4f6c00643e538a36338b6a5b21359a673a72f9bab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8197
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://www.mediafire.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
8 KB 390ms
388ms XHR
text/plain 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=364153125558495&correlator=2409192775744818&eid=31067277%2C31067407%2C31064018&output=ldjh&gdfp_req=1&vrg=2022050301&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&iu_parts=183096492%2CMediaFire-Zone3&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=3&adks=1870779098&sfv=1-0-38&ecs=20220505&fsapi=false&prev_scp=buildnumber%3D121873%26dladtemplate%3D34%26button_delay%3Ddisabled&eri=5&sc=0&cookie_enabled=1&abxe=1&dt=1651783339632&dlt=1651783338658&idt=569&biw=1600&bih=1200&adxs=320&adys=420&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&bc=23&nvt=1&url=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Ffij49akvtgn6y78%2Fwmpband-dll-64bit-x64.zip%2Ffile&frm=20&vis=1&scr_x=0&scr_y=0&psz=960x1500&msz=336x-1&fws=0&ohw=0&ga_vid=229842437.1651783339&ga_sid=1651783340&ga_hid=806374906&ga_fc=true&btvi=0&topics=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e434c519ca0cebabcb3176270059223d8adee1bbe870a67a5b06c1471edcc1fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7879
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://www.mediafire.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4212 6 KB
4 KB 102ms
37ms Document
text/html 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 20:42:19 GMT
expires: Fri, 05 May 2023 20:42:19 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK / Show response
c.adsco.re/ Frame 8B11 63 KB
25 KB 22ms
22ms XHR
text/html 2606:4700::6811:a7ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://c.adsco.re/
Requested by: Host: c.adsco.re
URL: http://c.adsco.re/
Protocol: HTTP/1.1
Server: 2606:4700::6811:a7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da1bc24aeafec2701dbdeed0d9f37421252a140e3307a71e4bc5fec4cec377e5

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://c.adsco.re/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:19 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Server: cloudflare
Age: 3193299
ETag: W/"WtfcKMteYs2dCZjgNMzUmw=="
Vary: Accept-Encoding
Content-Type: text/html
Link: <//6.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//4.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//adsco.re/>;rel=dns-prefetch
Cache-Control: public, max-age=2678400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 706c4d50cf254bd0-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Expires: Sun, 05 Jun 2022 20:42:19 GMT

GET
H2 200 supportedLanguages Show response
translate-pa.googleapis.com/v1/ Frame EBF1 13 KB
2 KB 122ms
66ms Script
text/javascript 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://translate-pa.googleapis.com/v1/supportedLanguages?client=te&display_language=en-US&key=AIzaSyBWDj0QJvVIx8XOhRegXX5_SrRWxhT5Hs4&callback=callback

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ecae715341645fcb5a95f62c8d6a32f2b8b9e5a3bae5d3430f7d261f0e029cc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
content-type: text/javascript; charset=UTF-8
vary: Origin, X-Origin, Referer
content-length: 1207
x-xss-protection: 0
expires: Thu, 05 May 2022 20:42:19 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 85ms
37ms Image
image/gif 2607:f8b0:4006:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-829541-1&cid=229842437.1651783339&jid=2048751360&_u=YEBAAUAAAAAAAC~&z=977438502

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2004 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
501 B 89ms
38ms Image
image/gif 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-829541-1&cid=229842437.1651783339&jid=2048751360&_u=YEBAAUAAAAAAAC~&z=977438502

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET /
6.adsco.re/ Frame 8B11 0
0

GET /
4.adsco.re/ Frame 8B11 0
0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 90ms
41ms XHR
application/json 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022050301&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

74f6d49e239eae6974a3e87fb02c3f413fd875ff826e00b255328b757fb9205a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 05 May 2022 20:42:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10680
x-xss-protection: 0

POST
H/1.1 200
OK rum Show response
www.mediafire.com/cdn-cgi/ 0
479 B 38ms
37ms XHR
text/plain 104.16.203.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://www.mediafire.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

HTTP/1.1

Server

104.16.203.237 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
content-type: application/json

Response headers

Date: Thu, 05 May 2022 20:42:19 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cloudflare
X-Frame-Options: DENY
access-control-allow-methods: POST,OPTIONS
Content-Type: text/plain
access-control-allow-origin: http://www.mediafire.com
access-control-max-age: 86400
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-credentials: true
CF-RAY: 706c4d519e6354d3-YYZ
vary: Origin

POST
H/1.1 200
OK p Show response
adsco.re/ 259 B
786 B 50ms
50ms XHR
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://adsco.re/p
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: e8ee5dd1ad489fe1632e2c3b1b6e87a91a38276e28d7b33592c27326ac3b7549

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

AS-P-G: OK
Date: Thu, 05 May 2022 20:42:19 GMT
AS-P-7: OK
AS-P-9: OK
AS-P-C: OK
Transfer-Encoding: chunked
AS-P-5: OK
AS-P-F: OK
Connection: keep-alive
Content-Encoding: gzip
AS-P-2: OK
AS-P-D: OK
AS-P-6: OK
AS-P-B: OK
AS-P-H: OK
AS-P-4: OK
AS-P-A: OK
Access-Control-Max-Age: 2592000
AS-P-1: OK nyc123
Access-Control-Allow-Origin: http://www.mediafire.com
Cache-Control: no-transform
Access-Control-Allow-Credentials: true
AS-P-8: OK
Content-Type: text/html; charset=UTF-8
AS-P-E: OK
AS-P-3: OK

GET
H/1.1 200
OK arrow_dropdown.svg
www.mediafire.com/images/icons/svg_dark/ 315 B
1 KB 35ms
34ms Image
image/svg+xml 104.16.203.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.mediafire.com/images/icons/svg_dark/arrow_dropdown.svg
Protocol: HTTP/1.1
Server: 104.16.203.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 20:42:19 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Tue, 18 Dec 2018 18:09:53 GMT
Server: cloudflare
Age: 2630
ETag: W/"5c1937f1-13b"
Vary: Accept-Encoding
Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 706c4d51eea054d3-YYZ
NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 79ms
39ms Script
application/javascript 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.mediafire.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 05 May 2022 20:42:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 14 KB
8 KB 368ms
367ms XHR
text/plain 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=364153125558495&correlator=3799590728670187&eid=31067277%2C31067407%2C31064018&output=ldjh&gdfp_req=1&vrg=2022050301&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&iu_parts=183096492%2CMediaFire-Zone4&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=4&adks=215913335&sfv=1-0-38&ecs=20220505&fsapi=false&prev_scp=buildnumber%3D121873%26dladtemplate%3D34%26button_delay%3Ddisabled&eri=5&sc=0&cookie_enabled=1&abxe=1&dt=1651783339834&dlt=1651783338658&idt=569&biw=1600&bih=1200&adxs=430&adys=1095&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&bc=23&nvt=1&url=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Ffij49akvtgn6y78%2Fwmpband-dll-64bit-x64.zip%2Ffile&frm=20&vis=1&scr_x=0&scr_y=0&psz=960x1500&msz=728x-1&fws=0&ohw=0&ga_vid=229842437.1651783339&ga_sid=1651783340&ga_hid=806374906&ga_fc=true&btvi=0&topics=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c33548d879b6af74936a0261e2fe27a513ab2e2ccdef9ea876f3a017b1316de5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7864
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://www.mediafire.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 84ms
36ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 05 May 2022 20:42:19 GMT

GET
H2 200 verify Show response
otnolatrnup.com/ 17 B
335 B 60ms
20ms XHR
application/json 2606:4700::6813:d725
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://otnolatrnup.com/verify?sig=BAoAYnQ2qwFidDargAGBAcAAICZvlbwIs4BordmP-uh3Mj3wjSg6QcvHka22Gtard-DxwQAg9WB-tTcI1xhtXARkuArwRw2clmZWHED9J1EtTAQDt6LCACDgg4bDJXtCIZREwh3XipVdcWuJ7xv_huwJ3UINO1ZfMcQAECYHUwAAYHhnAAAAAAAAAATFABD4WOl9Jh_AiLtwCKgfH9KxwwAg8PhNTrmMuMyfFjMnnfoABpxQ7v2Q3_PErj7covaVZ4M
Requested by: Host: cdn.otnolatrnup.com
URL: https://cdn.otnolatrnup.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:d725 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 39ca3c85734717cf31f55ab2e7d04d8ad2438a3bd9f6f46fae350d12506b4699

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:19 GMT
server: cloudflare
x-adscore-status: bot
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: Content-Type
cf-ray: 706c4d52ae1f714a-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17

GET
H2 204 Tag.vrfy Show response
otnolatrnup.com/ 0
56 B 20ms
20ms Script
text/plain 2606:4700::6813:d625
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://otnolatrnup.com/Tag.vrfy?time=0&id=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0&rand=73422&ver=async&referrerUrl=&fingerPrint=123&abr=false&stdTime=0&fpe=1&bw=1600&bh=1200&res=1600x1200&curl=http%3A%2F%2Fwww.mediafire.com%2Ffile%2Ffij49akvtgn6y78%2Fwmpband-dll-64bit-x64.zip%2Ffile&kw=online%20storage%2Cfree%20storage%2Ccloud%20storage%2Ccollaboration%2Cbackup%20file%20sharing%2Cshare%20files%2Cphoto%20backup%2Cphoto%20sharing%2Cftp%20replacement%2Ccross%20platform%2Cremote%20access%2Cmobile%20access%2Csend%20large%20files%2Crecover%20files%2Cfile%20versioning%2Cundelete%2Cwindows%2Cpc%2Cmac%2Cos%20x%2Clinux%2Ciphone&sig=BAoAYnQ2qwFidDargAGBAcAAICZvlbwIs4BordmP-uh3Mj3wjSg6QcvHka22Gtard-DxwQAg9WB-tTcI1xhtXARkuArwRw2clmZWHED9J1EtTAQDt6LCACDgg4bDJXtCIZREwh3XipVdcWuJ7xv_huwJ3UINO1ZfMcQAECYHUwAAYHhnAAAAAAAAAATFABD4WOl9Jh_AiLtwCKgfH9KxwwAg8PhNTrmMuMyfFjMnnfoABpxQ7v2Q3_PErj7covaVZ4M
Requested by: Host: cdn.otnolatrnup.com
URL: https://cdn.otnolatrnup.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:d625 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:19 GMT
server: cloudflare
cf-ray: 706c4d527a9c7148-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 065B 13 KB
5 KB 73ms
31ms Document
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 71693
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 00:47:26 GMT
expires: Fri, 05 May 2023 00:47:26 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 2618 783 B
534 B 80ms
39ms Document
text/html 2607:f8b0:4006:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2004 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

eda071106bed7d971650d6359ddb98094d309403d43ab1ef4639551276f8d55f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-mKEDoWT30pMrSrfFQmB8Nw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-mKEDoWT30pMrSrfFQmB8Nw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 20:42:20 GMT
expires: Thu, 05 May 2022 20:42:20 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 container.html Show response
63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 37CD 6 KB
3 KB 61ms
20ms Document
text/html 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 20:42:19 GMT
expires: Fri, 05 May 2023 20:42:19 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 600E 6 KB
3 KB 51ms
21ms Document
text/html 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 20:42:19 GMT
expires: Fri, 05 May 2023 20:42:19 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame B4B2 6 KB
3 KB 28ms
21ms Document
text/html 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 20:42:19 GMT
expires: Fri, 05 May 2023 20:42:19 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 2618 0
0 445ms
402ms Image
text/html 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022050301&jk=364153125558495&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H3 200 NHksFvpwOA_e7xJte31GpOZsvVxHGuXQeGuPktjycGc.js Show response
pagead2.googlesyndication.com/bg/ Frame 065B 35 KB
13 KB 60ms
20ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/NHksFvpwOA_e7xJte31GpOZsvVxHGuXQeGuPktjycGc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34792c16fa70380fdeef126d7b7d46a4e66cbd5c471ae5d0786b8f92d8f27067

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 19:39:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 176542
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13649
x-xss-protection: 0
last-modified: Mon, 02 May 2022 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 03 May 2023 19:39:58 GMT

GET
H3 200 logad Show response
fundingchoicesmessages.google.com/f/AGSKWxWYOoutw2D5SOZNzYBq5-lCbJGaHAU_pIIkxPd2475O97XHWVXezKxT3lFaY9JlBY3iUbGzY8l0dAYSIJu0jfFbVHqtD-0bkdFRvB61C7EZG5RQaHMRzwNfh-gLefRGtQJlhFEK4CDg94gvUN7Ja0V1uA9d_... 54 B
109 B 45ms
45ms Script
application/javascript 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWYOoutw2D5SOZNzYBq5-lCbJGaHAU_pIIkxPd2475O97XHWVXezKxT3lFaY9JlBY3iUbGzY8l0dAYSIJu0jfFbVHqtD-0bkdFRvB61C7EZG5RQaHMRzwNfh-gLefRGtQJlhFEK4CDg94gvUN7Ja0V1uA9d_OpNfsYnr7rpNW99RivNbcdAi3yPOOZe8hmryvJZqKmzd-gnwFyanVS-ULbL7lUIFI1knpEMLfRV7eVsIYk=/_/logad?/adv-header./adpopup.-images/ad-?adunitid=

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.en_US.2v6xTWswhII.es5.O/d=1/rs=AJlcJMxvpTwBCubeE_jEBJIxi8ue7uzIZw/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d79f46a8003a2a0846f36907190d3e973450c9a2f3cef330228961c994ccfaa3

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-VOu1GwmeCZpSn/BC0sZ9pg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-VOu1GwmeCZpSn/BC0sZ9pg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-VOu1GwmeCZpSn/BC0sZ9pg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-VOu1GwmeCZpSn/BC0sZ9pg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
date: Thu, 05 May 2022 20:42:20 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 156 KB
55 KB 116ms
78ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c3ca844d239162e11aa1a0d811df9fdeb198688ee080ab3c16b9bf6b6f6bcd0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55898
x-xss-protection: 0
server: cafe
etag: 8375398224413165889
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 05 May 2022 20:42:20 GMT

POST
H3 204 AGSKWxUcOt7ec3yJhv-P3wvVxp1bl3CTjS9xn6BmQu0VNJoheAIfDiZIbkCw1-HhBgwmyS8uRAXn5w7K3UrYOEH9qDrYXQClCGa6EjZWxHuf5LkJ3SvIRQRjp3B_NbrhCl427KrEMNQG-eLqppBPJLn9g-QOozar8MqSbogpN5AFf-xmoxBs5EgfUdXHQdZA Show response
fundingchoicesmessages.google.com/el/ 0
29 B 46ms
46ms XHR
text/html 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUcOt7ec3yJhv-P3wvVxp1bl3CTjS9xn6BmQu0VNJoheAIfDiZIbkCw1-HhBgwmyS8uRAXn5w7K3UrYOEH9qDrYXQClCGa6EjZWxHuf5LkJ3SvIRQRjp3B_NbrhCl427KrEMNQG-eLqppBPJLn9g-QOozar8MqSbogpN5AFf-xmoxBs5EgfUdXHQdZA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ywmHd/pko6Q6eC3cXdJNBA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-ywmHd/pko6Q6eC3cXdJNBA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: http://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-ywmHd/pko6Q6eC3cXdJNBA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-ywmHd/pko6Q6eC3cXdJNBA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C229 645 B
568 B 126ms
48ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkY9aWAmAEwAQ&v=APEucNVn1yGd8ebXIgRJ1xLc0T0LZqIBl02ULa35bdRcQxmsHNrdBA1m-2RlpBD7R_8LAqSGIlplhV9fgKbs0nBW8vBTldFJuN42omPF0YBZ6jtkxOb4AIM

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 285
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 20:42:20 GMT
expires: Thu, 05 May 2022 20:42:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 37CD 59 KB
30 KB 146ms
70ms Script
text/javascript 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BNLr8kfQeVT5uf8AKyOOwl1cJASPVlSH9RXXn927Fh272l6UQ84dmDmyivj6-ZF1H0Q4Y35owxsOP7fbaFHnEYuW2-pw&cry=1&dbm_d=AKAmf-C2s59DUwBeBCODTg2xp7igaMuSPEbLqGS7nzclnlxoYLrTH2zEqyOAqWqfeROospt0XA7lTu1DYG49r9kpkv8Mm29Q0npfP_IgkHQE79GoQJu9-gpndCYxgzIKaFivjlRRHW34DkCFUDw9IROPft1y2nFNyIRuN027_eVnHvqFIM6u8fb4P9SWw8ler7k01P2nylhAqcl2Uae73w4rX_mXzzcxXXtRczl0YyyDE4j_mNI2EJl-UIYvV0KbJqvJcPrpJwdiR-JBYEK8N_E5rwyOsDOuOSOIUj9kGE8Q01xiPYA3AuYy8BTv_Kyw_dPve95_Z8lG0XzvZCmS0EPHSdWMAwzgAeX8YbfoovvNH6-1gVMir1Ncbbq1F5O_-t8NT28BLJ4dLLA76WDdGznGAJvwBWAWCPm3Fz6Qs37LuZT-irnqr5kFEpVUaSXNxG0_FLu2uc7kBq7Rgug_VwGPNncF69yWLMNPw67Q4yBGrHzdzF1MuSsC485ABrnAlXG3h7RxqOHL0xZ00nJmd-R1aM76fCL6U8B6RBLEwN12xftoAj6P6dGR6i6097KcqZFjF-dQ0jJ2rfrC213P0X0FAgT4kbC8t5l9S1rwXLy3O620iN_Y-GqUJd6yDk78jcmnrdOTIsm26sJfw6rVz99e_2bgNH6yHf1HtbaoXinCfazQZb3FkjQ93LSPTmQWYul8aFhbYwKBG9lmn0Y1IydCX1e2pejWYes6QoU6NRMxo_Twzd3NqR5uN2Q97wqj8i1wYnpl4C0vzuZB-XmfzKNZtmP7DmDObx2-ZJSVF-FVlha59YqkGfdBswc_asla3uo0ELOko3CIv_081CUTO-KxppWGLen1rSUgNvSao30jXYeOvkPOyScT6VYA5xKbNAlkJ9VtN3D-4Pfylf3OXgEwtxhPOxHpkzGuZ3aSMtFhC2adik2Tdy3iIKkB5fo-8oYGWnZ-J5kVltfpSOgluWPiR0xvBMIIoEOJe9z8XQs9qspZuWWDnjKGEcLF_PSdSUfz8c3d9CM5xXF7_AIBQjSCXC7o7loCpkGWt2NkxAOH4UAR2ky10L7AvhgCqY0Jgq7qOmOGVaHTb8GRrUcvgnoSBcLgbjTuqH-uODub5d3ihtEhaSqsIy-ZmYiGR-hfFilcG2LKYE6ka1Bq2ubZCqSextITPx1cDyLZ1XJlYVqBfZ16rD3MbywHwOVWkmFZC9HNq7uqRx8lYEhxVo9rWZkWXmPCmoJEDoQDIfNpN84XIvvYWGgtFSKI7GfxjtKv-VkAon4Csr6T6duDOLGldUYZadVl_GM-XRA7U20KRUanpUkt6CLAhfT_L6oFDK4ZhLy4JDzHLvS9lN-jOYPu0cjk8pPE2SNAZhV_Cghr6q6WIktmhsXp6iOaXt4bJnsNqPAdEwan8-c7LnMRtq7mvwXlelE4gb6_YaLr-TaXztSdvpdRcw6I04lzH-AkRKO5H8Fyd1wE31voIiB8DLvEMa1awfx-QFKrPX0MZseFflS1w39VFFoO8orrjU56ri8WUZLvsAz7AEdJ4ScA0dZaoNPI1iRd9C4eTv4sa90YwCI7EZFWm6MSL_J8V9EPk137XEn4s8_ZIVQN6kTwOVcXGRs1ZvbOMNMDNRaFHkjQih1Xq_9NdC1Az8hABgBTwFktsjt8hXQ-prQu0EAdJHQhrH11R6Bl71hnEfCXa7C1yqKIVUHVNc_qftrj8aqFqwrff86fTXLYHUwdZogxiamQs8zJ71OLyUQNjwDOtb7gRGVyk6O5LEK19C6Ik2RmIjO8jgeArza6CefV628C5gsUGyvf7bfxxYIvQI0szf5E3rMW75CK4PKcOH-IAMIbpVZgVHJ4Xe9rafp7r_HSJ_S9ldiSvE2bn_ISA8NMI4Z-b_4SB673WNKieQqX7uJfOmFih91pGPflDCBxFRJiEgoNLjmKX7thZN4Pl2cn1A6rAeCgGxhxst2c0_viNG6Daf69WgaNd0jcmqCXfFoz5DNK7iAiYMCo25NoWh-RE7tzA0OK1qXqD97QIT00yCTCOKU1EO8vw79cc9yehE2paRBTFfQKe22imsVtkxrOOYcezH_qYu32q3XyLj9Xvp-FoJPAG8zkc2A0bXdce9n7ApUd-MBqgZ0ORERzqXONmZD0zpNt74cEo3AJT92_ij3haH8X0rJe8_ggmSuE9CmPOM9D1UDnq1vBJ_jiaelsd882lhUG6Ldt6_W-w2ax20lZfmPKyJ6uRQnyJIGrAw_SVyrOZNIBOzEFhpQWXTji74Ofo2z0FVtHh7OZMvWIP5BYIT_0DeHX35962cJtIgEM5uGk2Ooh_4XXW01SP__5EJawbEV_gWLuYcrJ3MQvqpRAHHfLCI71CqggqHXM7xNk2MVotpkeyE9CiBlpEu2mDKJH5C7GnksuhX6XonplR-6fLY3EMV4RZrRFqLGDyUgAjIlF6P5UBeLKNkqYMcHfaKz1jdvQtxjgHPeDHKPQIPw83l4pw1Io24wUBEZK5i5B4qNYqM3-xm9epEaGyyNmaL2i15EtLMH6JyA5UFTRqojz_yyRGlbOGqUaeboNynKcphdg494SuUaSaFiEyEpp-8lyeCx2Z8xG4zRJqmhyB5jldmPRqtRwkyBW-dkFPh0Q9LPqOE0ccXb5n-Q8v53t3BQ1xWMxtxkWWqkXHQrZXT44zwSYZ0xWNWatLYhUZsbxm0TUV3QEGhTgvs8JkhCR_19zRQbyzoirsOrtLH1AvXFoXWjPjZmRNGpyRRaxFfBpigdVXJQ4Upix-X2ayYzz8FwQZMdBP673CeT289vI1WH6pTjJpqLU2_Jo8VbtweOLd_mQrHUA7NSBWwEBZU19jq6xxQy0M3Y26ZwBNd1oNteM-MRC0V00EFITmO-_R_hlCep1eIdIsci5IPUs97DYrR62ymsu5oTH05icZqHpxBTlB9lm-QfPzTGnbDDkSjGIApQ24yqja0vCnOgbBhzqX1Ozx8PMBGgNnk6VTefP5-JNFZtoChiTV5V99Wjm6MdrJJnJEMNlexViEFPeN73m1wueE2eBaSIJvy2kYLml5_DhsTBthkMYveAmQNJk8ggMMJQp35R_wuLIUPd5Qg&cid=CAASKORoWXaTkCNC4Wix9uxXPhu2m9CV5sKhDRXm88CoF5r8oMH8FSkw__4&rfl=1%2Chttp%253A%252F%252Fwww.mediafire.com%252F%240

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ea0da066c1b1b471f3b2c898c8c6c79f83596a0da9c9508f31a8e1a041894d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30035
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 37CD 42 B
63 B 81ms
80ms Image
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A8fzVq_-9j8UD5Z8pVG3J5cicdCCdXjciAeudXetXSPRiJTAuY84gkXNnhhyH1_NO0huFq44htigm7HVlW5jzt_isWCS8UyvgeHT1N2_nugMWLkY0

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/ Frame 37CD 3 KB
1 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/window_focus_fy2019.js

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:24:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1064
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:24:36 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 37CD 120 KB
37 KB 120ms
45ms Script
text/javascript 2607:f8b0:4006:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1b2415f02c89234a4b94896afa68c68db82465563711b8b05f0c1b8b3ba580b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37409
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1651664140737961"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 05 May 2022 20:42:20 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/ Frame 37CD 15 KB
6 KB 21ms
20ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdc0c59701784258f143dfd4201f28353f080e0900a3530a83702e08c9ff353f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:36:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 370
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 567849196274905959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:36:10 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 37CD 0
0 45ms
44ms Image
text/html 2607:f8b0:4006:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT3TfXbcWSje_wyY7UHzG-qP75jaPACZnVpduiHVAjaoYBJv7k3DThK6IG7tShwM6JDloakyN9Q8L06G49i9hPUNXxVvw
Requested by: Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80e::2004 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6234 645 B
567 B 121ms
49ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYjoiAmAEwAQ&v=APEucNWks2OyBIfKMLxAlL3ojVQaIHTYx4GOQBlsy9B8E86-CfcFqfWtxclFmAyAV35Y8OFZhANQ1BvWmYy0xLkRY8pOxCzrkxvNr1_sqtSf8frRUYgpaOI

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 285
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 20:42:20 GMT
expires: Thu, 05 May 2022 20:42:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 600E 60 KB
30 KB 147ms
75ms Script
text/javascript 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A72f4HVY61a17xI6ZUdOPnEVX09YoT8icFs6TPWwNlIKCzMiuQefq2-nR8C7Vm4Rm1Msdy8KAGdDZk7R6w18LIPgdaRg&cry=1&dbm_d=AKAmf-BHclm7wHrVap5C0kjlm1w81Rf0Z01NI-Khbl_pjVvYVSTdZ7TNEncYUw4W6bOiR25o58xHYP7Wl6IbUt2ZRGIZDboyoPpOhFJ4XTU4Nkzh6aWpvccUW0fWNGUDUwHPASEYaaC9Ne2RT3ySBLlpTskOb7vwhmqtLn5DLBNRGJjBO_nW3UPDIrmA8zpudGXVMbJNwebXe4KP1xt7ieEtuEmUF_jHmxi2shPrL2MtM2WQBvw09UoF9fwgVK3z6ID8vkdF4gE7jJZrUYgljtmrvkQ4HUjLU3z-3KsSyyqr58FLhtaHlgEzteoE4sqS6dZHc23k6PjHu1atU6m4_oRmxJ9zYUsVVTRqMz1RHsbvbH4kDTAT3mbE_xWSgXxv2rms6_i-HWKkkgaddikhlNfKiE2bdEL7arMLWp8umEiVlwbTnBhz2Mk9fx7p0dMZkkIqeJH9N6Pt3inxO3HsjEZiitO0Q61_St2f56iljJt5GG-7wZPwCPgTuzz0CJHE0sthzLn7LShqWPwXapnvc0xjo0xPhP_ralxLWnegyDWNOmxB4SzK8eKXF9k-3rfKcjdxAvcaK5CDPUzQOJiSt45-eLwHS4OuOdysCj7pweVJ9odVSxVVOLRWC_6puRtzr3VNQf2PDzMqfVJluyhbsquEMKLb7ZoAUBcLP_xwg8doNoPciKT-gYJEemCojSXQxqTfbHK6f8os0Q1he3cxYXFhxQhD97LorcHmQF97Z9TvVaVEjahRyak4DH5icqzbNkIpZ7Q_GuakFWIsFSS-ZQem1CkTd5WcmbaVs2HFEJ4RKVzcWr2Ysyov6KN8Prub3YJ3693bbNjB6B49hAZ4MXhwSWs99wgEpZfS1LiT67J5RIzT6fUEMVGM6QkPcWYlBngghUbGNZu_ZgZtgPPk06AGO5cV-SrGQoN45JjdT4SuscUjrIxoZYltJnhJYAv3_oSO7-UBj1pSsNKceys3ijVSuuGozFmPlJ5BJl4gu4i1vSCRDuCxwMyF5SBcu7LqL2iXRnOPDFeDX5Tci79jVxCtpK1UBVZ4uBqyWgbwpLcyyMLuKctqMvi15zgnq6KITxdDDHjtYasqD3GEBTnMAskyvMT-s8-UqGEkNxM4H5n7A9eqvJTys-AKNwtWPFy85-l2C16bLdkJgE7vdJ9iZpTYphqAs8hlK3uei9EwBHk3IKG4tus47uhdcvFGnZV96w4HD6j6hleumYBDTNZaZHg9TXX5emZ-sNhx2e7Yp0QaITuYK2ObQhtluFkEq6mUCaM5LXJWJMLrUurLNX48uqydsf5OpiB9rVdfrRoF6BvQ2zI4ANtvOZJ5AWu7yyNik83izOnufQN4RjYFDb5xz9UPvye5ND5B7mvE60zTK-hMjlaOFbEGRdYoUQUJIYXKL7QmxqlpdxZPB38EzK0kBFW9ePRjYE5p1rhFOIjcs6NaXiEzc-FlMUWIpnT96P4QHliOvO5tBfGmcuAolUX4LOJn-zFWs8i8xW1TvuDzL9a2FCxc8vzQtdY8iUqjSm7iIWoqNc3MOdHt9q_Ox_VzAkq67jEeWpzyKfmshbFaa8FySQAt5j35YHGjrXspJEKJYFQeqzsXBgvd04S4dmZBXmvwLkfUpUKtpZK4wXiOW8X6DMtfTQ2-L3e3xzA0IR61hcQYOVLk3zCG_pO1RL3HRKGOpAo2rccH-o1Y9Frh6zn9bh8kil11-jTZcuTm_T9B1zxoK8Q35juGIG7Nzi_BcYDgDvgoDPQTFslsxUeFctrPxFL_tv_x7ElsPxuZlWIYIvVRaDdz0L8MO221XjU29eycQJ227BbixNvU_7NQP6_mvGZ6G0b_w68ZgQrzEDOiT3a1HIrUFJVXxch8AHal7jCK8v8KqdrvhF8YqYJVhc5IqlrT-IgltVqI0Ca2o4EXMKGlwA9Nth-k2ZpNBOKhq3WdXWc_KLn7-dkPjV526qQTx1ND3yGM5TJGeSvWp2WyrvR8DoDYjVoO8eDkzwczJX3IVXg6QyWbSjxAl44sz2keA1vkwe7D3UIOM6hBXoZaRyF-PiLKkzKwjR23R6MseS3Lp2R-gWIgVTgmt_fRfP3EVLZQ-aE88lncxQo6DZzOkMGWousm7j1RcGNQuz_IH-t8LQrOsF8OFAZBawQ3AGbdSITAFmWE1dOyEXf7wwRqP-cLpmOxdVf6v2bz-7pAMKxnSx10X6rXV5c16-n-q-o8aaBLYUCRnskwT4-X-yb4YWOZSRVi3FKgFqj9w0nJlDJOnwWNF1f_jQZoefQRK4Wj1La--3wcJxUwKjAc0P0oda0e_AvZ5G6Y_Fvz7liRDaw-1qllexgYEMJlC1TMpwsFaFz9W6Rn747L2FSQKf9s87YLTks1st7xXzefdRSnFVItLSsUrdMgNy4GcuXGrLqs-vlpjUovcJyQZ2h3_0EShUJ_HYdINCeI-bwVcKznINETdthzt6PMi7BZ-Ra-j1sKzuNkCClrQne7sJDy_GHB-nq9F3ckMc5cyrAhJaKxgESKuylOOpAdBe9rW4tS0u_k0CA8VY71nSRtPc0NFtfnVnIJyGZyogIGYaq97UEUI0qm-XUhjpJkc90aPyWJOXTPxLiC0xhbc9JDmKK0iukzQSf3gB-i0bxtwwbDx7zblS7EztKqC80MgZADFpSJdirYcbE5_22P1iBBV-3kyx126lW3TQb906ooLEOTCSGnx6amoi74HwNRj7gLzWTlaz8uQG2b317uZK1kdiGTUtWxu22HUN0A3byYAAWtohKktoWZy2MiPlN5uebopxZGpziMZwoCjzCLPY8-x1PtlCPv0NEyOFTCQGFsEK1jtLIDtKsK5-U3sp0kM67-lBBZ0LGdXusf4XyK1QtWJ7kevf7Xlq6lZOUCX5xzkTeTGe5ML0i3uxt4Ax5T72Qd2JyQDWObM66QAosZfHYx9ObyMQ8c0dVhUZj6p3fxoye7fncaJ1RVeGj2-OZBRGOOGdMx0zx2XPuK_EmHmmBNBbE6q4vtPRwCU1R1BQCCQkf5iGMJI5zVSZa_OFJTrnkDnZstoliCSSi88pBpDJZvjhWZdt88UaAZ6KFHzYOBwr8sp4RYy4QLQ3wyLqsaGKScat5WWCuhAc2DrEmyQEI&cid=CAASKORoUJ1nd77SMv-7s51GRYBvAW6DvK6i2cQcWMvXHPW7Mwa37K3zVlA&rfl=1%2Chttp%253A%252F%252Fwww.mediafire.com%252F%240

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

56814b447a39fbabde8e9f596baf4cec9bd23fb2f3fd83940aef00e2eb0fa0f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30094
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 600E 42 B
63 B 80ms
78ms Image
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DxRFkfzKnTk0sldhj7KWh5kfh2VQmTy52sGTCyjlDFbt15Uu9nCZkDse28PNRMwAY1_dIyR75EPT4MTZSJUGgtiqOVtKKPdepUttGo15WJp7xDQCk

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/ Frame 600E 3 KB
1 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/window_focus_fy2019.js

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:24:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1064
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:24:36 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 600E 120 KB
37 KB 148ms
78ms Script
text/javascript 2607:f8b0:4006:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1b2415f02c89234a4b94896afa68c68db82465563711b8b05f0c1b8b3ba580b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37409
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1651664140737961"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 05 May 2022 20:42:20 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/ Frame 600E 15 KB
6 KB 22ms
20ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdc0c59701784258f143dfd4201f28353f080e0900a3530a83702e08c9ff353f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:36:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 370
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 567849196274905959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:36:10 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 600E 0
0 45ms
44ms Image
text/html 2607:f8b0:4006:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR1gmBE_YwhloV89U7glUlwZTeN0hcTkBUHqGTeDq15iirwqg4Dc039lfAu7L80oSKEXLTlSySkK90SuQJNJtEIXmMmFw
Requested by: Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80e::2004 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 249E 645 B
983 B 110ms
48ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYjoiAmAEwAQ&v=APEucNUowLZ7WJmq5qsMnytyppSUzzNLS5D7Rh0ftzNv09oL2L60Do2KyFVEN4OM8C6pshVouOiVCp2wt_hBmSv5cNyWVoAEPtZ_SFgg9KDK-nzcn_RP6BY

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 285
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 20:42:20 GMT
expires: Thu, 05 May 2022 20:42:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame B4B2 59 KB
30 KB 162ms
99ms Script
text/javascript 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AUyuOHZZN5wzDbywA3xXtAmrh_XFwspNE4OEEnbz56SiIICoiBKlheZhi_GtoTelo2legND_jfWkqURk08vFlmbsilcA&cry=1&dbm_d=AKAmf-Cwbpwq3xkz1MJ8dAOPMmBtG6DtCRS3W8c4mJYNefGvO3XCd4gjhaFkIHtmE2gk0eZbQGG5Vl83FwQoe7vJgLvL3JALh5O06lFjtJ7fGtNNU8VTcGsdq9mm0vQ-Ud2alPcxqgO0GtXPCtA1JiM9NGtr5iphr5ze1PbJrBv1LKMG-dz7ZXi8sQgp3BLWRQ9M43arv15VmKI8FjVqHXzc3Q321Uw2oYSKFrtZNFae_ey83ac3Yvqet4eaOBYE52_FitOCzclXKtdvK4fpkkLJeWTx29baCxOoVGYFErWXB1lzHXTTs89fzyH7S-bZHeE0HQuctznjxPVM0Ldvvg3UoR3m2FOaxcHIZh-tc0pMIseAjiPtHg7LouWz2KdOWdxlfkc6djayiSAO8x2mZIG7-a8B9TCKjPARAvmuuXY-CcbsSPuVotf1i7Jp1bzToBql2iDkxeaE12cjKufoA3_QYSoknlEXmfgiyLR_RN3STqsxUyNmLSTip-LTO3P_pOb7x1za93WG5_EDALJix8f1r6xpe-AzdNPKdAkMDitXo-lAG7strhvS204qjzz7LE5sMee8PParse_ls_qkcV5xP9rwmXKrQrzx5srEwXoNL1g5VJsm1-Mw234-wgCh_pCm6ttyRPffaLM-SCfAky6RdnddRRBKQ7fRXDy7nCWtqnl1meEeNQV8FVot0pF2IWWzVCGRR7KkDDYV4KY9hcaPvoIAvXiVT-Y-HtnhNVfdJfaxDyxECjvclb06vS5BF9jphNLPfTVxz8Z2cZpOaUts7CnA3VkgVcJHPmFmpTTHM_XZapMEjJhuVo1n9j-Uuji-LFpRfMc5FNWTGE-7nxrhiDWN5DWZ7Y00M248FMeG8pRg8z3JDP7GUlK0zbfy5Hh3sEkBdRHYl3MZXvB9CLegH6Dz2w6dYozD37GXKvtX305ffcRJzWZ6duaK5yc1GEZ7m1v0DPkOhwRxe683nLHzLom8nheUSsBqvw9-hirfkcN02NSibh7rClcD4KUc6hdQHOjMd2AEgeISo-yZTVNXFu_rJPZp2f9RDuVfR74IV2HuEJGn70PwQGgknFDK2aUwlK1ToAr7IKL3qv67x_iMZEjyLMOoJlN6tajymQHr3Tsve9WpwJIsk8lZwZrQfDUQ-0Hm83n_CXiJFSwQec0zpIaZygY0AaYyutRSDT4ouZeVExZ09cteGlbfBSKTaCg28zj7KhCJVUQZXQKj1jHGbM4sExB1c5d5f3aWbiwOl68FyEuJCwH84mZ6IYO2zf-x8sJU3MopZ7A7UHb2o-M4x_r_Mez_eNOxBWXUsXzmaMSbjeONwvV9bCGaHYm4-0JhJuB_OD0KOVFyD77ZXrsWuXsXn5nlwwvz-pr3wOK4CjH2A24iTixr3_1D1EWSr7kbSPtoiR9gPnJd0sQexnKPma6pL105vzU_uL22TJk7oY8z8Igd4BH8Mq-C3PdUeNeQmG_B2sYN2IZfqtTqq3EaZPWlVF8eBif3pTUaI6mSYcaVVyUdixT8p1kxwnrDz1ttKAccbZHSnqw5ks1h0DgfhHABGLic8dF_elIdHlnFmpDsuFTdDrEGwWlXcdFfNFUkpy4P6L4pAcM2VF4zEpNTa_xgzjszIdb_3cQMoLF3YjaSMyet2b3T_djpG1hJ2dvBxhiCXzUrSVzwFv8m-CCPW2-IkzHPrSvCmO4ugAtFjl0GIJ5knyAwjzAOFqqWUxgzouijIoTSJwDzgPvNkLFZ29_tKEu-_-3mcKdk3Q5DGrD7Or0qatrpfeP5AcrG8Aea4RFYukHF1g4Jc-D34Q6sMRomdTvdk0phGDBKGuDA0eB8IAvCOLC4FWaMy6R874g9B3mGH1xVTRHzIw_PcP5knVP-fRCsjtzAzcouW9sGl04hFolCwp5qOQWQ58Ll9YRKpzk1cEoW-kDcKTeOVkEhiScO6JM0uaCyOU2uuA04iVWqRGXlm8TDkjOh0W-U3vlQ31JG98vnBfYnqWSW7IMzCHckcPFHtIbzKB5y3f0FRpJ1XBQJIt3yM_iMHJAKt6F4Lwn_pg3l4BgyXOnXHK5jeKG9Hii93xtDUx3RiIlu2dGyPAqiw6_YpBlzJsuc5bZrHh5G501dFYBvBLJB6xwHpoVosW4AxRD_wjYGw3jQbQb_iliHIewnm3Vz_vAjj79Dnql7ivTKP4eNN5PCdnC-u20P1QEYdVjRg5_Qz0DRlfBWtJLsH2yICRh3d7jHbSv6cbhS_DTDTaXSsZ9RmdwqgRIBnThxwpnlhxNZ_d1blcHltMJFg3Fc0bSCPRbeFaQ9-TlXwt_6bFcig5W-5kfgTRaqUmfD0UcOSVp6KXfmcOuqYELqRKS5SibAPDZDvSQ_jmAkjaSyhnSu7c9NDWgN7aB_M3f8MRB4PxGzzgh7kxRjh5HJCr5jNO1M_p1LgAxh4LL2xesYw1v9VeWsY1bI5sqiugds4YKaMojpyX1dMY7EkrQMTdz8cqM7jLfSGneqp9QoZN05o_35U2AJNjLHt4v3mBrYNJYP9yLy-3hA3a4wHNuTlDh-QoEk1LeR3Kv0ILGAR8I8r6C5ETNGCvvFKBgzgSNz7K9nypXO0DsXGTpyBm3zJBBtVdiVXGeM3SouT79E0cRTu4PYKpHEUU5dnTnPDD0m7l-GuLzyjiXyFpkyywRXFTV0UqQf6JS1u8ROOmDgbHvX8s6K9MF2FELU3lLeSc5n95I-EWdycvTkzRkvbih3FZiXjia-nDfaxFkNPe53pJrnrdfg8FwvRKdycw52HwZagPC8YHE3F1OWKoNBDvFpr_5V3_ZD6gXZA7NrA3cR0AwqO519NSr5YddDsyFjxQ2FKUQYlrpl0NEjIviHWZPkxf_LaDwmk7jpIFXEAvdZoPtpoBbDKDPzqXil-7nmcFH-5IBZSpUwAWgiVomMlXTuMLqfagmN-YlPEbq-wlZI7js6h0y_MwbhhSCiW75tZHfTZKz5YoX-jBXakN1GM565C3zWcDOq_RQ4dAeaesEZuuipaXiLSYyYk7P42CH-u6c8Pj8RxS7dMjwQCRLiwmFbaHqYSN8h5c033HreLY59DBDzIFwIM0Zag3K7030U2eQ7PSQoomODlk3Ydlc9WerMDUY&cid=CAASKORoE5r8E6-aN5OTNPT3JUACMdy-nJbRvoZbndnK2BWQ3-bLCsNBuE4&rfl=1%2Chttp%253A%252F%252Fwww.mediafire.com%252F%240

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6abe399287becb5282bb55ef56393bd0f57d7b14e052193739ed3cb6eb89af6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30003
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B4B2 42 B
63 B 80ms
77ms Image
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Dp2PAd2bu43oQ1XQPeh6AUkdbbCtd1YL1lfelxh3M2vQwAX_3Uhx59pLpjCSOk0RUetKXuLIFbqLImZKunF62_QyuxBsZaFP3irT_3jppDBHDZGTs

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/ Frame B4B2 3 KB
1 KB 22ms
19ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/window_focus_fy2019.js

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:24:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1064
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:24:36 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B4B2 120 KB
37 KB 134ms
74ms Script
text/javascript 2607:f8b0:4006:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1b2415f02c89234a4b94896afa68c68db82465563711b8b05f0c1b8b3ba580b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37409
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1651664140737961"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 05 May 2022 20:42:20 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/ Frame B4B2 15 KB
6 KB 24ms
22ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdc0c59701784258f143dfd4201f28353f080e0900a3530a83702e08c9ff353f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:36:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 370
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 567849196274905959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:36:10 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame B4B2 0
0 45ms
42ms Image
text/html 2607:f8b0:4006:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSwx1_8hdlHBrMh8I6wXtZyhIiUdeXtl4K4xjIw0-B0HvaZb4fybDEyMH6mlgO1dyFx9nLQj6RNWH5gae-K6GuvHMacjA
Requested by: Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80e::2004 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

POST
H3 204 AGSKWxUcOt7ec3yJhv-P3wvVxp1bl3CTjS9xn6BmQu0VNJoheAIfDiZIbkCw1-HhBgwmyS8uRAXn5w7K3UrYOEH9qDrYXQClCGa6EjZWxHuf5LkJ3SvIRQRjp3B_NbrhCl427KrEMNQG-eLqppBPJLn9g-QOozar8MqSbogpN5AFf-xmoxBs5EgfUdXHQdZA Show response
fundingchoicesmessages.google.com/el/ 0
29 B 53ms
51ms XHR
text/html 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-9xn8KVSSGHqa7z07jzHlRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-9xn8KVSSGHqa7z07jzHlRQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: http://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-9xn8KVSSGHqa7z07jzHlRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-9xn8KVSSGHqa7z07jzHlRQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BFE3 6 KB
3 KB 19ms
19ms Document
text/html 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 20:42:19 GMT
expires: Fri, 05 May 2023 20:42:19 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220504/r20190131/ Frame F975 10 KB
4 KB 64ms
20ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220504/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

42b853168bb627593eb95b83db66183f7b3bd442db24c37398f1958d1451acd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 22514
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4421
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 14:27:06 GMT
etag: 1428802124239944296
expires: Thu, 19 May 2022 14:27:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 AGSKWxUcOt7ec3yJhv-P3wvVxp1bl3CTjS9xn6BmQu0VNJoheAIfDiZIbkCw1-HhBgwmyS8uRAXn5w7K3UrYOEH9qDrYXQClCGa6EjZWxHuf5LkJ3SvIRQRjp3B_NbrhCl427KrEMNQG-eLqppBPJLn9g-QOozar8MqSbogpN5AFf-xmoxBs5EgfUdXHQdZA Show response
fundingchoicesmessages.google.com/el/ 0
28 B 45ms
44ms XHR
text/html 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-5Ds1RvXMIzPIh4W05Wk3pQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-5Ds1RvXMIzPIh4W05Wk3pQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
x-content-type-options: nosniff
access-control-allow-origin: http://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-5Ds1RvXMIzPIh4W05Wk3pQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-5Ds1RvXMIzPIh4W05Wk3pQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxXCHBXoiwzjyZ0Id3E0pQHg37YKIzNqxF9pOrmkwLsKZ0AonsYUHc3WfBH12faeetFFIEZik6NH-QVGJs30QE7LuYOPY2VIaEjqOWMsBst6LmXa54_Xb8rUvihK1ak9Vv2m6g8m-wuxthJUOBGMxygaC80qelHslYIUQ4fpmyMoINg1xPjN52ShA4oG Show response
fundingchoicesmessages.google.com/f/ 44 KB
17 KB 60ms
59ms Script
application/javascript 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXCHBXoiwzjyZ0Id3E0pQHg37YKIzNqxF9pOrmkwLsKZ0AonsYUHc3WfBH12faeetFFIEZik6NH-QVGJs30QE7LuYOPY2VIaEjqOWMsBst6LmXa54_Xb8rUvihK1ak9Vv2m6g8m-wuxthJUOBGMxygaC80qelHslYIUQ4fpmyMoINg1xPjN52ShA4oG?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjUxNzgzMzQwLDI4MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHA6Ly93d3cubWVkaWFmaXJlLmNvbS9maWxlL2ZpajQ5YWt2dGduNnk3OC93bXBiYW5kLWRsbC02NGJpdC14NjQuemlwL2ZpbGUiLG51bGwsW11d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d123643b99ff418fd0e59988713e5a77f06c109a38f3378a14e6f333c65ddba5

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-sQFsHrZSHZ7dBtEpD7pGhw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-sQFsHrZSHZ7dBtEpD7pGhw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-sQFsHrZSHZ7dBtEpD7pGhw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-sQFsHrZSHZ7dBtEpD7pGhw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
date: Thu, 05 May 2022 20:42:20 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxUcOt7ec3yJhv-P3wvVxp1bl3CTjS9xn6BmQu0VNJoheAIfDiZIbkCw1-HhBgwmyS8uRAXn5w7K3UrYOEH9qDrYXQClCGa6EjZWxHuf5LkJ3SvIRQRjp3B_NbrhCl427KrEMNQG-eLqppBPJLn9g-QOozar8MqSbogpN5AFf-xmoxBs5EgfUdXHQdZA Show response
fundingchoicesmessages.google.com/el/ 0
29 B 57ms
56ms XHR
text/html 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-4Ml7faQOWjqZo8kzdkEm/Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-4Ml7faQOWjqZo8kzdkEm/Q' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: http://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-4Ml7faQOWjqZo8kzdkEm/Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-4Ml7faQOWjqZo8kzdkEm/Q' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 249E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0

43 B
1012 B

37ms
34ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYjoiAmAEwAQ&v=APEucNUowLZ7WJmq5qsMnytyppSUzzNLS5D7Rh0ftzNv09oL2L60Do2KyFVEN4OM8C6pshVouOiVCp2wt_hBmSv5cNyWVoAEPtZ_SFgg9KDK-nzcn_RP6BY
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 05 May 2022 20:42:20 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 249E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YnQ2rG.yLCFodLOQqdxEsgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2

43 B
892 B

32ms
31ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYjoiAmAEwAQ&v=APEucNUowLZ7WJmq5qsMnytyppSUzzNLS5D7Rh0ftzNv09oL2L60Do2KyFVEN4OM8C6pshVouOiVCp2wt_hBmSv5cNyWVoAEPtZ_SFgg9KDK-nzcn_RP6BY
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 05 May 2022 20:42:20 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 249E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1

43 B
1018 B

22ms
17ms

Image
image/gif

68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYjoiAmAEwAQ&v=APEucNUowLZ7WJmq5qsMnytyppSUzzNLS5D7Rh0ftzNv09oL2L60Do2KyFVEN4OM8C6pshVouOiVCp2wt_hBmSv5cNyWVoAEPtZ_SFgg9KDK-nzcn_RP6BY

Protocol

HTTP/1.1

Server

68.67.160.132 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
X-Proxy-Origin: 149.56.153.188; 149.56.153.188; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 6b02f771-4ebd-4471-900b-301ea7951c93
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 249E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D

170 B
188 B

37ms
37ms

Image
image/png

142.250.81.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D

Requested by

Protocol

Server

142.250.81.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
X-Proxy-Origin: 149.56.153.188; 149.56.153.188; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9479c1bf-ba84-4966-b1b6-7ccc6fe7cff3
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C229
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0

43 B
1012 B

38ms
35ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkY9aWAmAEwAQ&v=APEucNVn1yGd8ebXIgRJ1xLc0T0LZqIBl02ULa35bdRcQxmsHNrdBA1m-2RlpBD7R_8LAqSGIlplhV9fgKbs0nBW8vBTldFJuN42omPF0YBZ6jtkxOb4AIM
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 05 May 2022 20:42:20 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C229
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YnQ2rG.yLCFodLOQqdxEsgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2

43 B
892 B

40ms
40ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkY9aWAmAEwAQ&v=APEucNVn1yGd8ebXIgRJ1xLc0T0LZqIBl02ULa35bdRcQxmsHNrdBA1m-2RlpBD7R_8LAqSGIlplhV9fgKbs0nBW8vBTldFJuN42omPF0YBZ6jtkxOb4AIM
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 05 May 2022 20:42:20 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame C229
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1

43 B
1018 B

45ms
24ms

Image
image/gif

68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkY9aWAmAEwAQ&v=APEucNVn1yGd8ebXIgRJ1xLc0T0LZqIBl02ULa35bdRcQxmsHNrdBA1m-2RlpBD7R_8LAqSGIlplhV9fgKbs0nBW8vBTldFJuN42omPF0YBZ6jtkxOb4AIM

Protocol

HTTP/1.1

Server

68.67.160.132 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
X-Proxy-Origin: 149.56.153.188; 149.56.153.188; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 96e74720-7e3d-40fb-8fbe-2b3154392844
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C229
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D

170 B
188 B

37ms
36ms

Image
image/png

142.250.81.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D

Requested by

Protocol

Server

142.250.81.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
X-Proxy-Origin: 149.56.153.188; 149.56.153.188; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 24bf7975-d557-4513-92ee-daca8c2ca58e
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6234
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0

43 B
1012 B

39ms
36ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYjoiAmAEwAQ&v=APEucNWks2OyBIfKMLxAlL3ojVQaIHTYx4GOQBlsy9B8E86-CfcFqfWtxclFmAyAV35Y8OFZhANQ1BvWmYy0xLkRY8pOxCzrkxvNr1_sqtSf8frRUYgpaOI
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 05 May 2022 20:42:20 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6234
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YnQ2rG.yLCFodLOQqdxEsgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2

43 B
892 B

31ms
30ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYjoiAmAEwAQ&v=APEucNWks2OyBIfKMLxAlL3ojVQaIHTYx4GOQBlsy9B8E86-CfcFqfWtxclFmAyAV35Y8OFZhANQ1BvWmYy0xLkRY8pOxCzrkxvNr1_sqtSf8frRUYgpaOI
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 05 May 2022 20:42:20 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 6234
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1

43 B
1018 B

76ms
53ms

Image
image/gif

68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYjoiAmAEwAQ&v=APEucNWks2OyBIfKMLxAlL3ojVQaIHTYx4GOQBlsy9B8E86-CfcFqfWtxclFmAyAV35Y8OFZhANQ1BvWmYy0xLkRY8pOxCzrkxvNr1_sqtSf8frRUYgpaOI

Protocol

HTTP/1.1

Server

68.67.160.132 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
X-Proxy-Origin: 149.56.153.188; 149.56.153.188; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: b3d8712d-c2a9-4fcd-8d04-0ca9d4339676
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6234
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D

170 B
188 B

39ms
38ms

Image
image/png

142.250.81.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D

Requested by

Protocol

Server

142.250.81.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
X-Proxy-Origin: 149.56.153.188; 149.56.153.188; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 57ffec9e-1556-4fc1-885f-4d0e1ca9c8dd
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 602C 645 B
306 B 36ms
36ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkY9aWAmAEwAQ&v=APEucNUjq0inVA6ylvQtEnwaIdeVVf6_svRzUQjfD2PucHkQINfue59KwKatulh9Rw_ruPCMb9ocTvsZLExSN6gIhiOiTHeZthtHchn4L3ZYXK25LThRN6I

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 285
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 20:42:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame BFE3 59 KB
29 KB 65ms
65ms Script
text/javascript 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BBNEPeC9EXKdYbSDOVWg6FbKDcbTwTWuGSHUppzsa6FRtF1BQ8_GC6xZqRLy8wWpnnjOzDPIvONydmc2C1aj94frHVGQ&cry=1&dbm_d=AKAmf-B6-5l7OXq5cCgUIoLvEeT5YZM5-exxjOdx7rkrEpTgQqcmdmqeuNvR7brD-nRvtDJKeBnw48kX04h61tlNS9EWAa7mfMbqXSYR5DI5D0IlFW12lI-on6JmlfBvONJXiJJTMFZROVnCp5pLQKUSTvZMa3vABqB-VltmNW9rm0IQPRvnQqFAG-uPtLOyihkNpSZ_eFWwh-s6Gc23J5G4NpIEIkHOLT4D_rlLMoIcR6mH7rdEQNdkr0ZPEVrhQE-0p3koR6j5bK0e-QdnbL-Q1lR2LWiIfYhczCX2INZIZAXlz2bHmsrX_yGJ8V4SBtsoO31h-eLaFCIdotRYneUgEZGCBQOsrGGn8oslAcJn8TqMz1-F04-SKg-upMjemgmikM_DqzkZVuGzkrYJHKrqgF6G4q5c3sTz5eAODV2ec13rUnDceRjcVogeT_G38u4bSJ22Ytw1E0bxMq9_1XPwW_HkppMwfWcCai-spEM_Nn9QXknmUCFIFD4X8qvpBEmiwQ5qY29VVhC04oBpjSmKqB7ekdg8XbpRxMQkAVZuGqmoGe7y_eWBhYy03hF43ZPIvQlaoR0Wdt9fRMkP1CTkn_wIxE_zlyKgCl3zQBvqICy0AfuHgDQGfOzPhQ4KKN-9POIPUR04i_2U4F68bvWY05e6JArR6F2UbIcupOLS28pJRoNVD8obWo6EBguLtGoCvOpLjSeQLSEZfXyX7BGsIe-eL36QKDalqSGKMF8cAxHp0rsCJxNorcuK_iYxsPNlyyd_I3doFlubU1egA1mYpy4mwDC9yzGIP2Ks-pnTsz6U6bmApbdN3k75xUzXZ68tUBye9J79yAOh290ic0ulJbUiQVYwnj6o9PzXAL4kwk37fxfXEeHuEh3x62UNVw7kkDAZ9jOVJ1gOeD6wpLwGsixvCTkItlp02ZTvz806A7ouJZqY98YkfHcDwxn_ErIC3Cfko32SeDGx0cOdKRZXsR_NKSfethCTFkXTSAw55FaZ6fIPc-2fbj7t7s8qfoMgB9btk-vdXXyfkq_dKzrdZBJ3PXqjoxLWUqKWeVwiyKk3Po2sP_BELLALj9phii2fY7L3aAHbmJCDRh0C4zHbNeUdPisdd4JnRN8riVrbCWUBOyvvxFrXx_XCOWs4bf1SAHTTcHxzWYupC4g5ySdeLpQHgViRCAq5mChdREkdFVq2XOsysQ8RtEBbmJk5ZfWa9rHiCc0aqNq54qASTSGGFaLW8Xa7czjaP7R6FqVIa5_NjEGXVwsiAh-2exGixcXfEPkG_kOI6pA80rykU5qReF_Pb9Cg2KDFvBt5LGsxJDrrG4NdRMAiGciFGc1hR26vmXVE8lpH35f1f4sI3G4gQtLStHri12PpOBJtdZn9HZZkOabmhS5W-A83jF8oITN2WYq2ZhBXShp2HSv7OUtl6hEFvCgx-C7qwgiyjTXNTfbJYZ1w_r84-D4yTb_V5X6KiDrNpatolqlKejnzukUf6pudQfEWkcPYL2DMc_jhakh5lLYhTOzB9OIPHcaKJMVJr9DZZNHx6gDYT6ZM44bmCT2luTgRpJ3JYsNCsgm3Yi4MYHGGf7rT6pTLHl9V2ESZQ4J2g61nibAF5sz5CZtyiQMYPQ92HOcj9WsLOzrTEOUvETknlUlrUe4Mo4CwU4Iw7gqDNTgJQmjklLm7wy6ZLyRs6CpGuROrsyu7vFKO1uxeKEdpUI2j8TH_bXmxPgL08MxjQkODeGyKTyXZs7PpZK-Kf43S2OAgmTKO5GnaplkWrj41F3x8oU14N-RlkGxQ-leMi3hljDGRC7KStArSLXEMuk2AEdpJn5FzsPbHRSvWnFjs-ThbdcVIxHRYAufr4sRPQ3xseIPd_NhugPnVlcPRHw0GLoI_zRhKBpBjazFlhG25GH5qysZ7Ua8Tb8kP4FM-PEi2_apbiU6C7ZYovPwCVgYuPP8KvinBjbCQca2mdQZpGjMh3UcSAMFtgFm-6KM8Wqcao72QTvnT6pyq5ae8poKBdtnou5hLQAoTbUpjwfozyUKYOHgHogeZ8VAJar9njPjS0Z-N4-aX1tnmO5mcsHFCvZ9KXaQUlUv_ZMxHy5d1_svk6pl8EB8smyOVb9Yz4vy1C0L028HSbI8_5-cfDx2AeVfeg44-shjP82qmwOQepMDPpLGozmDhY3XA1sL2N6Amig0QBByoiXjKnr8psY_bwAnKNfTmQTNJ1z-TCsN6fO59DFkeE5-6TixdCMzTNpsLomJSOnDJJsWKDfSv5a5XSvaDjG1Mk4RcS_HI3h1JpBqx91ADEkScWDsoLPG90VzwoHaEMmbOFFwb8M7Vmj0Ir001gZLNzl_gbL8_HFkyh2m3CHUzkebkoOUvZopXRtQN5l_V-AAQYVP-R-I9RkNtWFfaBprC2oD2rY_cMcYlQZNL_yaoqjMUPxDrEPTUNmyi5rWaP5AWvjtqC1zUY9s5NMUXLu_-rxahtjDTuqERyyB0mRAzV93xsIPfMHSJxx_XZ12UlUANRntIue2sflKmttbVFaifaRmCqRX7ICz1h1uZ1M08F4w94Saz8ydqQ52cyMw0Ll1_kZnrjs1n33AZb5dqiBrxz8GCDAc9UUb5N1hkHdqwyD7LT_qb4x6yAcMGA689UvRAFcOrgKoCRZDqE5i6X9W03-d9jWJHNKlMA88UABA99D8FScM56Z1Q21KGYEKBM5jyHiFgb0Irv44qN0B2Nq64uFRO2oNCmHqyZLA4t2LJ8nqc2iUahs6nW-ZjzoQUakj3sQobWQPb06xga6mOa4OstwRALTd4tK1s_NCHoNTB0djlW26QBju9OCiCg-SLvGmyem9U0AGryfnLJEozRQi2lLDo6dV3PYOuVZCsQOswV1GvKolCG4vUKSllGo5V6-2dofJTJ0T9dEuXvEZ3wFfrFd56GgR3HD83g1KX5oZTyrh-vHfs9ZW1hGl9dJHw5bpQD95ZYj2Q8MxCfIn_fgAdapTjac16CLUXN6qZWa6Vl_Q1Z1P6WffQmnaKqlCLNjLuq0bPZPQufHOk4yQ996HXv81xSiTllofm_DLc8tb7axeKrAcym2hbQ9jlE827dyJZFbchJUTmonwPeQ&cid=CAASJ-Ro8jPK54S6L4z5RNevZs7droJg4I3OvZK2hmrGaXEhS7JT67dP-A&rfl=1%2Chttp%253A%252F%252Fwww.mediafire.com%252F%240

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/file/fij49akvtgn6y78/wmpband-dll-64bit-x64.zip/file

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

07dc0ddf7f0783b2b86a49cb5088a8341b0ad39442f0880306eb103bdaa4f042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29972
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame BFE3 42 B
63 B 85ms
84ms Image
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CsEP8VJLyo1FtpV0aFcLkF_xccCPr7gExnne11B0Jtk4OryiyNkm6EmRLeQmms78GIuJjCnYgyn1OpEWfhDdmqkHe_IKbfBEmtkvX0lNPeJNvtgiw

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/ Frame BFE3 3 KB
1 KB 21ms
19ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/window_focus_fy2019.js

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:24:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1064
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:24:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BFE3 120 KB
37 KB 89ms
46ms Script
text/javascript 2607:f8b0:4006:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1b2415f02c89234a4b94896afa68c68db82465563711b8b05f0c1b8b3ba580b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37409
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1651664140737961"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 05 May 2022 20:42:20 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/ Frame BFE3 15 KB
6 KB 22ms
21ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220504/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdc0c59701784258f143dfd4201f28353f080e0900a3530a83702e08c9ff353f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:36:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 370
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 567849196274905959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:36:10 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame BFE3 0
0 38ms
37ms Image
text/html 2607:f8b0:4006:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRXnEj_hl1yKn4Z_Euqw-jqztISa6Jj89wXKF0nVABWUOtLcvBjJhHDI3Ll3bN1sSMGHvPBXoa4Gz559BDE7wMjvvkHUA
Requested by: Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80e::2004 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220503/r20110914/ Frame 37CD 25 KB
10 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220503/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BNLr8kfQeVT5uf8AKyOOwl1cJASPVlSH9RXXn927Fh272l6UQ84dmDmyivj6-ZF1H0Q4Y35owxsOP7fbaFHnEYuW2-pw&cry=1&dbm_d=AKAmf-C2s59DUwBeBCODTg2xp7igaMuSPEbLqGS7nzclnlxoYLrTH2zEqyOAqWqfeROospt0XA7lTu1DYG49r9kpkv8Mm29Q0npfP_IgkHQE79GoQJu9-gpndCYxgzIKaFivjlRRHW34DkCFUDw9IROPft1y2nFNyIRuN027_eVnHvqFIM6u8fb4P9SWw8ler7k01P2nylhAqcl2Uae73w4rX_mXzzcxXXtRczl0YyyDE4j_mNI2EJl-UIYvV0KbJqvJcPrpJwdiR-JBYEK8N_E5rwyOsDOuOSOIUj9kGE8Q01xiPYA3AuYy8BTv_Kyw_dPve95_Z8lG0XzvZCmS0EPHSdWMAwzgAeX8YbfoovvNH6-1gVMir1Ncbbq1F5O_-t8NT28BLJ4dLLA76WDdGznGAJvwBWAWCPm3Fz6Qs37LuZT-irnqr5kFEpVUaSXNxG0_FLu2uc7kBq7Rgug_VwGPNncF69yWLMNPw67Q4yBGrHzdzF1MuSsC485ABrnAlXG3h7RxqOHL0xZ00nJmd-R1aM76fCL6U8B6RBLEwN12xftoAj6P6dGR6i6097KcqZFjF-dQ0jJ2rfrC213P0X0FAgT4kbC8t5l9S1rwXLy3O620iN_Y-GqUJd6yDk78jcmnrdOTIsm26sJfw6rVz99e_2bgNH6yHf1HtbaoXinCfazQZb3FkjQ93LSPTmQWYul8aFhbYwKBG9lmn0Y1IydCX1e2pejWYes6QoU6NRMxo_Twzd3NqR5uN2Q97wqj8i1wYnpl4C0vzuZB-XmfzKNZtmP7DmDObx2-ZJSVF-FVlha59YqkGfdBswc_asla3uo0ELOko3CIv_081CUTO-KxppWGLen1rSUgNvSao30jXYeOvkPOyScT6VYA5xKbNAlkJ9VtN3D-4Pfylf3OXgEwtxhPOxHpkzGuZ3aSMtFhC2adik2Tdy3iIKkB5fo-8oYGWnZ-J5kVltfpSOgluWPiR0xvBMIIoEOJe9z8XQs9qspZuWWDnjKGEcLF_PSdSUfz8c3d9CM5xXF7_AIBQjSCXC7o7loCpkGWt2NkxAOH4UAR2ky10L7AvhgCqY0Jgq7qOmOGVaHTb8GRrUcvgnoSBcLgbjTuqH-uODub5d3ihtEhaSqsIy-ZmYiGR-hfFilcG2LKYE6ka1Bq2ubZCqSextITPx1cDyLZ1XJlYVqBfZ16rD3MbywHwOVWkmFZC9HNq7uqRx8lYEhxVo9rWZkWXmPCmoJEDoQDIfNpN84XIvvYWGgtFSKI7GfxjtKv-VkAon4Csr6T6duDOLGldUYZadVl_GM-XRA7U20KRUanpUkt6CLAhfT_L6oFDK4ZhLy4JDzHLvS9lN-jOYPu0cjk8pPE2SNAZhV_Cghr6q6WIktmhsXp6iOaXt4bJnsNqPAdEwan8-c7LnMRtq7mvwXlelE4gb6_YaLr-TaXztSdvpdRcw6I04lzH-AkRKO5H8Fyd1wE31voIiB8DLvEMa1awfx-QFKrPX0MZseFflS1w39VFFoO8orrjU56ri8WUZLvsAz7AEdJ4ScA0dZaoNPI1iRd9C4eTv4sa90YwCI7EZFWm6MSL_J8V9EPk137XEn4s8_ZIVQN6kTwOVcXGRs1ZvbOMNMDNRaFHkjQih1Xq_9NdC1Az8hABgBTwFktsjt8hXQ-prQu0EAdJHQhrH11R6Bl71hnEfCXa7C1yqKIVUHVNc_qftrj8aqFqwrff86fTXLYHUwdZogxiamQs8zJ71OLyUQNjwDOtb7gRGVyk6O5LEK19C6Ik2RmIjO8jgeArza6CefV628C5gsUGyvf7bfxxYIvQI0szf5E3rMW75CK4PKcOH-IAMIbpVZgVHJ4Xe9rafp7r_HSJ_S9ldiSvE2bn_ISA8NMI4Z-b_4SB673WNKieQqX7uJfOmFih91pGPflDCBxFRJiEgoNLjmKX7thZN4Pl2cn1A6rAeCgGxhxst2c0_viNG6Daf69WgaNd0jcmqCXfFoz5DNK7iAiYMCo25NoWh-RE7tzA0OK1qXqD97QIT00yCTCOKU1EO8vw79cc9yehE2paRBTFfQKe22imsVtkxrOOYcezH_qYu32q3XyLj9Xvp-FoJPAG8zkc2A0bXdce9n7ApUd-MBqgZ0ORERzqXONmZD0zpNt74cEo3AJT92_ij3haH8X0rJe8_ggmSuE9CmPOM9D1UDnq1vBJ_jiaelsd882lhUG6Ldt6_W-w2ax20lZfmPKyJ6uRQnyJIGrAw_SVyrOZNIBOzEFhpQWXTji74Ofo2z0FVtHh7OZMvWIP5BYIT_0DeHX35962cJtIgEM5uGk2Ooh_4XXW01SP__5EJawbEV_gWLuYcrJ3MQvqpRAHHfLCI71CqggqHXM7xNk2MVotpkeyE9CiBlpEu2mDKJH5C7GnksuhX6XonplR-6fLY3EMV4RZrRFqLGDyUgAjIlF6P5UBeLKNkqYMcHfaKz1jdvQtxjgHPeDHKPQIPw83l4pw1Io24wUBEZK5i5B4qNYqM3-xm9epEaGyyNmaL2i15EtLMH6JyA5UFTRqojz_yyRGlbOGqUaeboNynKcphdg494SuUaSaFiEyEpp-8lyeCx2Z8xG4zRJqmhyB5jldmPRqtRwkyBW-dkFPh0Q9LPqOE0ccXb5n-Q8v53t3BQ1xWMxtxkWWqkXHQrZXT44zwSYZ0xWNWatLYhUZsbxm0TUV3QEGhTgvs8JkhCR_19zRQbyzoirsOrtLH1AvXFoXWjPjZmRNGpyRRaxFfBpigdVXJQ4Upix-X2ayYzz8FwQZMdBP673CeT289vI1WH6pTjJpqLU2_Jo8VbtweOLd_mQrHUA7NSBWwEBZU19jq6xxQy0M3Y26ZwBNd1oNteM-MRC0V00EFITmO-_R_hlCep1eIdIsci5IPUs97DYrR62ymsu5oTH05icZqHpxBTlB9lm-QfPzTGnbDDkSjGIApQ24yqja0vCnOgbBhzqX1Ozx8PMBGgNnk6VTefP5-JNFZtoChiTV5V99Wjm6MdrJJnJEMNlexViEFPeN73m1wueE2eBaSIJvy2kYLml5_DhsTBthkMYveAmQNJk8ggMMJQp35R_wuLIUPd5Qg&cid=CAASKORoWXaTkCNC4Wix9uxXPhu2m9CV5sKhDRXm88CoF5r8oMH8FSkw__4&rfl=1%2Chttp%253A%252F%252Fwww.mediafire.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36998456859e35cf76812894575b0203d48ad8ac11d3165c5449d1fa73f19800

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:35:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 391
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9783
x-xss-protection: 0
server: cafe
etag: 9821519945299111448
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:35:49 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220503/r20110914/elements/html/ Frame 37CD 8 KB
3 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220503/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 219
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:38:41 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 37CD 0
622 B 115ms
45ms Ping
image/gif 142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst6UEAMq7-yq__kSdecPboS6MqNoltBJxDDtqTEZbLUIghxtdRGvbPV2NgEul0bN0GirHt4o8We48AkWbnBVSZKAg7jWl-Phd08jAwCddVpzl3r9Jy8zPnvrSb26yxG95mIAwL6oh-bmaZqpop4Fj_DOKVSllr9P-VfMYkUP0gMYaee9k99s-FB3Huazq3mrDcWJII3e4lZm464ASCj9yocgkL8hpSCPUdsDP1pXoU7fQy3TS_Y91Dja-3tHKKs1eHop_9kMHRAo_2FbEskgwP1fMSdClV0zWk2UK1UMxFvv3m6-9Fq5hgJHZpvtv2LwAhnPr4NjJ1q3GbuGq4R_vJLqQ6kpwlKb5e1Vv7Fq4rXEsQ_VosduKBAII3M635d-ZsDUmXVKJjyuyJJw-LUTD_o70xwfJ5zZDxArPnOwt62FQvtzk8LS3JFT-qQ61802eUPtTvoNqHKVMCSSGiurza_A9OtIBTkWk3O43Mu0slJqcq28hWJ4aicyWk5c10N6lplqqvSIChuRAYyHT8rGqvdwH-pUiwFr0AUDpfQtNrpiUdVtanNm0yN7we7asWxF9z_R17KZrx6xFAO2VqP3rk9seuIFmVKMVP_WvMCV-z8YRkk9-LpO8MY3f1tfbbbiWRu3Nb6fOvl-WIjr3TRxFkVSqcR9A2PgBU7VmWMSBwHT4zHpyddc0XyRzfbcFrWk_Tc_pzc6umKjTJz2Qwkb5HQ2yo7ad5hlbWBXT8DWe7yLNJc5Xc4XC5duN6XbnbTpqYRIkrzOox_VqhdQ9orK_m0eXHXes5ZDRRotGQP21hkRCaWAinuY7KRe1BgK9v6foTJonFnp3iRv_YEC9QwPihxqsioollgLRB-k1pjj7Qsx89reKtJIMO45SHviCDTzMXXAq1ejudp59BqLLO38yTyKYjdOdowWyDjp1r8Vg7ER3v5n4jIhRdctSsk8NIX2N98jIx0hxOWL6U9fKz3lo6DDgrqG_sjSByrR-2n82HZ-KAMfx1TwBOnxfVeuzoP1htJOm52O-Eu5CK9N2U08g14AHF0GS7uZjSoV184gHcePHt7j1jXVoogkCBORiogi-b5j-Xg75USR2har5lfh7vaz9HmKbFS9wQehGSNl04miT93vRWS3PDbpt9rVWGLHeIcfAzqdgTvD7YUeYUZKb4Nw1rFQ8U1wSsOEA&sai=AMfl-YQPmM2Bn7qSeLKgOsYfPFXK_vGl5ERrQ1I0PIcx5jUoskA-ToyIfEuMOp_B08AIM4LxTOE4-cJbCrBm3Nmwpcp181ngz_IIkx-_jajXoVzDxrCtw7318oGyv_l7Xq8hcWevgmQDEEKMxShgNGgjarGvCoD40tKRdNyDmeEGGYa8UO3ZZifuSQzC84L9rHmsFaC-CLDQY4lMMFgfFzAarFQxeGYq5rrLsw&sig=Cg0ArKJSzKbEaXooPXrPEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220503.78286&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Thu, 05 May 2022 20:42:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 37CD 41 KB
15 KB 22ms
21ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 00:32:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245405
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 May 2023 00:32:15 GMT

GET
H2 200 15661044598845104375
s0.2mdn.net/simgad/ Frame 37CD 25 KB
26 KB 76ms
21ms Image
image/jpeg 2607:f8b0:4006:824::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/15661044598845104375

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2006 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44170a187936c909e46990879c52f88f82a4c133c6f938243310e6549d49c193

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 12:01:11 GMT
x-content-type-options: nosniff
age: 204069
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26032
x-xss-protection: 0
last-modified: Mon, 22 Mar 2021 21:44:49 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 03 May 2023 12:01:11 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220503/r20110914/ Frame 600E 25 KB
10 KB 21ms
21ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220503/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A72f4HVY61a17xI6ZUdOPnEVX09YoT8icFs6TPWwNlIKCzMiuQefq2-nR8C7Vm4Rm1Msdy8KAGdDZk7R6w18LIPgdaRg&cry=1&dbm_d=AKAmf-BHclm7wHrVap5C0kjlm1w81Rf0Z01NI-Khbl_pjVvYVSTdZ7TNEncYUw4W6bOiR25o58xHYP7Wl6IbUt2ZRGIZDboyoPpOhFJ4XTU4Nkzh6aWpvccUW0fWNGUDUwHPASEYaaC9Ne2RT3ySBLlpTskOb7vwhmqtLn5DLBNRGJjBO_nW3UPDIrmA8zpudGXVMbJNwebXe4KP1xt7ieEtuEmUF_jHmxi2shPrL2MtM2WQBvw09UoF9fwgVK3z6ID8vkdF4gE7jJZrUYgljtmrvkQ4HUjLU3z-3KsSyyqr58FLhtaHlgEzteoE4sqS6dZHc23k6PjHu1atU6m4_oRmxJ9zYUsVVTRqMz1RHsbvbH4kDTAT3mbE_xWSgXxv2rms6_i-HWKkkgaddikhlNfKiE2bdEL7arMLWp8umEiVlwbTnBhz2Mk9fx7p0dMZkkIqeJH9N6Pt3inxO3HsjEZiitO0Q61_St2f56iljJt5GG-7wZPwCPgTuzz0CJHE0sthzLn7LShqWPwXapnvc0xjo0xPhP_ralxLWnegyDWNOmxB4SzK8eKXF9k-3rfKcjdxAvcaK5CDPUzQOJiSt45-eLwHS4OuOdysCj7pweVJ9odVSxVVOLRWC_6puRtzr3VNQf2PDzMqfVJluyhbsquEMKLb7ZoAUBcLP_xwg8doNoPciKT-gYJEemCojSXQxqTfbHK6f8os0Q1he3cxYXFhxQhD97LorcHmQF97Z9TvVaVEjahRyak4DH5icqzbNkIpZ7Q_GuakFWIsFSS-ZQem1CkTd5WcmbaVs2HFEJ4RKVzcWr2Ysyov6KN8Prub3YJ3693bbNjB6B49hAZ4MXhwSWs99wgEpZfS1LiT67J5RIzT6fUEMVGM6QkPcWYlBngghUbGNZu_ZgZtgPPk06AGO5cV-SrGQoN45JjdT4SuscUjrIxoZYltJnhJYAv3_oSO7-UBj1pSsNKceys3ijVSuuGozFmPlJ5BJl4gu4i1vSCRDuCxwMyF5SBcu7LqL2iXRnOPDFeDX5Tci79jVxCtpK1UBVZ4uBqyWgbwpLcyyMLuKctqMvi15zgnq6KITxdDDHjtYasqD3GEBTnMAskyvMT-s8-UqGEkNxM4H5n7A9eqvJTys-AKNwtWPFy85-l2C16bLdkJgE7vdJ9iZpTYphqAs8hlK3uei9EwBHk3IKG4tus47uhdcvFGnZV96w4HD6j6hleumYBDTNZaZHg9TXX5emZ-sNhx2e7Yp0QaITuYK2ObQhtluFkEq6mUCaM5LXJWJMLrUurLNX48uqydsf5OpiB9rVdfrRoF6BvQ2zI4ANtvOZJ5AWu7yyNik83izOnufQN4RjYFDb5xz9UPvye5ND5B7mvE60zTK-hMjlaOFbEGRdYoUQUJIYXKL7QmxqlpdxZPB38EzK0kBFW9ePRjYE5p1rhFOIjcs6NaXiEzc-FlMUWIpnT96P4QHliOvO5tBfGmcuAolUX4LOJn-zFWs8i8xW1TvuDzL9a2FCxc8vzQtdY8iUqjSm7iIWoqNc3MOdHt9q_Ox_VzAkq67jEeWpzyKfmshbFaa8FySQAt5j35YHGjrXspJEKJYFQeqzsXBgvd04S4dmZBXmvwLkfUpUKtpZK4wXiOW8X6DMtfTQ2-L3e3xzA0IR61hcQYOVLk3zCG_pO1RL3HRKGOpAo2rccH-o1Y9Frh6zn9bh8kil11-jTZcuTm_T9B1zxoK8Q35juGIG7Nzi_BcYDgDvgoDPQTFslsxUeFctrPxFL_tv_x7ElsPxuZlWIYIvVRaDdz0L8MO221XjU29eycQJ227BbixNvU_7NQP6_mvGZ6G0b_w68ZgQrzEDOiT3a1HIrUFJVXxch8AHal7jCK8v8KqdrvhF8YqYJVhc5IqlrT-IgltVqI0Ca2o4EXMKGlwA9Nth-k2ZpNBOKhq3WdXWc_KLn7-dkPjV526qQTx1ND3yGM5TJGeSvWp2WyrvR8DoDYjVoO8eDkzwczJX3IVXg6QyWbSjxAl44sz2keA1vkwe7D3UIOM6hBXoZaRyF-PiLKkzKwjR23R6MseS3Lp2R-gWIgVTgmt_fRfP3EVLZQ-aE88lncxQo6DZzOkMGWousm7j1RcGNQuz_IH-t8LQrOsF8OFAZBawQ3AGbdSITAFmWE1dOyEXf7wwRqP-cLpmOxdVf6v2bz-7pAMKxnSx10X6rXV5c16-n-q-o8aaBLYUCRnskwT4-X-yb4YWOZSRVi3FKgFqj9w0nJlDJOnwWNF1f_jQZoefQRK4Wj1La--3wcJxUwKjAc0P0oda0e_AvZ5G6Y_Fvz7liRDaw-1qllexgYEMJlC1TMpwsFaFz9W6Rn747L2FSQKf9s87YLTks1st7xXzefdRSnFVItLSsUrdMgNy4GcuXGrLqs-vlpjUovcJyQZ2h3_0EShUJ_HYdINCeI-bwVcKznINETdthzt6PMi7BZ-Ra-j1sKzuNkCClrQne7sJDy_GHB-nq9F3ckMc5cyrAhJaKxgESKuylOOpAdBe9rW4tS0u_k0CA8VY71nSRtPc0NFtfnVnIJyGZyogIGYaq97UEUI0qm-XUhjpJkc90aPyWJOXTPxLiC0xhbc9JDmKK0iukzQSf3gB-i0bxtwwbDx7zblS7EztKqC80MgZADFpSJdirYcbE5_22P1iBBV-3kyx126lW3TQb906ooLEOTCSGnx6amoi74HwNRj7gLzWTlaz8uQG2b317uZK1kdiGTUtWxu22HUN0A3byYAAWtohKktoWZy2MiPlN5uebopxZGpziMZwoCjzCLPY8-x1PtlCPv0NEyOFTCQGFsEK1jtLIDtKsK5-U3sp0kM67-lBBZ0LGdXusf4XyK1QtWJ7kevf7Xlq6lZOUCX5xzkTeTGe5ML0i3uxt4Ax5T72Qd2JyQDWObM66QAosZfHYx9ObyMQ8c0dVhUZj6p3fxoye7fncaJ1RVeGj2-OZBRGOOGdMx0zx2XPuK_EmHmmBNBbE6q4vtPRwCU1R1BQCCQkf5iGMJI5zVSZa_OFJTrnkDnZstoliCSSi88pBpDJZvjhWZdt88UaAZ6KFHzYOBwr8sp4RYy4QLQ3wyLqsaGKScat5WWCuhAc2DrEmyQEI&cid=CAASKORoUJ1nd77SMv-7s51GRYBvAW6DvK6i2cQcWMvXHPW7Mwa37K3zVlA&rfl=1%2Chttp%253A%252F%252Fwww.mediafire.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36998456859e35cf76812894575b0203d48ad8ac11d3165c5449d1fa73f19800

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:35:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 391
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9783
x-xss-protection: 0
server: cafe
etag: 9821519945299111448
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:35:49 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220503/r20110914/elements/html/ Frame 600E 8 KB
3 KB 25ms
24ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220503/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 219
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:38:41 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 600E 0
55 B 111ms
48ms Ping
image/gif 142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv8RuV9MYnirnsJPcAK7mUaqM3b2w4bVtmZAV-R_a8TrNKyn9NWr5sS2NqWAbH2f3T4V0s8Zn8V1x-DwZDsBoxlrSeIoeMNY0v2jcpoeemYO0KyTJmFmO3YNLo7KVOWE2cgix04KvJgDABm-LfGFgb44uU3vaJgUiYDTeDdoEio6a92NsLg-NGfD3H0xK0QEG0Tc1-FKUTrw7w2X6nGEFtCLraLNYU4HWaZN_abB0SuzTtb0tLv0WQ01shhK35-Wj10Pnmie2GSvodLZnWKm4HBrRXlvpc_0KHZjHXj8DWpp9DYf3PFHaFGo_Am1czMM0oNEvjwUyQyCo5QlEqkABmP556TOi8NjX72IlfZ3G7maf8T8sv0sPj3zqaO6cJ2dFT871ewVsn-OzCZFs52VRn5LFvrT0FVzpZKoTDkIeARvERTXgNSV7NgMjPO1XXsjE-QByG6w0rNJ0HW7zjSHgxlyw8thAVZEm_0dL9JFhpdgQBPKHb1sOG_KO75A5jo31LIAZTkLsRHL_fnOtHIgE_7zkF8JH2KvJbe1Lv3-dZST9cZcM3TI7iLPgOqrGu0NwpsIPYk754mZXNdGMon8Evm-f4hFZ4UCnnUx-O5UOwmgRGNxjvq3Xg_fKzPhqel9dFqIuflWjY6m19OxlQqX1Dlr5i7aTBBiy8LhDDW1KT9EqSyFTFiVc_qeqzCPkW3NJMhZ0iKEqnk-MqLay5jFrC9vsdDhuQtbdN7IzRk62m1ooPKDI9iTyFcc0SB6V6qwdrbkVETrMk5wIKb91NSQhglTJ7WpNhfuaWXvjA6KCFw2zmOELXEgtA_HpQs_HKTYNMAsV_1qDE_f8bCk6oGU5wenbV7eTD-YBJfkREqlrlVqlerWiuef6rzByUrvu7adEXI2nbSubgMEVBvuthXQ2qK1M_RrxXiREYuq1b94baZnZJJFI4kAhAzG4yn7vL5u19H7OzB10htAQPODwMhufI6toB85xUDWYlyeubOvFCokfkhgmzlnwECXfgv3Wb9ViSxC7Dq_X2gvFUDZyWaxPor4j5k5SW5zgbxEon_D6eA-Emb-M8JrDsUYy7FhwnZwaMU-xYh6ZjIwx--rxJogVC5RayylSilSSFE1er_36PymCNWEJyC7_EIa-mgiAsja5lJQXhVkvDdq_nQtwcxpzU_lXEPn4BV-NjbZll9KPNEVtBJCA&sai=AMfl-YQ9AdcKrU4EOUojhqQaovyxCv31GfW72aumsq3v-k6LKkdZvV7-A-Z4dxXYZGEEYP14pbcNQtxIkrUOqVEmnmgRt48g_kRZAlPTTzb0Aqj3nhkuJ5Xu_dGDQbJdWnoDCPzGTH9m-sQHlbTUhqUJQdsjp3zwlxmv2UCd5p3nOTgPKoE1btM07_-wNU64kv-rTHB2j58bQw5auCqJYYbgQJprXxAPQxXEXg&sig=Cg0ArKJSzP-3HIn2mhpkEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220503.20988&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Thu, 05 May 2022 20:42:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 600E 41 KB
15 KB 25ms
24ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 00:32:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245405
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 May 2023 00:32:15 GMT

GET
H2 200 13410437746721620882
s0.2mdn.net/simgad/ Frame 600E 23 KB
24 KB 88ms
39ms Image
image/jpeg 2607:f8b0:4006:824::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/13410437746721620882

Requested by

Host: 63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com
URL: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2006 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

edad0c4aa7484411f166bda83e83fb5a6300ade6eeeee0df3a74ed4b7daff3d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Mon, 02 May 2022 23:04:37 GMT
x-content-type-options: nosniff
age: 250663
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23960
x-xss-protection: 0
last-modified: Thu, 17 Mar 2022 14:55:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 May 2023 23:04:37 GMT

GET
H2 200 13410437746721620882
s0.2mdn.net/simgad/ Frame B4B2 23 KB
23 KB 68ms
48ms Image
image/jpeg 2607:f8b0:4006:824::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/13410437746721620882

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AUyuOHZZN5wzDbywA3xXtAmrh_XFwspNE4OEEnbz56SiIICoiBKlheZhi_GtoTelo2legND_jfWkqURk08vFlmbsilcA&cry=1&dbm_d=AKAmf-Cwbpwq3xkz1MJ8dAOPMmBtG6DtCRS3W8c4mJYNefGvO3XCd4gjhaFkIHtmE2gk0eZbQGG5Vl83FwQoe7vJgLvL3JALh5O06lFjtJ7fGtNNU8VTcGsdq9mm0vQ-Ud2alPcxqgO0GtXPCtA1JiM9NGtr5iphr5ze1PbJrBv1LKMG-dz7ZXi8sQgp3BLWRQ9M43arv15VmKI8FjVqHXzc3Q321Uw2oYSKFrtZNFae_ey83ac3Yvqet4eaOBYE52_FitOCzclXKtdvK4fpkkLJeWTx29baCxOoVGYFErWXB1lzHXTTs89fzyH7S-bZHeE0HQuctznjxPVM0Ldvvg3UoR3m2FOaxcHIZh-tc0pMIseAjiPtHg7LouWz2KdOWdxlfkc6djayiSAO8x2mZIG7-a8B9TCKjPARAvmuuXY-CcbsSPuVotf1i7Jp1bzToBql2iDkxeaE12cjKufoA3_QYSoknlEXmfgiyLR_RN3STqsxUyNmLSTip-LTO3P_pOb7x1za93WG5_EDALJix8f1r6xpe-AzdNPKdAkMDitXo-lAG7strhvS204qjzz7LE5sMee8PParse_ls_qkcV5xP9rwmXKrQrzx5srEwXoNL1g5VJsm1-Mw234-wgCh_pCm6ttyRPffaLM-SCfAky6RdnddRRBKQ7fRXDy7nCWtqnl1meEeNQV8FVot0pF2IWWzVCGRR7KkDDYV4KY9hcaPvoIAvXiVT-Y-HtnhNVfdJfaxDyxECjvclb06vS5BF9jphNLPfTVxz8Z2cZpOaUts7CnA3VkgVcJHPmFmpTTHM_XZapMEjJhuVo1n9j-Uuji-LFpRfMc5FNWTGE-7nxrhiDWN5DWZ7Y00M248FMeG8pRg8z3JDP7GUlK0zbfy5Hh3sEkBdRHYl3MZXvB9CLegH6Dz2w6dYozD37GXKvtX305ffcRJzWZ6duaK5yc1GEZ7m1v0DPkOhwRxe683nLHzLom8nheUSsBqvw9-hirfkcN02NSibh7rClcD4KUc6hdQHOjMd2AEgeISo-yZTVNXFu_rJPZp2f9RDuVfR74IV2HuEJGn70PwQGgknFDK2aUwlK1ToAr7IKL3qv67x_iMZEjyLMOoJlN6tajymQHr3Tsve9WpwJIsk8lZwZrQfDUQ-0Hm83n_CXiJFSwQec0zpIaZygY0AaYyutRSDT4ouZeVExZ09cteGlbfBSKTaCg28zj7KhCJVUQZXQKj1jHGbM4sExB1c5d5f3aWbiwOl68FyEuJCwH84mZ6IYO2zf-x8sJU3MopZ7A7UHb2o-M4x_r_Mez_eNOxBWXUsXzmaMSbjeONwvV9bCGaHYm4-0JhJuB_OD0KOVFyD77ZXrsWuXsXn5nlwwvz-pr3wOK4CjH2A24iTixr3_1D1EWSr7kbSPtoiR9gPnJd0sQexnKPma6pL105vzU_uL22TJk7oY8z8Igd4BH8Mq-C3PdUeNeQmG_B2sYN2IZfqtTqq3EaZPWlVF8eBif3pTUaI6mSYcaVVyUdixT8p1kxwnrDz1ttKAccbZHSnqw5ks1h0DgfhHABGLic8dF_elIdHlnFmpDsuFTdDrEGwWlXcdFfNFUkpy4P6L4pAcM2VF4zEpNTa_xgzjszIdb_3cQMoLF3YjaSMyet2b3T_djpG1hJ2dvBxhiCXzUrSVzwFv8m-CCPW2-IkzHPrSvCmO4ugAtFjl0GIJ5knyAwjzAOFqqWUxgzouijIoTSJwDzgPvNkLFZ29_tKEu-_-3mcKdk3Q5DGrD7Or0qatrpfeP5AcrG8Aea4RFYukHF1g4Jc-D34Q6sMRomdTvdk0phGDBKGuDA0eB8IAvCOLC4FWaMy6R874g9B3mGH1xVTRHzIw_PcP5knVP-fRCsjtzAzcouW9sGl04hFolCwp5qOQWQ58Ll9YRKpzk1cEoW-kDcKTeOVkEhiScO6JM0uaCyOU2uuA04iVWqRGXlm8TDkjOh0W-U3vlQ31JG98vnBfYnqWSW7IMzCHckcPFHtIbzKB5y3f0FRpJ1XBQJIt3yM_iMHJAKt6F4Lwn_pg3l4BgyXOnXHK5jeKG9Hii93xtDUx3RiIlu2dGyPAqiw6_YpBlzJsuc5bZrHh5G501dFYBvBLJB6xwHpoVosW4AxRD_wjYGw3jQbQb_iliHIewnm3Vz_vAjj79Dnql7ivTKP4eNN5PCdnC-u20P1QEYdVjRg5_Qz0DRlfBWtJLsH2yICRh3d7jHbSv6cbhS_DTDTaXSsZ9RmdwqgRIBnThxwpnlhxNZ_d1blcHltMJFg3Fc0bSCPRbeFaQ9-TlXwt_6bFcig5W-5kfgTRaqUmfD0UcOSVp6KXfmcOuqYELqRKS5SibAPDZDvSQ_jmAkjaSyhnSu7c9NDWgN7aB_M3f8MRB4PxGzzgh7kxRjh5HJCr5jNO1M_p1LgAxh4LL2xesYw1v9VeWsY1bI5sqiugds4YKaMojpyX1dMY7EkrQMTdz8cqM7jLfSGneqp9QoZN05o_35U2AJNjLHt4v3mBrYNJYP9yLy-3hA3a4wHNuTlDh-QoEk1LeR3Kv0ILGAR8I8r6C5ETNGCvvFKBgzgSNz7K9nypXO0DsXGTpyBm3zJBBtVdiVXGeM3SouT79E0cRTu4PYKpHEUU5dnTnPDD0m7l-GuLzyjiXyFpkyywRXFTV0UqQf6JS1u8ROOmDgbHvX8s6K9MF2FELU3lLeSc5n95I-EWdycvTkzRkvbih3FZiXjia-nDfaxFkNPe53pJrnrdfg8FwvRKdycw52HwZagPC8YHE3F1OWKoNBDvFpr_5V3_ZD6gXZA7NrA3cR0AwqO519NSr5YddDsyFjxQ2FKUQYlrpl0NEjIviHWZPkxf_LaDwmk7jpIFXEAvdZoPtpoBbDKDPzqXil-7nmcFH-5IBZSpUwAWgiVomMlXTuMLqfagmN-YlPEbq-wlZI7js6h0y_MwbhhSCiW75tZHfTZKz5YoX-jBXakN1GM565C3zWcDOq_RQ4dAeaesEZuuipaXiLSYyYk7P42CH-u6c8Pj8RxS7dMjwQCRLiwmFbaHqYSN8h5c033HreLY59DBDzIFwIM0Zag3K7030U2eQ7PSQoomODlk3Ydlc9WerMDUY&cid=CAASKORoE5r8E6-aN5OTNPT3JUACMdy-nJbRvoZbndnK2BWQ3-bLCsNBuE4&rfl=1%2Chttp%253A%252F%252Fwww.mediafire.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2006 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

edad0c4aa7484411f166bda83e83fb5a6300ade6eeeee0df3a74ed4b7daff3d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Mon, 02 May 2022 23:04:37 GMT
x-content-type-options: nosniff
age: 250663
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23960
x-xss-protection: 0
last-modified: Thu, 17 Mar 2022 14:55:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 May 2023 23:04:37 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220503/r20110914/ Frame B4B2 25 KB
10 KB 21ms
19ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220503/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36998456859e35cf76812894575b0203d48ad8ac11d3165c5449d1fa73f19800

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:35:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 391
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9783
x-xss-protection: 0
server: cafe
etag: 9821519945299111448
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:35:49 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220503/r20110914/elements/html/ Frame B4B2 8 KB
3 KB 22ms
21ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220503/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 219
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:38:41 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame B4B2 0
55 B 77ms
49ms Ping
image/gif 142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsttDaX5NY6IwCynhAPDVZpauILffOwIzVu5-gRPcmet2PhUGGeNaYBxFiz6XNaZZpBfUEgVpqyiO8ouLm-vER2N96PYvHJKIxthFnGWuRhkaNhJqKiGXWRGaMlM_8zUewwo8v6BPe464AwaKMCYHctssJub-6pA16uli4_tv_EiSXevBU-ztUN3uesMMWMOrK0Udnpw7aANfyrZjAzwe9Viut9Iuk0CHlJ6Hta9flz0p9r2cz9SgsmtpnA8KllKgB-S6XYrZJcBs2VCTbz6bIHqpTD6j9P0Y5IeEgsiZZw-ak7hZQwo45g5QRc4ZWIdQeFx5diFR5NkAqJ_qoUDJvS5TNH1NRFi6rFLyClCHENj8pnjG-LDqGzXhBLKF3X5BAntgHEpL-0rdMo0_92SqKxyC_H1DUcm3qKBnB9m5FoweJUFnCOdXLYpKvtKmG-DLsBllLCaK6mJWdMN0V6tgdukPSTmL38Z5fBG1hw3U9tzW5IK_PCZncSvkzfkp6Z4PllKeAg_4LFhKVhwVRd2wAhn-RCcpa3-tHs6warOEqFOdrg30rJJ-db8QhkQuFVriC2UgIDceZlrUnVs53oBCxInlBZTt1pseOblPEyqSfIbrHuqN3Hfs_y39m5NiE93joDLxiJBaQlt2o90vvW1FQdNgVSc9fdJqu7p9Yh3_O4v6Za2-kTmNal5p4G36qi37UKw9xWyKAssldBYhJ0sKRpwdjbrOc2k6niiyDKM9vBsD-RH4QBDkFIfAXCQnQi5Gz9IN18_Qz2JgpXdKDg2Jq3EgRO8BureJ22XciDHhez9J7cKOlhiLAp3YHwVh4lx3M_CCXXXb5cip6gqBb8EYsQ3sfttdztjbW7jPxp_sbnC-fG12_-F6n1BglJGzKE2YE6HQiQopCYKuHVNsTw6Afi_1G5IKEWah-EsK-d-JGb6jv234LLanczGunonPq8XEEl0bOhLK7c7tJ_hCC6FdI6m9uGh5In__Fpmzu_we88nbe83c5wTwuKVWwE3leqz1zZBQLmuyG--keqjVJJkTDrDHnHo5vcCy9eY_9xbZ3RarLmSp2PtsSJjSedkgpZFxJorg6JPMPYcpZFXu3rwzOmlLwp8wTXptCttB7yiH7e7mvySiJwc3eTdS-9e2RjBXYQTTW6Qbum1Foqderg503wyCKvujjTHaT-gZ0H7RBUc7f9hJw&sai=AMfl-YRHlRfUrCiDxTnDxB25tgmsMBUIoUTmnkZBGuPIvQ6AnX_ZucuOnWJkM2KWg5JPaRB5wRqCBmZikjkgPOmrZlc0L80HxZWrZKhS_Ox3Rb2ogocfbN0Ar7tqOYr52o_D-NYDd3TUpNJJFIpov7pTjupHTvG9jELWFVcVO3K_ILbFc0VpNrD3rV_469_LHHufZSiGiysLikRr5j5H9LEYVNoa73doi-KO_A&sig=Cg0ArKJSzH-sh0nEMzYyEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220503.31999&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Thu, 05 May 2022 20:42:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame B4B2 41 KB
15 KB 23ms
22ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 00:32:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245405
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 May 2023 00:32:15 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 065B 0
9 B 26ms
19ms Image
text/plain 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?5gtpsQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 602C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0

43 B
892 B

32ms
30ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkY9aWAmAEwAQ&v=APEucNUjq0inVA6ylvQtEnwaIdeVVf6_svRzUQjfD2PucHkQINfue59KwKatulh9Rw_ruPCMb9ocTvsZLExSN6gIhiOiTHeZthtHchn4L3ZYXK25LThRN6I
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 05 May 2022 20:42:20 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 602C
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YnQ2rG.yLCFodLOQqdxEsgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2

43 B
892 B

29ms
29ms

Image
image/gif

23.54.68.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkY9aWAmAEwAQ&v=APEucNUjq0inVA6ylvQtEnwaIdeVVf6_svRzUQjfD2PucHkQINfue59KwKatulh9Rw_ruPCMb9ocTvsZLExSN6gIhiOiTHeZthtHchn4L3ZYXK25LThRN6I
Protocol: HTTP/1.1
Server: 23.54.68.240 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 05 May 2022 20:42:20 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELAwSBp5xrh7M3y30M6QLq0&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 602C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1

43 B
1018 B

18ms
17ms

Image
image/gif

68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkY9aWAmAEwAQ&v=APEucNUjq0inVA6ylvQtEnwaIdeVVf6_svRzUQjfD2PucHkQINfue59KwKatulh9Rw_ruPCMb9ocTvsZLExSN6gIhiOiTHeZthtHchn4L3ZYXK25LThRN6I

Protocol

HTTP/1.1

Server

68.67.160.132 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
X-Proxy-Origin: 149.56.153.188; 149.56.153.188; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: baed7842-6228-46d9-857d-89c8f6d74b50
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEPMX8vI-1o0A09QDnOb34U0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 602C
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D

170 B
188 B

35ms
35ms

Image
image/png

142.250.81.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D

Requested by

Protocol

Server

142.250.81.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:20 GMT
X-Proxy-Origin: 149.56.153.188; 149.56.153.188; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8d340cf1-b8e5-4b84-830d-33a5b035f4e6
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIzMzE5NjI3NjM5NTQxNzA1OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 AGSKWxWpKScCQZgA5ttX4uHW81u4_gr1fT8N7DBCcRTMDwqmOrx2NuQpCGqsJ6u2j6iYnWZU30jSRiXr4Vq6Pg2XINSsKMUs2XZP3UVWduFvMChHcTgKjfYmkpnagqz2tvF0-ZMqZw5xOxxh1TvG1v6yy4WV0dp0NCiASnKtDgBUYsCUpnifaGLv_WUGkKWm Show response
fundingchoicesmessages.google.com/f/ 41 KB
16 KB 67ms
66ms Script
application/javascript 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWpKScCQZgA5ttX4uHW81u4_gr1fT8N7DBCcRTMDwqmOrx2NuQpCGqsJ6u2j6iYnWZU30jSRiXr4Vq6Pg2XINSsKMUs2XZP3UVWduFvMChHcTgKjfYmkpnagqz2tvF0-ZMqZw5xOxxh1TvG1v6yy4WV0dp0NCiASnKtDgBUYsCUpnifaGLv_WUGkKWm?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjUxNzgzMzQwLDQ0OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHA6Ly93d3cubWVkaWFmaXJlLmNvbS9maWxlL2ZpajQ5YWt2dGduNnk3OC93bXBiYW5kLWRsbC02NGJpdC14NjQuemlwL2ZpbGUiLG51bGwsW11d

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorIabCcpaWebSignalJs.en_US.pYa-znObcbg.es5.O/d=1/rs=AJlcJMxB7g4qTdtj1d9EpA7zvf235NBoNQ/m=iabccpawebsignalscript

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

476ca9f4edbb9a1fa34695fe10138d31ac7a3f7c3679f8c5676f743af5bd20d5

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-9CTxBP9oZBJd611rDWyyQg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-9CTxBP9oZBJd611rDWyyQg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options: SAMEORIGIN
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
report-to: {"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-9CTxBP9oZBJd611rDWyyQg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-9CTxBP9oZBJd611rDWyyQg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 15661044598845104375
s0.2mdn.net/simgad/ Frame BFE3 25 KB
25 KB 74ms
23ms Image
image/jpeg 2607:f8b0:4006:824::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/15661044598845104375

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BBNEPeC9EXKdYbSDOVWg6FbKDcbTwTWuGSHUppzsa6FRtF1BQ8_GC6xZqRLy8wWpnnjOzDPIvONydmc2C1aj94frHVGQ&cry=1&dbm_d=AKAmf-B6-5l7OXq5cCgUIoLvEeT5YZM5-exxjOdx7rkrEpTgQqcmdmqeuNvR7brD-nRvtDJKeBnw48kX04h61tlNS9EWAa7mfMbqXSYR5DI5D0IlFW12lI-on6JmlfBvONJXiJJTMFZROVnCp5pLQKUSTvZMa3vABqB-VltmNW9rm0IQPRvnQqFAG-uPtLOyihkNpSZ_eFWwh-s6Gc23J5G4NpIEIkHOLT4D_rlLMoIcR6mH7rdEQNdkr0ZPEVrhQE-0p3koR6j5bK0e-QdnbL-Q1lR2LWiIfYhczCX2INZIZAXlz2bHmsrX_yGJ8V4SBtsoO31h-eLaFCIdotRYneUgEZGCBQOsrGGn8oslAcJn8TqMz1-F04-SKg-upMjemgmikM_DqzkZVuGzkrYJHKrqgF6G4q5c3sTz5eAODV2ec13rUnDceRjcVogeT_G38u4bSJ22Ytw1E0bxMq9_1XPwW_HkppMwfWcCai-spEM_Nn9QXknmUCFIFD4X8qvpBEmiwQ5qY29VVhC04oBpjSmKqB7ekdg8XbpRxMQkAVZuGqmoGe7y_eWBhYy03hF43ZPIvQlaoR0Wdt9fRMkP1CTkn_wIxE_zlyKgCl3zQBvqICy0AfuHgDQGfOzPhQ4KKN-9POIPUR04i_2U4F68bvWY05e6JArR6F2UbIcupOLS28pJRoNVD8obWo6EBguLtGoCvOpLjSeQLSEZfXyX7BGsIe-eL36QKDalqSGKMF8cAxHp0rsCJxNorcuK_iYxsPNlyyd_I3doFlubU1egA1mYpy4mwDC9yzGIP2Ks-pnTsz6U6bmApbdN3k75xUzXZ68tUBye9J79yAOh290ic0ulJbUiQVYwnj6o9PzXAL4kwk37fxfXEeHuEh3x62UNVw7kkDAZ9jOVJ1gOeD6wpLwGsixvCTkItlp02ZTvz806A7ouJZqY98YkfHcDwxn_ErIC3Cfko32SeDGx0cOdKRZXsR_NKSfethCTFkXTSAw55FaZ6fIPc-2fbj7t7s8qfoMgB9btk-vdXXyfkq_dKzrdZBJ3PXqjoxLWUqKWeVwiyKk3Po2sP_BELLALj9phii2fY7L3aAHbmJCDRh0C4zHbNeUdPisdd4JnRN8riVrbCWUBOyvvxFrXx_XCOWs4bf1SAHTTcHxzWYupC4g5ySdeLpQHgViRCAq5mChdREkdFVq2XOsysQ8RtEBbmJk5ZfWa9rHiCc0aqNq54qASTSGGFaLW8Xa7czjaP7R6FqVIa5_NjEGXVwsiAh-2exGixcXfEPkG_kOI6pA80rykU5qReF_Pb9Cg2KDFvBt5LGsxJDrrG4NdRMAiGciFGc1hR26vmXVE8lpH35f1f4sI3G4gQtLStHri12PpOBJtdZn9HZZkOabmhS5W-A83jF8oITN2WYq2ZhBXShp2HSv7OUtl6hEFvCgx-C7qwgiyjTXNTfbJYZ1w_r84-D4yTb_V5X6KiDrNpatolqlKejnzukUf6pudQfEWkcPYL2DMc_jhakh5lLYhTOzB9OIPHcaKJMVJr9DZZNHx6gDYT6ZM44bmCT2luTgRpJ3JYsNCsgm3Yi4MYHGGf7rT6pTLHl9V2ESZQ4J2g61nibAF5sz5CZtyiQMYPQ92HOcj9WsLOzrTEOUvETknlUlrUe4Mo4CwU4Iw7gqDNTgJQmjklLm7wy6ZLyRs6CpGuROrsyu7vFKO1uxeKEdpUI2j8TH_bXmxPgL08MxjQkODeGyKTyXZs7PpZK-Kf43S2OAgmTKO5GnaplkWrj41F3x8oU14N-RlkGxQ-leMi3hljDGRC7KStArSLXEMuk2AEdpJn5FzsPbHRSvWnFjs-ThbdcVIxHRYAufr4sRPQ3xseIPd_NhugPnVlcPRHw0GLoI_zRhKBpBjazFlhG25GH5qysZ7Ua8Tb8kP4FM-PEi2_apbiU6C7ZYovPwCVgYuPP8KvinBjbCQca2mdQZpGjMh3UcSAMFtgFm-6KM8Wqcao72QTvnT6pyq5ae8poKBdtnou5hLQAoTbUpjwfozyUKYOHgHogeZ8VAJar9njPjS0Z-N4-aX1tnmO5mcsHFCvZ9KXaQUlUv_ZMxHy5d1_svk6pl8EB8smyOVb9Yz4vy1C0L028HSbI8_5-cfDx2AeVfeg44-shjP82qmwOQepMDPpLGozmDhY3XA1sL2N6Amig0QBByoiXjKnr8psY_bwAnKNfTmQTNJ1z-TCsN6fO59DFkeE5-6TixdCMzTNpsLomJSOnDJJsWKDfSv5a5XSvaDjG1Mk4RcS_HI3h1JpBqx91ADEkScWDsoLPG90VzwoHaEMmbOFFwb8M7Vmj0Ir001gZLNzl_gbL8_HFkyh2m3CHUzkebkoOUvZopXRtQN5l_V-AAQYVP-R-I9RkNtWFfaBprC2oD2rY_cMcYlQZNL_yaoqjMUPxDrEPTUNmyi5rWaP5AWvjtqC1zUY9s5NMUXLu_-rxahtjDTuqERyyB0mRAzV93xsIPfMHSJxx_XZ12UlUANRntIue2sflKmttbVFaifaRmCqRX7ICz1h1uZ1M08F4w94Saz8ydqQ52cyMw0Ll1_kZnrjs1n33AZb5dqiBrxz8GCDAc9UUb5N1hkHdqwyD7LT_qb4x6yAcMGA689UvRAFcOrgKoCRZDqE5i6X9W03-d9jWJHNKlMA88UABA99D8FScM56Z1Q21KGYEKBM5jyHiFgb0Irv44qN0B2Nq64uFRO2oNCmHqyZLA4t2LJ8nqc2iUahs6nW-ZjzoQUakj3sQobWQPb06xga6mOa4OstwRALTd4tK1s_NCHoNTB0djlW26QBju9OCiCg-SLvGmyem9U0AGryfnLJEozRQi2lLDo6dV3PYOuVZCsQOswV1GvKolCG4vUKSllGo5V6-2dofJTJ0T9dEuXvEZ3wFfrFd56GgR3HD83g1KX5oZTyrh-vHfs9ZW1hGl9dJHw5bpQD95ZYj2Q8MxCfIn_fgAdapTjac16CLUXN6qZWa6Vl_Q1Z1P6WffQmnaKqlCLNjLuq0bPZPQufHOk4yQ996HXv81xSiTllofm_DLc8tb7axeKrAcym2hbQ9jlE827dyJZFbchJUTmonwPeQ&cid=CAASJ-Ro8jPK54S6L4z5RNevZs7droJg4I3OvZK2hmrGaXEhS7JT67dP-A&rfl=1%2Chttp%253A%252F%252Fwww.mediafire.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2006 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44170a187936c909e46990879c52f88f82a4c133c6f938243310e6549d49c193

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 12:01:11 GMT
x-content-type-options: nosniff
age: 204069
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26032
x-xss-protection: 0
last-modified: Mon, 22 Mar 2021 21:44:49 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 03 May 2023 12:01:11 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220504/r20110914/ Frame BFE3 25 KB
10 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220504/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36998456859e35cf76812894575b0203d48ad8ac11d3165c5449d1fa73f19800

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:35:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 412
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9783
x-xss-protection: 0
server: cafe
etag: 9821519945299111448
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:35:28 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220504/r20110914/elements/html/ Frame BFE3 8 KB
3 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220504/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:39:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 168
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 May 2022 20:39:32 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame BFE3 0
64 B 51ms
46ms Ping
image/gif 142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssYo_ZB3l5uKaT7yo1162pOuvlStvsnsPbRdGbojZd2zzrNLLP2Z_3K68DaX-GAY2Vvl4Z8tBu1LDvCv0xyvNOXMWrtOKHIYWsuqybX28lX8hvEbR8vvl8-3FqDYqz4JID8veW9W6u_oK5VsM3rkJbq5CmURVeanEL3d_q9bfEENgVlJfWxXwrplZUVF3NowichXJN6JeqVvNI-7v_XhtVOzTQivOOXiFPOZGdeaMKjd1Ztl9qMqYupBokrN0v6HkWZLWeZf3LVcJv32i4sqrw9rNHLKZjH-KvdTQILWfAZWLxY5XfMxTup1lKdrozNOmerdmI0x3ta57lNQEEfQOeLKh7z5FZiVyUypJ0Q8X4_vfh4wUyTA8F-By67oHnumVQgzACjnlEEdHeBXAkGM9uhMdU5ilivxCm4g3vdnXHsvlBnGY86GNjSCAP61EEA8hK1r5LhzHDWUFoCc_t0XkR0w6OG_6_9LnF9pUbY4osyM8v9IHzPDgZQqLcUsC1ppbE3TSq10XMmwoYK8kBVvQgRs44_HRZUVNaT88W3NYoVdu7RW7SZNHBBxU3-E0Bj9vR24YWgvxkDnDvow4mXeBcKwIyJKObccDDr5xmJWNKDLP2tn46l6QiUqwHesu1hVX8CThJL3Fc8claBk03mnLSr53B9xTWhJBMX97WCAl8cPx8f9JwF5YfQMQ_Q5SpwwCmx1k4sn6XslT7KSkPdKYbGTzIg2AiSaKm-VbfAhxzGnpYKJqfSqQwEqZ8dWyhd02CWqg0DNd8NncuXyz1til8wM646ZcqcAJLCXYd_dcZNIGOcVja4zuz5Ya9ANwmjflCDu1eazYefroaL04WzEnPw9MpqoB3ED4s0eJzUksUctT7pxbE3XK14WLaPsJ2xS2zmXP6xN8yxeeeAp2DH1QGN23WoM8qwmg7oUP2THNS3rDu-qYbsQGgwjVGqLDyd8jVYoy7y05TnRLwzQrtZVo-4RUbx8N829nK0TWh7WVuQBUEHOXhshvVUmpzsbeqkfGH9cZ1zQKdgMWgOgOIynqTzf9tauKgds0E8ZhzNzxHiENFzh5Hh6amdRyvCSMfS41zKRfqd_4aEU_7wxi0qtvCAqz66lVOfeRgYYmOM7yNr6IDogSN2oXYzqv4K62_5oJsDkyz6DRFmnboEZ4qFfrogeTX5JmeOgJnRBw&sai=AMfl-YTaBZgp6zxxSxJ-6RD2ce6by9AdrycyYqjoc3jWunzZB1X2Z96mKdUkgo2xrd1HASgHZtGvKOiZKlFQpDXGg9DIGxICwk5bVrNmSmBS7yjYD3FVuOxi_QXaw3lXaoLdL3FXhzftE4pKUzQYADteOdBarcefus_RaawUbs_rCkPvBjV7dGOhA4ZhKlcPGz_1lJ3dtUv-8M5cKuZW7vvpaaA2ekQaW-c&sig=Cg0ArKJSzETrJEzWIvAEEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=1&cisv=r20220504.69257&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Thu, 05 May 2022 20:42:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame BFE3 41 KB
15 KB 22ms
19ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 00:32:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245405
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 May 2023 00:32:15 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8BF5 22 KB
8 KB 19ms
19ms Document
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 245402
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 03 May 2022 00:32:18 GMT
expires: Wed, 03 May 2023 00:32:18 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 37CD 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0605a89ecbb4cc2a8a77fdaff226d2f834bb98475c9cc352eaca0b508a390a5f

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 600E 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 85a39546eb2f279ec3316f00df22e99b44eb92a9b50a4423fff33da66bc38844

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3296 22 KB
8 KB 20ms
19ms Document
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 245402
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 03 May 2022 00:32:18 GMT
expires: Wed, 03 May 2023 00:32:18 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 37CD 0
26 B 85ms
42ms Ping
image/gif 142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 05 May 2022 20:42:20 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 600E 0
26 B 70ms
42ms Ping
image/gif 142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 05 May 2022 20:42:20 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame B4B2 0
26 B 61ms
43ms Ping
image/gif 142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 05 May 2022 20:42:20 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7AB6 22 KB
8 KB 22ms
19ms Document
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 245402
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 03 May 2022 00:32:18 GMT
expires: Wed, 03 May 2023 00:32:18 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame BFE3 0
26 B 43ms
42ms Ping
image/gif 142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-200-204-24.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 05 May 2022 20:42:20 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame B4B2 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 498697f8423d15a31307e72726fe94928e6d0c60628bbd57038e1b8261d5c546

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 AGSKWxXdQLW9dZkrqAKqrmnsI1OWrHp4lezpg1KJe9jbULHj7LGHKMq8ZZNwfu7Tk8XmizAQtleiQugTuVy8KmhxX8nfODdONHpyEt6vWsz7FccJrQfkqud0AUe03NMVv36EwmnL4po236VjZvsxzLJ_WymgZ-vr73PArD-5BEr9JXH8QEOG9sDSWZraGQBJ Show response
fundingchoicesmessages.google.com/f/ 39 KB
15 KB 57ms
55ms Script
application/javascript 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXdQLW9dZkrqAKqrmnsI1OWrHp4lezpg1KJe9jbULHj7LGHKMq8ZZNwfu7Tk8XmizAQtleiQugTuVy8KmhxX8nfODdONHpyEt6vWsz7FccJrQfkqud0AUe03NMVv36EwmnL4po236VjZvsxzLJ_WymgZ-vr73PArD-5BEr9JXH8QEOG9sDSWZraGQBJ?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjUxNzgzMzQwLDY3NzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cDovL3d3dy5tZWRpYWZpcmUuY29tL2ZpbGUvZmlqNDlha3Z0Z242eTc4L3dtcGJhbmQtZGxsLTY0Yml0LXg2NC56aXAvZmlsZSIsbnVsbCxbXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorIabTcfV2SignalJs.en_US.5d3QJ5y4DBo.es5.O/d=1/rs=AJlcJMx62HlXnShrYw0UW0LBc8HSgo6BRQ/m=iabtcfv2signalscript

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fff830d2cd915d46c923b0f901ecb4a4e87e5b7b7fca3680c419ea781e4f0691

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-wlXSXUIDv4B09murUHbktw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-wlXSXUIDv4B09murUHbktw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-wlXSXUIDv4B09murUHbktw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-wlXSXUIDv4B09murUHbktw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options: SAMEORIGIN
date: Thu, 05 May 2022 20:42:20 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
report-to: {"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type: application/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame BFE3 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e42e7b7f3caf86f1c832758e1e3f025348a1ec2a2d17138caf99622ab892dc3

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 627F 22 KB
8 KB 20ms
19ms Document
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 245402
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 03 May 2022 00:32:18 GMT
expires: Wed, 03 May 2023 00:32:18 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 AGSKWxXtHMUOeZEhha0q9NziwKZvSfzi1Z59R0d8EYMzAE5jKfyRkZXWdbQFzzoNyDf5Dok_ngu7uWfGdNhFoGNDgsuGrefUfz0pIILJyKb9v0e3wgE2vL5WiSln_2-vM0VCofTiKUkEgEpNHyqQg6gu6X0gJZtuIFcoy_AU3wWhR9RegNszt4uxzjq1OZAJ Show response
fundingchoicesmessages.google.com/el/ 0
29 B 45ms
44ms XHR
text/html 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXtHMUOeZEhha0q9NziwKZvSfzi1Z59R0d8EYMzAE5jKfyRkZXWdbQFzzoNyDf5Dok_ngu7uWfGdNhFoGNDgsuGrefUfz0pIILJyKb9v0e3wgE2vL5WiSln_2-vM0VCofTiKUkEgEpNHyqQg6gu6X0gJZtuIFcoy_AU3wWhR9RegNszt4uxzjq1OZAJ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingCookieRefreshClientJs.en_US.8Z1US1_Ot1c.es5.O/d=1/rs=AJlcJMxYyOV9yYp9RDQ4o8y6PZAfBPWAuA/m=cookie_refresh

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-g3lgpl+rBSf8vo4QF+wntw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-g3lgpl+rBSf8vo4QF+wntw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
access-control-allow-origin: http://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'report-sample' 'nonce-g3lgpl+rBSf8vo4QF+wntw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-g3lgpl+rBSf8vo4QF+wntw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxXxcVRuN8XawVb51IZZpWRlLQqDtUMEESVZWdGC1u5Wi6gAJFpm6i7I9oubh2u4LYchktzq0dSp6syDm0EqL-LDlxKTzM4h67FiMwt5ps2Cr0bddi4sCYNX7vkdy8I2z0ER_IkKu2MGnUY-keqTnEKgZUN3Dwekd4LIOlHtsliM7414W7qZw-4Dc3CN Show response
fundingchoicesmessages.google.com/el/ 0
28 B 64ms
64ms XHR
text/html 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXxcVRuN8XawVb51IZZpWRlLQqDtUMEESVZWdGC1u5Wi6gAJFpm6i7I9oubh2u4LYchktzq0dSp6syDm0EqL-LDlxKTzM4h67FiMwt5ps2Cr0bddi4sCYNX7vkdy8I2z0ER_IkKu2MGnUY-keqTnEKgZUN3Dwekd4LIOlHtsliM7414W7qZw-4Dc3CN

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-8JZX7WAoW2VYOoL9IEoigg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-8JZX7WAoW2VYOoL9IEoigg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.mediafire.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
x-content-type-options: nosniff
access-control-allow-origin: http://www.mediafire.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-8JZX7WAoW2VYOoL9IEoigg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-8JZX7WAoW2VYOoL9IEoigg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 NHksFvpwOA_e7xJte31GpOZsvVxHGuXQeGuPktjycGc.js Show response
pagead2.googlesyndication.com/bg/ Frame 8BF5 35 KB
13 KB 32ms
32ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/NHksFvpwOA_e7xJte31GpOZsvVxHGuXQeGuPktjycGc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34792c16fa70380fdeef126d7b7d46a4e66cbd5c471ae5d0786b8f92d8f27067

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 19:39:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 176542
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13649
x-xss-protection: 0
last-modified: Mon, 02 May 2022 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 03 May 2023 19:39:58 GMT

GET
H3 200 NHksFvpwOA_e7xJte31GpOZsvVxHGuXQeGuPktjycGc.js Show response
pagead2.googlesyndication.com/bg/ Frame 3296 35 KB
13 KB 33ms
32ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/NHksFvpwOA_e7xJte31GpOZsvVxHGuXQeGuPktjycGc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34792c16fa70380fdeef126d7b7d46a4e66cbd5c471ae5d0786b8f92d8f27067

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 19:39:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 176542
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13649
x-xss-protection: 0
last-modified: Mon, 02 May 2022 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 03 May 2023 19:39:58 GMT

GET
H3 200 NHksFvpwOA_e7xJte31GpOZsvVxHGuXQeGuPktjycGc.js Show response
pagead2.googlesyndication.com/bg/ Frame 7AB6 35 KB
13 KB 26ms
20ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/NHksFvpwOA_e7xJte31GpOZsvVxHGuXQeGuPktjycGc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34792c16fa70380fdeef126d7b7d46a4e66cbd5c471ae5d0786b8f92d8f27067

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 19:39:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 176542
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13649
x-xss-protection: 0
last-modified: Mon, 02 May 2022 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 03 May 2023 19:39:58 GMT

GET
H3 200 NHksFvpwOA_e7xJte31GpOZsvVxHGuXQeGuPktjycGc.js Show response
pagead2.googlesyndication.com/bg/ Frame 627F 35 KB
13 KB 27ms
21ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/NHksFvpwOA_e7xJte31GpOZsvVxHGuXQeGuPktjycGc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34792c16fa70380fdeef126d7b7d46a4e66cbd5c471ae5d0786b8f92d8f27067

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 19:39:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 176542
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13649
x-xss-protection: 0
last-modified: Mon, 02 May 2022 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 03 May 2023 19:39:58 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 91ms
90ms Image
text/html 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022050301&jk=364153125558495&bg=!ISKlImbNAAZX5TVhd-U7ACkAdvg8Wv57yW57GVYM9kkvC9CcReyeAg_d5ZsRo8xbaA06mDLsQuSIuAIAAAGXUgAAAARoAQcKAPTgAg69S9U8Bj4kCJLzE888IpObyOZA87c8Zeuc5G6GGcGFkCRqkRmvrtd2Fd6RTAXBlJwDf01TlaiFx12nb52iPPWchjtZDXMI7k9moJihpbsorYmn6Kqh1LRoqjIz-OqzurAf2S_x42NJeCG95FWEwLNh_XhIeWDqpVVckP1rEh53z2VRV9pPV0MxN6sKLDTp8fg-8JkpF4a8od3lK9YhCLwH0alfGqVGUCy3StdXPzi2tsQXQ048vf6ks05po8_--VpQxYXeWU_O3Ym0a9EqUuh4XbC2Pu2m2jkNIIhGx6K66heDdG6wymvk5x2RDPFIIBYzmQKeaOVFlG_AmiWrvRMoZqIZa7K5GvKJrs_k-Ioe_qPq8XBuVaxGOZoMNBbFEL8bgUlzzN_FbUtIs0tFZGYTv-UC5ySJWbe8bdX4eFEumsimrViGy1cM8EIIFcljIO9cSpZ_fzVCOQPXxDNdJED0klmaJD6kULNf20UCzZL1hfjoQvGHsaV7lllHXGWeLc6W0MZJiNsqIVr5obQ8f0D7yYdfmx2TQrDq7xx1qLo6Ftfk30zlm-dsfgo5ZXPa-3Kn-kxbFzsFzAq3pJ3tlR-leQAlarw7qyBEU2w-t8dORSJcQB-92f5itsWAt0_ZjEpA1E6qvTIUgSyrCuES9TUJsMpIKZ-dNZIgQkwUCaX3d12fZ2nGnzUm1sg47QTDJNcODtm5Ti5yrzUmF7pumKSNNZ0cDakQ0VqhczsdMYdft13tVRM8hNfu5DBQ_fkod7xamh7jn6fEZqoswj8RvwbX2M39qs6DH7SH3ZcrKCvIioOlaficuZgXEoNIbpdyRO6JJKqjO0svnt0wW3F06eYQto1gsn8NEisH6MWrDAN9OJUX8vURAaExd4eY5fY1OjFpEQIYM7tp0i2mpH2ixobHyBFRKET60AGt9-EGbeQqLf0GowFDdZ2GwYd1XFg4F8Hofm904LpzA7-Jouss2IEBkgXUg-AKOZSAyeqPsfROWhQsW7DiHZcul-Q7AjYECynJ1_6MPQ5tB87PmgISv4pdzKSmIgKwdMzWnYpsSLFXCNLyaGa0a0irISLELXHR8A1TqNnVcUA3HOLiErqDjv2fPZlRLEgFo-ii7zIF4wb4LrkCnFYcyrhPNbYk5T46NVH4wzGe0eEh7hJu4up6F2tw9AuP7Jc_uJBc7HVFDwlKczgO71zelHs2Fz218s_abxWa8Q
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.mediafire.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3296 0
20 B 88ms
88ms Image
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BHoUKrDZ0Yr72DtOrNeqRt9gFAAAAADgB4AQC&bg=!s7ClsPTNAAZX5TVhd-U7ACkAdvg8WumG4Xw0kcZPtZWER7w2JPjo5sBhZRWMa_QSjSCSgvitKcH2LAIAAAHTUgAAAARoAQeZAvAED0or9urzZq8njyyOS7fQMOKCeAJTQ34_weabv1L7W-UH0eC2_1ZsP_15IGnEfGmNY2bZM3rT1N2rtZKdRowJHf10KuPvEclErBKsaAVGlNTPMZODlwFqnj9yN5NVjOddacLcROZq1i9i0TwZMKTZia95FM3x7GXVCCZ3hwy9tZCH95PV_vPsrTFThpCdQ-jkqak_-e-_DobADOV2Jp0rSyp2FcfS032aZlgpbPJdbvKUnTbo1sBoAxpDTLbCMtQgdZN65ms-sMSzPxq5x6TdLqR49Ot0VsbzP7S5OtO0D447r_ltLjFQf22Vr_R83okIINmbYwD8GKJLTO0bahkiWMECdBBYUiE_8BzORQK9gCEitcdHvWB1eYbUltXaFZx6UwJRIlfZa6fsRklMDQsEPIXjX_SksfGo0rFGL1eVAZSL2bOsy7_6gT5MfYhNrYBdWqhxEn4Hz_etkYe_CGwkj_EmfmkXT_Nf9J0XFd69zq-IT3exu8biZ4dRxjWT0S4BSvohQuLG499ZJUWmrs6KLFFRcMws4Y3GJxZpSdoEMVCUWoeDS9r5qFIs7ZUdauCC3iNH0_yaeIu5lTG2z539iP3-OVQq3L62D1poir9kLa_ZhN74887_FMRWSSJEhG5haWO1ncFHc9hfW1Z0lTYpSsJpczY3q2FCm-uU21r99LCY_bkvIVK7tp1NBKgUwWCpxxSp79K6cw0A4y6NFXNDDuKVx9FV25lkWPe-sCklvytxGsaGiS_p2elHFFutdP8yw8rIHiDVMG1elNmRN-h3ORbOtakkN4V2oqoFHjn4QdkoXqJN5u7XCzmX3ePnSoSUsRWeO_nj7C3lCrfJKbFhjx_-VPH7VBdm8hv97v8boF3O7QaEoHrTTJx3-Jp3KNTeVRiEatMeWzqaC9m_QO3r5XulC5HSVzppgF7MXb9CcQeLPWHcABVMTA1K5WAQzZAUYbINCztvOCWYWP-uCzqZqUwHvu0M2jr0mCYNjGZoJw

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8BF5 0
20 B 86ms
85ms Image
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BholarDZ0Yo_qDuPDzgWZtYGYBwAAAAA4AeAEAg&bg=!t7SltPDNAAZX5TVhd-U7ACkAdvg8WoCFwWfCtnGqss8Svz13mhHPSSefscLaoy5eR-8tW7-zZtNZigIAAAG5UgAAAAloAQcKAJ-wUYPGZuCDrgkPCSlBJVmy6ycNZxmhZjDp9YxFU5DZMQYKlgwrS-R9EjrkaiCsNv1vqHlfRCfCvMoS38UnjRtQ63IiWNzFuinbKPatCe5YV-HEh_nx7_i1HR9ClyvoJGoAcbZRcziUhGFAW5EoDVEYezd5jl4Smomypl3WLK0nFrHKDliH6xI8d8W2UJF3SpAizfhsFtfVBn6ik9CtO5WZAuxQThNKCSpzdQWJbwIFkhmHTjsMR_o-_RWmiODBAmBnvMMFObA-JOVd0Tb9QJxuIPmiWV_4DolqLKgcP15L0R6tn_zsjZrWc9nb8UgRawC2NU9G5nEozINMGQkbfyHxBLL6NXdSdsOyNvK8ZxI03R9b2452YOKYUHsAk2WCfFl0EqLl1Lo_XF9p0b9qHGqzTA3BXxi2nLh7BlvcECk_b5pSRWgDJJIVxA5RZIdUjUXcP1sDD0kuGsESpGqzYkzj6-8H_mcQHGL9eVCysjJfw24cyQ9HQhStX0Yfl8siP98nllodpuFXVlcoB1idxpm-HfvHK7FSMk4QsCPjI8gdVb3yjJc1tTbRKFKyIApp9ryzJw_4XNphfIiDmGi7kk-Cwbn3MEY-NOGzHHRwWJjKAVf2S0F1dQlD3Sm1d9aGFRMeu82A3tIGm1LWWVG4KJG3p_9u0uXehY_Ue8uLLv-UaNlwz7BdRScWPBl2zwsSdZkgtPnN4jh3MmAwCN_j9dqrKkx_BS1YB5tAyRDKuuJMJHJFKCIP1yX7N7j2Xf5ZYeIusCP6hqwCB9HXY3ph7LHdXs_l8GrR6EilUMrR9JQ0nqScATpWMD47XBCeVgDnfiuzjOlI7MLogUxugAnNj_UPvuoGCY5UAHNBbCYZhOmBBELSwfZKEgz1nvqTh4zcxkzQUKq8zPHyYLgZOOyd187j5OdQ6cKMx-7UJFKPGXCS5SQ_dg0PZ6zHYQ-nNGBmxac-XQRtVc1hnaQn8RRQAn5RuWJLexvXszLgktwD02b0SRUNogQeclirFbOeYchfq_10_dNXjzJ45kByhNng1fENlUQmTVxqpDRG1agkTkD-2LRz6rEc8AV65sKRWetgBP2xXGHrR41qgGLwqcLs6y-wvGdeXi6NrjXa2LNUIkOlX2reXkEgFK3S9mC6nw8VpD6tRCN-zULOlzQkhjVeZnlez9pO-6JTcQMAWek_RnSDKvjzWIVOZ98sMq2BD862

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7AB6 0
20 B 84ms
84ms Image
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B2lBErDZ0YpjiD4jlzgW9iaz4BwAAAAA4AeAEAg&bg=!l5SllNDNAAZX5TVhd-U7ACkAdvg8Wl6TDei92iahHiAPaFckefdVqTprIhDltzPkCEC9afU8VA5eTwIAAAGuUgAAABpoAQeZAwCYw1NXNfyd7Ls5-hUD9irJYep9XcDVwCIkYVpxsMPrKDmM16fEGBA9mTqILx1K0bQbsbgWOj9NGoi4jeAEKcWaBUN3i3_ZTOa4MdpnUmGYPyUpgw9iZJquVgPs2vX7WK9ITfosHRPRMiFxFjs19HQ1EHPCk0lXEzqKxWYPxqKbH3JuJiQFj8YVLfN-hUEaP5GxaLZ4xfOcivAUjKauO7J5WijNakx9CWrqU_vFWoqM6XlyQKFDx4C1YcwvzsaBOB149AwwdmbS_PN0i3TkdO6fhmDr5pHD0RZrDQ-uHXUR9ez18WvfQavaREmwVRh0okMC_Fd18e4Hwjct77Ambu8BGMjGRPWDRFGwRiMjjW95EFqK_3cZaSQV6DNXTUA_Iy2OdBDZzMYDiHzzlwyDZAWMSV0ydZRJ7-mSPIJW0PYPl8ewIgO2n45D2pay_FO3ltPo0CDHqAiqbgOqWZyE5omPpOxwFDNyStscj9AS7GGoENAMCPBNc86n7DjyorMn8caQnNwMK_Z9obdiGKljahnligIc8dhozj30M6wc1k-nLuH1Zd1DLf1EX4jCsrcKJk-bT9jFCB_luHBPd7c8gIJTxhlFpfwscGBkaoFUcHWtkkzU_yrug8Rx-JfkVIpmNGjMX8nPItzGp4luQpj6jY2LCKB4aF8AV1XkQpWSmBpJmP43h_6nWZ6zcZYgOmK-sQF33_XirxM2q6w9qGGJ5nBiPJ1YsRzOdHIAMAtMNlYISS89oGMRtOFekFcPfYo8k19ZTeE4yQKlJk-GXqyUNTFo98emmtlP5ZHY8RwFxfGkIhR3W4TeOJoKFH-MSGUURo9mpJahEP-apun9suSA4GTCupVarbtt20USy4q-O13vKHYYGXDigvW9RT31BQtivTnr_4RNLQn2JHSP4YvU2nJ1lP-24jLdXc9XrnkeT0MuX07amS5En-4KjWgW3sp0GLWR5EwQcSjrKczJKyorOgCrYTE9b3xM5wYM34qcOWWATzgd4ekVcB5YEMvtxa0omDE

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 627F 0
20 B 82ms
82ms Image
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BUnEYrDZ0YufbFcKN_gTqzpHQDAAAAAA4AeAEAg&bg=!zs2lzYnNAAZX5TVhd-U7ACkAdvg8WvzkxwIZ6Bc1vp_D_xNlpcp65BPSSBeePUnC9zK-pxQwRk1KbgIAAAHBUgAAABVoAQcKAASJIBjOmQLpZ_qLPyTQWzpch6iDegFUKV0lMNUZ21Wf6ZttrJ9wQ7P4KIkRRa8dAWO2TIxAUiAJNK6lDB4Sy1tk9uMpgSHVtQpTnuBitxrJEGjcv5WO8l4pNQ-vzSTgASJmBdcovC4VcYdJ-uhIQMc9tGPoFEJOXzQ8ofG586L19dxG7higduVWxsN69nLiw0yo9DuUf4eLplIOzj_24uZHUzNbP5ClPUsOnjbk1Snda-7xnxaeYf6Qfq1T0l6Oqi5N1tU7A8_RQbd8WKf2Gh9Y-OzpLpHZOOCOe60kaw1Qg7w-L9QCbJ0a-ZlNxUVIJxkFZefl5RpeFjKaQcOvIAUyiW0htn0mhvHD1pUWZCchUenCWH3qZXZm2yOQ8QL5SkHwE-3DG44tsBRUvPbQG-YVoOpR4c1d3cGKixQOfz7Qx8gJNskwmet8PufiW76YGZwHpTtVCuVSxqvJgLyrMsYcHq8cThhu3WKbqmjEnoCQ3tqUjjsmvNUxv4N4JzX048vL0LdvbuDP6wpZqd3bCz9bhNqiHgsFVYOpA6D-bi7JDnmMqjw9PnRCCrD9zyvLsOtEgGq_UMYDcsTti2YD2XzWrRlJ0iI4W8xEsNF3lmpeVvZPCy0svmyKjeAY-HLpUxAAfBeBmobp7L5AQCrIxmyzqSqz8LANSeeF4aihBLkLXT6T8wMuYXhm0U8i4s9I0IMpoHwtU4rl6zSOiqsoSIautx2irYA8TMqs88xCvNpbFdtExIpQrMk-9oheuIfFJgF3DHZ9sA24K5aFhfop4sp8MONjt4QcFG24MviAPhzvymoRZ3ZEkbZRcSthLPINydCsmdBGPPVXAPxVdc39iUk4JH7Dp8EoNDRhzTvTXOadA7DJhn9-Ylbb-D76saTyE1L9i30lGZIgLBixmcgjRQUO6em_HKJZhB66aJtKsOB7-GtgBH0CsEYUsgDZpwzd3d2N8KAuEXRLldCh0J_hCheM06RnX8pZUvSXIt357u4H3g

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 37CD 42 B
64 B 78ms
36ms Fetch
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstJLj9KO28KixOzBXYZ2mE-KFrcjpksR6tjowu36ERbiaUVPX7XJSs-PBbWQHYy0yBv1hrP6ABk5-xh_4dtW9znu8oYeameVxChhfwXXXFtyTSTTDVIqHlsuA&sai=AMfl-YRqRUYGigaYe-8LUgUOeWDyI2hY1RU7dPybiUKk71G8GgY6N-T7EbOYkfIsIK3YWofdHPhq8EBRL32FW3G2cosCFj_fp-8VftWHhN-quwRIyAW9i-BDOqPHRK25-Tg5&sig=Cg0ArKJSzAnhQf4eycU0EAE&cid=CAASKORoWXaTkCNC4Wix9uxXPhu2m9CV5sKhDRXm88CoF5r8oMH8FSkw__4&id=lidar2&mcvt=1003&p=10,552,100,1280&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20220504&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=630197753&rs=4&la=0&cr=0&vs=4&r=v&rst=1651783340051&rpt=473&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 600E 42 B
64 B 36ms
36ms Fetch
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsswn_4LJxKOf2SeNJI9kb9Lf8-SfRazYh__ghuuySFwmAbpOY_1nCqX0gybuUym00pVLAPGR9toxRH-lpoJRl8E21aUGzShW17QcWZaLuD2XL20BxRbs8mung&sai=AMfl-YQ7ddm6S64BkUXAS_2XpsFsCkyUcF1QKssZREH_D7pQXaV4_XQvFRyRDodoHTtUVC8Fj3HcFX4GzcZ1vErkq3yMEY07PBS3XqGX9118rPmK37bV6IhAmRXJXFH6Zj38&sig=Cg0ArKJSzLwA5jGqWRFcEAE&cid=CAASKORoUJ1nd77SMv-7s51GRYBvAW6DvK6i2cQcWMvXHPW7Mwa37K3zVlA&id=lidar2&mcvt=1005&p=420,320,700,656&mtos=1005,1005,1005,1005,1005&tos=1005,0,0,0,0&v=20220504&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1870779098&rs=4&la=0&cr=0&vs=4&r=v&rst=1651783340063&rpt=538&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B4B2 42 B
64 B 38ms
38ms Fetch
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst4NPzWtHVJbZWqdFvM-gkQogTgpEEx1YyF5-I3g25uLwRuULyn3SLL0VSY-_IvvyFQTh2rJKcJSdd6Gh_EYSCqteFPJdD3PC7QRU021WYCvIQl8q28uQoTpw&sai=AMfl-YTYrK09UoLAor4PLcLX2AGxQdYVpVJkZ_p1Ec4a-naYorVI2m6hcJf6YWbp8g_uOiJQqnIg3xsPwG6F3Mst-BNDvUebes9UlqfS6D9jbmbaLf2JJjRiQ80NFJODgpWm&sig=Cg0ArKJSzLs8JGG-PG4dEAE&cid=CAASKORoE5r8E6-aN5OTNPT3JUACMdy-nJbRvoZbndnK2BWQ3-bLCsNBuE4&id=lidar2&mcvt=1000&p=120,320,400,656&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220504&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3841872593&rs=4&la=0&cr=0&vs=4&r=v&rst=1651783340086&rpt=540&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame BFE3 42 B
64 B 44ms
43ms Fetch
image/gif 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuOWxTbnuv0XYO0MtTNci48WDMHT9VxosQVMFo-bFaKZDt9Kh3UR2a4912-f6dcyweKieQPFA2iJHwPpFH_QAGjNYQsgqvcXXBCzzsZWewMiU892WlEctTJXQ&sai=AMfl-YSmEqJC0kl4-6hnKwa77gqoyDxG2wtUXvF0Eo2zyZBFN5tA7zyDwkh38MdHOQvxb2OGN1PajSOytP88rXq0s5kWOFa-W3KoE-cnWh4TK0hZx6At7H-ouxMSxLIHAnA&sig=Cg0ArKJSzLTneCna7ZncEAE&cid=CAASJ-Ro8jPK54S6L4z5RNevZs7droJg4I3OvZK2hmrGaXEhS7JT67dP-A&id=lidar2&mcvt=1001&p=1095,430,1185,1158&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20220504&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=215913335&rs=4&la=0&cr=0&vs=4&r=v&rst=1651783340233&rpt=426&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://63759bd3769810476ecf37265cfea72e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 5706 15 KB
6 KB 84ms
20ms Document
text/html 23.54.68.197
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158936
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/js/prebid5.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-197.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=39203
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Thu, 05 May 2022 20:42:22 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 06 May 2022 07:35:45 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2 200 pd Show response
us-u.openx.net/w/1.0/ Frame B98F 1 KB
988 B 49ms
43ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=74c7d33a-f978-474b-98bd-3e72347fbee9&gdpr=0
Requested by: Host: www.mediafire.com
URL: http://www.mediafire.com/js/prebid5.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/18.1.0 /
Resource Hash: c0726bb67d57ca99b4d347835fa99bfcc7eee2874873cab7a046911c978f2414

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 670
content-type: text/html
date: Thu, 05 May 2022 20:42:22 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/18.1.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 6A62 2 KB
814 B 11ms
10ms Document
text/html 51.222.39.186
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1651783339060

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/js/prebid5.17.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.186 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip186.ip-51-222-39.net

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 492E 33 KB
11 KB 118ms
36ms Document
text/html 23.200.204.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUO2689O&prvid=2034%2C2033%2C2030%2C273%2C2028%2C2027%2C2025%2C237%2C117%2C97%2C99%2C3012%2C3011%2C3010%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C3014%2C337%2C338%2C77%2C38%2C182%2C261%2C141%2C262%2C222%2C301%2C225%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: www.mediafire.com
URL: http://www.mediafire.com/js/prebid5.17.0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.204.24 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ecc58460e3c0a420e364eb58fe1e12d2c418a6978fea3328835896a58ab4ea38

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://www.mediafire.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11284
content-type: text/html; charset=UTF-8
date: Thu, 05 May 2022 20:42:22 GMT
expires: Sat, 07 May 2022 20:42:22 GMT
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
server: Apache
strict-transport-security: max-age=604800
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2

204

sync
ups.analytics.yahoo.com/ups/58294/ Frame B98F
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID}
https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=cddefabb-d046-0d5e-003b-d744138776dc
https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=cddefabb-d046-0d5e-003b-d744138776dc&verify=true
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=cddefabb-d046-0d5e-003b-d744138776dc&apid=UPdd72e7ca-ccb3-11ec-ad6d-0e6bcaaa15b3

0
121 B

73ms
28ms

Image
text/plain

3.218.90.66
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=cddefabb-d046-0d5e-003b-d744138776dc&apid=UPdd72e7ca-ccb3-11ec-ad6d-0e6bcaaa15b3

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=74c7d33a-f978-474b-98bd-3e72347fbee9&gdpr=0

Protocol

Server

3.218.90.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-218-90-66.compute-1.amazonaws.com

Software

ATS/9.1.0.46 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:22 GMT
server: ATS/9.1.0.46
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=cddefabb-d046-0d5e-003b-d744138776dc&apid=UPdd72e7ca-ccb3-11ec-ad6d-0e6bcaaa15b3
date: Thu, 05 May 2022 20:42:22 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

458249.gif
idsync.rlcdn.com/ Frame B98F
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D
https://id.rlcdn.com/464246.gif?partner_uid=b6dc0654-c56b-0177-0c65-96bdbdbfe36d
https://id.rlcdn.com/1000.gif?memo=CPaqHBIvCisIARCUaxokYjZkYzA2NTQtYzU2Yi0wMTc3LTBjNjUtOTZiZGJkYmZlMzZkEAAaDQiu7dCTBhIFCOgHEABCAEoA
https://pippio.com/api/sync?pid=5324&it=1&iv=464d7d30b6518efbba3143bcd2c49557d6f5c4609d8e1f94b6dbe62028b49cb9791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA0NjRkN2QzMGI2NTE4ZWZiYmEzMTQzYmNkMmM0OTU1N2Q2ZjVjNDYwOWQ4ZTFmOTRiNmRiZTYyMDI4YjQ5Y2I5NzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA0NjRkN2QzMGI2NTE4ZWZiYmEzMTQzYmNkMmM0OTU1N2Q2ZjVjNDYwOWQ4ZTFmOTRiNmRiZTYyMDI4YjQ5Y2I5NzkxNDI2YjU0MTdkY2UyMRAAGgwIru3QkwYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=f0f237e7-d951-4c14-a077-f67d2fa22453

42 B
60 B

45ms
45ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=f0f237e7-d951-4c14-a077-f67d2fa22453
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=74c7d33a-f978-474b-98bd-3e72347fbee9&gdpr=0
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 05 May 2022 20:42:23 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/458249.gif?partner_uid=f0f237e7-d951-4c14-a077-f67d2fa22453
date: Thu, 05 May 2022 20:42:23 GMT
via: 1.1 google
x-samesite: secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111
content-type: text/html; charset=utf-8

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame B98F
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=7233196276395417059

43 B
61 B

39ms
39ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=7233196276395417059
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=74c7d33a-f978-474b-98bd-3e72347fbee9&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/18.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:22 GMT
via: 1.1 google
server: OXGW/18.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:22 GMT
X-Proxy-Origin: 149.56.153.188; 149.56.153.188; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1dd2fa00-9010-41dd-b256-1ab17c2a54d4
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=7233196276395417059
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame B98F
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=bbcc054f-1486-8ced-9312-94d9ec174955
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=bbcc054f-1486-8ced-9312-94d9ec174955&dcc=t

43 B
932 B

44ms
44ms

Image
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=bbcc054f-1486-8ced-9312-94d9ec174955&dcc=t

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=74c7d33a-f978-474b-98bd-3e72347fbee9&gdpr=0

Protocol

HTTP/1.1

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:22 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: KHB0N2N3ZK18FEWJG2XH
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 05 May 2022 20:42:22 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 183GJ6TTTF0K9N588W6V
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=bbcc054f-1486-8ced-9312-94d9ec174955&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame B98F
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=4340293576127443608&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

39ms
38ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4340293576127443608&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=74c7d33a-f978-474b-98bd-3e72347fbee9&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/18.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:22 GMT
via: 1.1 google
server: OXGW/18.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4340293576127443608&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Thu, 05 May 2022 20:42:22 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET ny75r2x0
sync-tm.everesttech.net/upi/pid/ Frame B98F 0
0

GET
H2 200 77dd1f76-9880-a55e-62cb-00bb7b734ffc
pr-bh.ybp.yahoo.com/sync/openx/ Frame B98F 43 B
987 B 100ms
29ms Image
image/gif 2600:1f18:4e9:5a01:b316:89b6:b042:cc75
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/77dd1f76-9880-a55e-62cb-00bb7b734ffc?gdpr=0

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=74c7d33a-f978-474b-98bd-3e72347fbee9&gdpr=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:b316:89b6:b042:cc75 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:22 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame B98F
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=e31a7932-082c-3717-531c-164e842482b5&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=e31a7932-082c-3717-531c-164e842482b5&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=d4396f28-50d4-4d4e-a51a-cb83679a13f4&ttd_puid=e31a7932-082c-3717-531c-164e842482b5&gdpr=0&gdpr_consent=

43 B
62 B

42ms
39ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=d4396f28-50d4-4d4e-a51a-cb83679a13f4&ttd_puid=e31a7932-082c-3717-531c-164e842482b5&gdpr=0&gdpr_consent=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=74c7d33a-f978-474b-98bd-3e72347fbee9&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/18.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:22 GMT
via: 1.1 google
server: OXGW/18.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 20:42:22 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=d4396f28-50d4-4d4e-a51a-cb83679a13f4&ttd_puid=e31a7932-082c-3717-531c-164e842482b5&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 335

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame B98F 170 B
188 B 40ms
36ms Image
image/png 142.250.81.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Y2Y3NWFhZjgtYzE1Yi02OWIzLTQ2ZmMtNGNmNzRlYzY0Y2Q1

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=74c7d33a-f978-474b-98bd-3e72347fbee9&gdpr=0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS