tinyurl.com Open in urlscan Pro
2606:4700:10::6814:8b41 Public Scan

Software

sffe /

Resource Hash

5b9b6cd02b6f5355729b475326e038d4a16cc824b12562fa8d3f234b6f3aec2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "944 / 118 of 1000 / last-modified: 1627596591"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24700
x-xss-protection: 0
expires: Fri, 30 Jul 2021 01:34:03 GMT

GET
H2 200 sync Show response
c.deployads.com/ 369 B
557 B 128ms
43ms XHR
application/json 52.51.116.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.deployads.com/sync?u=https%3A%2F%2Ftinyurl.com%2Fyd9ojkxx&s=tinyurl.com&g=0&cc=0&cs=&client_build=2852
Requested by: Host: tags-cdn.deployads.com
URL: https://tags-cdn.deployads.com/a/tinyurl.com.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.116.157 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-116-157.eu-west-1.compute.amazonaws.com
Software: SortableCactus/1.0 /
Resource Hash: 64b363de17e67fcd6438ecf4ade0c440ee163be45dba4712d15208cdce01cf6d

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:03 GMT
server: SortableCactus/1.0
content-type: application/json
access-control-allow-origin: https://tinyurl.com
cache-control: no-cache
access-control-allow-credentials: true
content-length: 369

GET
H3-29 200 pubads_impl_2021072701.js Show response
securepubads.g.doubleclick.net/gpt/ 318 KB
111 KB 52ms
26ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efd6c3fe040e0780295b2bb958b6cb638b10d68ea13bb0a5d3a4da7efce788a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 27 Jul 2021 08:37:43 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113834
x-xss-protection: 0
expires: Fri, 30 Jul 2021 01:34:03 GMT

GET
H3-29 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 539 B
227 B 55ms
29ms XHR
application/json 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=tinyurl.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b87e9a11d9cbf38748c319752759e71aa4403286c8048b88bc54b13b65f51f0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Jul 2021 01:34:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 202
x-xss-protection: 0
expires: Fri, 30 Jul 2021 01:34:03 GMT

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame CEE5 2 KB
823 B 72ms
22ms Document
text/html 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=65e2f0d9f4ee117

Requested by

Host: tags-cdn.deployads.com
URL: https://tags-cdn.deployads.com/a/tinyurl.com.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: onetag-sys.com
:scheme: https
:path: /usync/?pubId=65e2f0d9f4ee117
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H2

200

XNDR
c.deployads.com/cs/
Redirect Chain

https://secure.adnxs.com/getuid?https://c.deployads.com/cs/XNDR?b=$UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.deployads.com%2Fcs%2FXNDR%3Fb%3D%24UID
https://c.deployads.com/cs/XNDR?b=2252650731092212138

43 B
326 B

44ms
44ms

Image
image/gif

52.51.116.157
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.deployads.com/cs/XNDR?b=2252650731092212138
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.116.157 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-116-157.eu-west-1.compute.amazonaws.com
Software: SortableCactus/1.0 /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:03 GMT
cache-control: no-cache
server: SortableCactus/1.0
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:03 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f274aa63-c9a7-4e94-a92b-5381347213c9
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://c.deployads.com/cs/XNDR?b=2252650731092212138
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

QANT
c.deployads.com/cs/
Redirect Chain

https://pixel.quantserve.com/pixel/p-N04C2m09Yy8f8.gif?idmatch=0
https://c.deployads.com/cs/QANT?gdpr=1&b=99Mw2PTVMIns2zTSoNAtiqDQNI7shDKKoNYIPHXB

43 B
307 B

42ms
41ms

Image
image/gif

52.51.116.157
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.deployads.com/cs/QANT?gdpr=1&b=99Mw2PTVMIns2zTSoNAtiqDQNI7shDKKoNYIPHXB
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.116.157 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-116-157.eu-west-1.compute.amazonaws.com
Software: SortableCactus/1.0 /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:03 GMT
cache-control: no-cache
server: SortableCactus/1.0
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:03 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://c.deployads.com/cs/QANT?gdpr=1&b=99Mw2PTVMIns2zTSoNAtiqDQNI7shDKKoNYIPHXB
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

bswt
c.deployads.com/cs/
Redirect Chain

https://x.bidswitch.net/sync?ssp=sortable
https://x.bidswitch.net/ul_cb/sync?ssp=sortable
https://sync.srv.stackadapt.com/sync?nid=50&gdpr=&gdpr_consent=&gdpr_pd=&ssp=sortable
https://x.bidswitch.net/sync?dsp_id=188&user_id=VVGkbAqITChvGyeKwD586rmcr2s&user_group=1&ssp=sortable
https://c.deployads.com/cs/bswt?b=e2c2249b-c717-4902-94f1-27b93401e4a7&i=

43 B
339 B

42ms
41ms

Image
image/gif

52.51.116.157
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.deployads.com/cs/bswt?b=e2c2249b-c717-4902-94f1-27b93401e4a7&i=
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.116.157 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-116-157.eu-west-1.compute.amazonaws.com
Software: SortableCactus/1.0 /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
cache-control: no-cache
server: SortableCactus/1.0
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: //c.deployads.com/cs/bswt?b=e2c2249b-c717-4902-94f1-27b93401e4a7&i=
date: Fri, 30 Jul 2021 01:34:04 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

VZNM
c.deployads.com/cs/
Redirect Chain

https://pixel.advertising.com/ups/58282/sync?&gdpr=&gdpr_consent=&redir=true
https://pixel.advertising.com/ups/58282/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
https://ups.analytics.yahoo.com/ups/58282/sync?&gdpr=&gdpr_consent=&redir=true&apid=UP391c5e33-f0d6-11eb-9bd3-024aa993177c
https://ups.analytics.yahoo.com/ups/58282/sync?&gdpr=&gdpr_consent=&redir=true&apid=UP391c5e33-f0d6-11eb-9bd3-024aa993177c&verify=true
https://c.deployads.com/cs/VZNM?b=y-BlSudptE2uHpsBrY9e5P23Om3YUHYs3s~A~UP391c5e33-f0d6-11eb-9bd3-024aa993177c

43 B
393 B

41ms
41ms

Image
image/gif

52.51.116.157
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.deployads.com/cs/VZNM?b=y-BlSudptE2uHpsBrY9e5P23Om3YUHYs3s~A~UP391c5e33-f0d6-11eb-9bd3-024aa993177c
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.116.157 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-116-157.eu-west-1.compute.amazonaws.com
Software: SortableCactus/1.0 /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:03 GMT
cache-control: no-cache
server: SortableCactus/1.0
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Fri, 30 Jul 2021 01:34:03 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://c.deployads.com/cs/VZNM?b=y-BlSudptE2uHpsBrY9e5P23Om3YUHYs3s~A~UP391c5e33-f0d6-11eb-9bd3-024aa993177c
Connection: keep-alive
Content-Length: 0

GET
H2 204 prebid Show response
ads.yieldmo.com/exchange/ 0
352 B 128ms
46ms XHR
text/plain 54.194.126.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebid?pbav=4.23.0_custom&p=%5B%7B%22placement_id%22%3A%22krpoa55lsklyff%22%2C%22callback_id%22%3A%2221c83824f61a86%22%2C%22sizes%22%3A%5B%5B160%2C600%5D%5D%2C%22ym_placement_id%22%3A%222352983247081644305%22%7D%5D&page_url=https%3A%2F%2Ftinyurl.com%2Fyd9ojkxx&bust=1627608843705&pr=https%3A%2F%2Ftinyurl.com%2Fyd9ojkxx&scrd=1&dnt=false&description=TinyURL.com%20is%20the%20original%20URL%20shortener%20that%20shortens%20your%20unwieldly%20links%20into%20more%20manageable%20and%20useable%20URLs.&title=TinyURL.com%20-%20shorten%20that%20long%20URL%20into%20a%20tiny%20URL&w=1600&h=1200&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%7D&us_privacy=&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22sortable.com%22%2C%22sid%22%3A%22795%22%2C%22hp%22%3A1%7D%5D%7D
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.126.20 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-126-20.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://tinyurl.com
pragma: no-cache
date: Fri, 30 Jul 2021 01:34:03 GMT
access-control-allow-credentials: true
x-robots-tag: none,NOINDEX,NOFOLLOW
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
852 B 92ms
33ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:03 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 3d4bd97d-a85d-4535-b1d3-5265c8da4d59
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://tinyurl.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
281 B 62ms
21ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 30 Jul 2021 01:34:03 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://tinyurl.com
access-control-allow-credentials: true
cf-ray: 676ad7a97d380204-ZRH
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
743 B 136ms
95ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9698ef0175754ff4a155ad8bf9005a&pos=8a969d5d017575e55082e72295140073&cmd=bid&secure=1
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/7.1.2.128 /
Resource Hash: b7607009370671a797a55ff40c53dedf139c8faabb68d0fbda2f09345b8034ea

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 30 Jul 2021 01:34:03 GMT
Server: ATS/7.1.2.128
Age: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST,GET,HEAD,OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://tinyurl.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 62

GET
H/1.1 200
OK bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
743 B 157ms
109ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9698ef0175754ff4a155ad8bf9005a&pos=8a969d5d017575e55082e72637ca0076&cmd=bid&secure=1
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/7.1.2.128 /
Resource Hash: 44dff0af7653229048dabfa65f13143ae0d2102e8d1165baebdad6646d7b9dfc

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 30 Jul 2021 01:34:03 GMT
Server: ATS/7.1.2.128
Age: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST,GET,HEAD,OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://tinyurl.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 62

GET
H/1.1 200
OK bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
743 B 189ms
124ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9698ef0175754ff4a155ad8bf9005a&pos=8a969105017575db4f32e72422f001ee&cmd=bid&secure=1
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/7.1.2.128 /
Resource Hash: 9114662bd4fffd97cab23ebe6a7a38b7a650c9152d3b5a4f2bd65297bb674f75

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 30 Jul 2021 01:34:03 GMT
Server: ATS/7.1.2.128
Age: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST,GET,HEAD,OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://tinyurl.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 62

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 735 B
2 KB 196ms
86ms XHR
application/json 178.162.133.150
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2212c14f3bfe3c5a9%22%3A%226998b185322cd01e15a7%7C160x600%22%2C%22139c027f7803c7b%22%3A%226998b185322cd01e15a7%7C728x90%22%2C%221410846a9b92013%22%3A%226998b185322cd01e15a7%7C300x250%22%7D&ref=https%3A%2F%2Ftinyurl.com%2Fyd9ojkxx&s=55f74759-a60e-4853-ac82-0df1aefef099&pv=f84b023c-77fe-4ea5-bac2-885ea02b809d&vp=desktop&lib_name=prebid&lib_v=4.23.0_custom&us=5&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22sortable.com%22%2C%22sid%22%3A%22795%22%2C%22hp%22%3A1%7D%5D%7D

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.150 Madrid, Spain, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-apex.go.sonobi.com

Software

sonobi-go /

Resource Hash

42ff8e1d421fa9d2f57d75d4ad1f754c7baaa7a72e3ac3b601647e851a2f2263

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:03 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: apex-ams-1-6-8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://tinyurl.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Type: application/json
Content-Length: 435
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
852 B 97ms
39ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-3-123-149-62.eu-central-1.compute.amazonaws.com

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:03 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 5941f533-de0f-4576-8b8c-f0bc20165660
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://tinyurl.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 auction Show response
c.deployads.com/openrtb2/ 586 B
919 B 170ms
170ms XHR
application/json 52.51.116.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.deployads.com/openrtb2/auction?src=prebid_prebid_4.23.0_custom&host=tinyurl.com
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.116.157 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-116-157.eu-west-1.compute.amazonaws.com
Software: SortableCactus/1.0 /
Resource Hash: 9f5200f668c830093256be006cb90839416f557b71a6fa298c5fbe4b95f326ff

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:03 GMT
server: SortableCactus/1.0
content-type: application/json
access-control-allow-origin: https://tinyurl.com
cache-control: no-cache
access-control-allow-credentials: true
content-length: 586
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
507 B 61ms
21ms XHR
application/json 3.123.149.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=4.23.0_custom&referrer=https%3A%2F%2Ftinyurl.com%2Fyd9ojkxx&tmax=2000

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.123.149.62 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:03 GMT
x-auction-status: 12, 12
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://tinyurl.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
350 B 361ms
119ms XHR
application/json 67.202.110.21
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=d9HhYeaj8r6QaoaKkGJozW
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.21 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip21.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: 20ab5d05e9b30d6f0d731849a608010d51536a690cae299c2e5407acc116e3e1

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://tinyurl.com
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
341 B 363ms
121ms XHR
application/json 67.202.110.21
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bggfyaakar6PmwaKlId8sQ
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.21 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip21.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: bcaaca84aba820b6a65fc59bca166f3c556d24b22e13a219794a6bc8bf56543f

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://tinyurl.com
access-control-allow-credentials: true

GET
H2 200 integrator.js Show response
adservice.google.ch/adsid/ 107 B
853 B 48ms
16ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=tinyurl.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 36ms
16ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=tinyurl.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 41 KB
16 KB 249ms
249ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4472886863985705&correlator=3343017254222222&output=ldjh&impl=fifs&eid=31061161%2C31062031%2C31061200%2C31061963%2C20211866&vrg=2021072701&ptt=17&sc=1&sfv=1-0-38&ecs=20210730&iu_parts=1966186%3A34718310%2CPub_tinyurl.com_160x600_2%2CPub_tinyurl.com_728x90_2%2CPub_tinyurl.com_300x250&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=160x600%2C728x90%2C300x250&prev_scp=s%3D0%26v%3D1%26u%3D2h7%26sdbg%3D1%26st%3D3%2C8%7Cs%3D0%26v%3D1%2C4%26u%3D8f6%26sdbg%3D1%26st%3D3%2C8%7Cs%3D0%26v%3D1%2C4%26u%3D73t%26sdbg%3D1%26st%3D3%2C8&cust_params=pt%3Dyd9ojkxx%26ab%3DD%26pm%3D1&cookie_enabled=1&bc=31&abxe=1&lmt=1627608844&dt=1627608844114&dlt=1627608842903&idt=704&frm=20&biw=1600&bih=1200&oid=3&adxs=3%2C170%2C1280&adys=357%2C123%2C243&adks=1379951554%2C3534186949%2C392238017&ucis=1%7C2%7C3&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftinyurl.com%2Fyd9ojkxx&vis=1&dmc=8&scr_x=0&scr_y=0&psz=170x839%7C1430x96%7C325x639&msz=170x600%7C1430x90%7C300x250&ga_vid=1144776219.1627608843&ga_sid=1627608843&ga_hid=1039931547&ga_fc=true&fws=0%2C0%2C0&ohw=0%2C0%2C0&btvi=0%7C0%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2726a6e5957cd91d4d166720e19e854344f1f147c9b0c757aa6e0b167b86ae65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15852
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://tinyurl.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C1B0 6 KB
3 KB 47ms
13ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Fri, 30 Jul 2021 01:34:04 GMT
expires: Sat, 30 Jul 2022 01:34:04 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 tinyurl.com Show response
e.deployads.com/e/ 2 B
127 B 167ms
54ms XHR
text/plain 18.202.37.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://e.deployads.com/e/tinyurl.com
Requested by: Host: tags-cdn.deployads.com
URL: https://tags-cdn.deployads.com/a/tinyurl.com.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.37.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-37-41.eu-west-1.compute.amazonaws.com
Software: Jetty(7.6.12.v20130726) /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Fri, 30 Jul 2021 01:34:04 GMT
server: Jetty(7.6.12.v20130726)
content-length: 2
content-type: text/plain;charset=UTF-8

GET
H2 204 prebid Show response
ads.yieldmo.com/exchange/ 0
351 B 47ms
47ms XHR
text/plain 54.194.126.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebid?pbav=4.23.0_custom&p=%5B%7B%22placement_id%22%3A%22ad-krpoa5tys03e8n%22%2C%22callback_id%22%3A%2231f76b41607b044%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%5D%2C%22ym_placement_id%22%3A%222352983247081644305%22%7D%5D&page_url=https%3A%2F%2Ftinyurl.com%2Fyd9ojkxx&bust=1627608844353&pr=https%3A%2F%2Ftinyurl.com%2Fyd9ojkxx&scrd=1&dnt=false&description=TinyURL.com%20is%20the%20original%20URL%20shortener%20that%20shortens%20your%20unwieldly%20links%20into%20more%20manageable%20and%20useable%20URLs.&title=TinyURL.com%20-%20shorten%20that%20long%20URL%20into%20a%20tiny%20URL&w=1600&h=1200&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%7D&us_privacy=&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22sortable.com%22%2C%22sid%22%3A%22795%22%2C%22hp%22%3A1%7D%5D%7D
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.126.20 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-126-20.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://tinyurl.com
pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
access-control-allow-credentials: true
x-robots-tag: none,NOINDEX,NOFOLLOW
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
852 B 32ms
32ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-3-123-149-62.eu-central-1.compute.amazonaws.com

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:04 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 81c9b827-0e4b-4805-b1dc-964b42459679
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://tinyurl.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
59 B 17ms
17ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://tinyurl.com
access-control-allow-credentials: true
cf-ray: 676ad7ad4e8e0204-ZRH
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
743 B 100ms
100ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9698ef0175754ff4a155ad8bf9005a&pos=8a969d5d017575e55082e72637ca0076&cmd=bid&secure=1
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/7.1.2.128 /
Resource Hash: cea826765f0b32015cb0f665f9138573302616733cfdb9a7f68eba9beeb6f085

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 30 Jul 2021 01:34:04 GMT
Server: ATS/7.1.2.128
Age: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST,GET,HEAD,OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://tinyurl.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 62

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 693 B
2 KB 40ms
39ms XHR
application/json 178.162.133.150
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%223772372f1c174b8%22%3A%22ad559ed82e9f14739f52%7C728x90%22%7D&ref=https%3A%2F%2Ftinyurl.com%2Fyd9ojkxx&s=a55f4e20-7a70-4807-846f-117ff33a36e7&pv=f84b023c-77fe-4ea5-bac2-885ea02b809d&vp=desktop&lib_name=prebid&lib_v=4.23.0_custom&us=5&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22sortable.com%22%2C%22sid%22%3A%22795%22%2C%22hp%22%3A1%7D%5D%7D

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.150 Madrid, Spain, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-apex.go.sonobi.com

Software

sonobi-go /

Resource Hash

07989ca26a32efe9db5d651fdef1c49660186f81d47173613ad136329e2084d3

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:04 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: apex-ams-1-6-8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://tinyurl.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Type: application/json
Content-Length: 407
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
490 B 20ms
20ms XHR
application/json 3.123.149.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=4.23.0_custom&referrer=https%3A%2F%2Ftinyurl.com%2Fyd9ojkxx&tmax=2000

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.123.149.62 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
x-auction-status: 12
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://tinyurl.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
852 B 39ms
39ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:04 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: a80dceaf-098e-4dd9-92e6-d6fa7381bb14
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://tinyurl.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 auction Show response
c.deployads.com/openrtb2/ 549 B
914 B 156ms
156ms XHR
application/json 52.51.116.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.deployads.com/openrtb2/auction?src=prebid_prebid_4.23.0_custom&host=tinyurl.com
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.116.157 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-116-157.eu-west-1.compute.amazonaws.com
Software: SortableCactus/1.0 /
Resource Hash: c4838e5763464c498c15166dc8257a81f6942518f366403ea3bebbd259715460

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
server: SortableCactus/1.0
content-type: application/json
access-control-allow-origin: https://tinyurl.com
cache-control: no-cache
access-control-allow-credentials: true
content-length: 549
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29 200 container.html Show response
95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4A12 6 KB
3 KB 22ms
8ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Fri, 30 Jul 2021 01:34:04 GMT
expires: Sat, 30 Jul 2022 01:34:04 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4368 6 KB
3 KB 18ms
7ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Fri, 30 Jul 2021 01:34:04 GMT
expires: Sat, 30 Jul 2022 01:34:04 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A7EC 6 KB
3 KB 16ms
8ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Fri, 30 Jul 2021 01:34:04 GMT
expires: Sat, 30 Jul 2022 01:34:04 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 28ms
27ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eca48824a13b12bd6503bda806b0a66f2b0810fdc90796c0e763c3f934cee5a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627472111755377"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27995
x-xss-protection: 0
expires: Fri, 30 Jul 2021 01:34:04 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 44ms
20ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021072701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

77dcad63d2dbe869938586ae423646f9ceeeb363341c9754eea8d2ed31eb2bf2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8472
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1469 478 B
565 B 19ms
16ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYjP_gOjAB&v=APEucNWc24jmzUPnRKOT7obkr3mk6p4GxqyhW1FdgtivEvOJ5viFkb0BYQ6JqfK1adrhjMUILq3FxGcxOqGq-CYodWBQriinyA

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0414d0221112224b4c926de91a6e316f9d9aba685aa8b05fd0654848d8fcdf55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYjP_gOjAB&v=APEucNWc24jmzUPnRKOT7obkr3mk6p4GxqyhW1FdgtivEvOJ5viFkb0BYQ6JqfK1adrhjMUILq3FxGcxOqGq-CYodWBQriinyA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 30 Jul 2021 01:34:04 GMT
server: cafe
cache-control: private
content-length: 230
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUkNxOTec-G25-zV9dwQOGPaWHFSVZr7KDUFWKv5Wy-MOrOtdserq-3RPoXF; expires=Wed, 24-Aug-2022 01:34:04 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 30 Jul 2021 01:34:04 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4368 24 KB
13 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AiHx3cC5ltrDEOFeBTBanaDWnbukc15Ip3DEIhzfT8F8KyWgvDs7Y209zxpq3JPwggXTwm6JlVRkXO0n7Rmjexvfxv0A2I1782VLnw3yxnaIu0W-A-F6Iyk37p6P-kMcK9cDnYOTtdLpDHNDBwtjqyJeLm-w&cry=1&dbm_d=AKAmf-CdCz6QTmRscn6BKkgO1w0pQt5Emqlaa9L8NTpmNEIoqGUVxvHR9z1DJXktQP7hZ-UrI_gdSyfL2SEwqCRFjaQHzZ3dfH6dTdtNAAUCgHHUJVMMaq7BQ8jIBz5w2SkArm2IB4WZ9B2JGgxmaYNKn9Id1L0aEkZOV30oEe47NK60-HQtUTZzlu5Gtno82eW69wX42hC8D_RHlgBv0f1X8dgm_OHbbm1xgL78qLu8GrVhRpuBVeXKiKbR-hR0RLyimFtLXlBVVwwd3xUhvpH1mY-IMydRAUA38NqOpwfIbyzArym9zuylBB1Dv5R2cyPIXhzkZRxsSvdofLUNpSgjBzZnHgD8Law7VJkMRCzF_cQaq753h6cW2H_fFkPVFG6-uifmKkVHSI8lAnFxFNZYbax54LQ0pCrQQwGIbeWPWCdlU44VmsB8Mb3hLSunDMqyNCGcpeHRUgY53Oi7YP13Gl3ERoORtI56nNlNKtLGb2qW3b-LbAKAJjCmeZdVo1eZ_pwgMK5aUZulufBnmHaGeIucbFE1O94dsiGHK1zSPizR5sKSFyhd8NQZa2zuA7Gjqo0uNOOtNWA-3lOoxeVrw6CJ_ZzasdfuKwyXRxYAR8Gc7j9esASQ3UebXZjL2XQW9engq7VX4Sa0rVSRkTAjQ9nnlv8AlTjo1hm9vsGgLvEpNBIOSpEfKWA40IYT3_ME_0tMZkCXr4e875bLn6fRjO-QHVUVTOmzeUNKG409rDfDqTGQZ0CAhVr3m9GeRWzIq7n7eu32Wydpe3-HPk8_TZLcfbZfjYwEFWp-rJZq3Mc3rz6doGSXeqjOPemg-iDxbjhq011QZwMXc52VNlTC9jpuV7AJz30zBzEE4ZABLHmj1Y-x4yDU9mbciVx3DsjuY95dyJOC22uGXXE1SdaoOHfrHClgH8yD8khkjtD7c7AmUFCuSeoaklBDa-k7BtIVj0w82dNur14GOFMsVDgdiaeMV1Z2_Znzh32WGNgu26Krz4guh1bnVMDV_9MEXZf2u8jHMYxZmd_FMmOQsboyMGtoAj4D6Sd1TLzsKKyypCU7jy1-A8T1JLsOlo0SyhOTqTJ4rqyOfAcqVuZpdvbqfuq_Bsho9XP4jdOgsOXH4rGtEatz5iZVqNVtc31o4sPO8Zs1DmSYoDpdYOtv044qDf9ajD5D0Zp0er1LJhVpMRVO97NcfcqSff7HR16jjpfe3g7GKVDAHOR6gAuAayHpmBEqiS7cylNkKeIW9RXBD5pm-fxY61WmctfQK50kwoJBoTM7Vk1g8ekcRQGNtVnb6NwbnJJKEwvCsfzKXUGd-TAF4NwJzISPGGApmwio4wrrzcEcOLXjAmeTCTADUqhyA17OtPour-uu5f6DuxrUtKAmEjvEbeWFgD3Nzyr0DZlY29ZS0SVxOlaN1JNqO3wsro-ngKDiYXA8UIpKLQy21cFqS4zH1lM1upa2KlFlWhBhsc610URLy7kevlr8EA3VoOczVqxCGGp1oZp3UeiHXHzdBKq4gywfNzXUCobebReNRtQc6zVc2sGdepio1xFZsf9SqdgkdDymR3VJUfoR8tOsgy9jqedvLgd_B9qPRBLGoq4_JrfMvOaC0-usFIwr4u5QLyupCB81vrPqaqlcmW82K0YqKWep-ruh0fmsKbXnwpB_DW5nuOHotfc5GD0MGS1-vtBBMbe1YBratqymsCJZToY1FylJUlyh5Tv21rrzcJy4OXeC74D6rKn6oYb0syHdQuskvaaKPCBSCYZLt1VDrmBV15OXxwPXT-shI1QiiA6r5UNUCb8QoVkKN1Z37OHuvp4jIO17D4EvaTHpztKU5fsTtlh8UnzYBob8_D97fUnGmOgm0DYDewopbJ9ZY6jYnv3USQwplVMdp8YstjeKZw8L4H2HlQRGkom-EjAKt38s9i5qSTKvwIpGcVAuh_4c0MrQS69FCd_0cISqH9NHObrxuOI5vq_Kngf_djMcSLnzFUSESlBO1oU_iLdz4U2cGK3hyfo34Zjgo662okQ0hRziueW5gmb0WtMM8RIMtSWdFZ3fCbbsmdYbqZM3SXVqByBdusS-KdS3HaszfsGQxNuK_Acga7V44hu4sEoFrXg0kajTGUOrEWIDDdcHKDXpaVwC060jdBfKC0WHcdqa3SOkP2P9pFynwwWTOiRYmYHsdTjoOtaqA2GP8PFdBCzxcC01Mcb0348wlZKGVH-16JrmudtmfZ4SXnFK32YowW_mGnAoU_4Egz94MPVIoPAc6x-uO6_yvKVtoDaKT_rEt4D37Bylnd7zcFtic5nSA05Ub8VzRH_4vXzGMq6ip-p9k3UOj70940JIWVLmKFleBaPJAQdyHwciDicBShb35AxMLHUFHnflNaYz9j2uJHzkbNCRrwUUo_vcgIYZP7PrBPpeIUEdsd5JsjndybAQci7Yawps2aOAAarrP46oClOT_EynIHAVcjBY_E6uNeK-6PjA4HlFFZ9LWvHVASOxiItDoiu32wlewDRixCm0XwTuvfkLVE1ahbU-nMw5g9eqEv-Q_NjKIDBJUsxfB1FtVeWPhmwW7LZmEVGOZD0tq6UbPIQFJZfJ5_LBr8nPbV0TCcGLGFujewOC9u0UIos2tP6aihOoGiLS2DOmBrLi-Own6vYJzTgxrkoLhsqstA6j0dEzP9TqelIjCKUqPY77Q1qgr1zt4VkL_IVwt1_abI1--uh7CxDekVm_w_P3OiHBtmdir9CxGzSrcgY5II0zR8uE7M_A_tgwVY5IoufOjdwa2SJOrDmY27891gEHkWDCbMU6QMJrJ7gnzdv9stffA5XgH-NaGw1sA2wyC01UsxY6Dm7IJ-1caYSF3m9zZX3cY5laE1QZ4z2-qK2gG8xlUfQtO3Q2dApSfNq89JIHUpGIfji7B_4wxpKC-04hTpZJQKVolhmsCDdQpkbIdUsbZ0Y4o6OW_xSIE89pK7x1m5171Aj-lVzkwzjI9FBFKOvvK4roLzHveO544_ZL1tYVmOvRCGPKE82oE-k7lkY-RgvyrrQQ9GiVZkjG4JVFYw0lMxvy-8rvT-3JUGI13Ptqpsiysu4BzI-689oj_2vGCISL-h-sjjJLelbz8f7Fo08k7IcJSWUaqVGV0V8gPX0mg9040dJSg8DGjqJjabSEfShp8F2eCQ&cid=CAASFeRo3G7JFp2q0_IOU-eIQ1qqgsT4oA&rfl=1%2Chttps%253A%252F%252Ftinyurl.com%252F%240

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04eb1e0757fc635f0bf8cb2c2df4f5d2b3172e87942d0ddc620eeaa6b6042358

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12951
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4368 42 B
515 B 60ms
39ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AKKTu6GfKd6BV5iLOXLYnfW1g5CZH9AFf-niHCADdYX9_timNXPupFOmeX9DfAA_YEiwMwI1cf3r2k4sRDKzboDawXvsjON83YB_TTsrzH2_7pzhM

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/ Frame 4368 2 KB
1 KB 38ms
7ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/window_focus_fy2019.js

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:27:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 385
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Aug 2021 01:27:39 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4368 124 KB
37 KB 30ms
29ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0964703aceadd0f8a443019b3d10e976a88d91cb124b39c0a9518b844e94ba8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627472092244076"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38161
x-xss-protection: 0
expires: Fri, 30 Jul 2021 01:34:04 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/ Frame 4368 14 KB
7 KB 36ms
5ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d8a9aaecb7cd39329dcfad9a882ce0d174802ded027e150440484e097c73cb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:29:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 258
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 18081889583213459188
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Aug 2021 01:29:46 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 29ms
13ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Fri, 30 Jul 2021 01:34:04 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C88F 611 B
316 B 16ms
16ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY_e2XVzAB&v=APEucNURz60uNQj3nL5bxck_ggueKwL0_3A1QjbE4jHbWD59LQdWzQEa5KTqDuAtHgkVISs_C6vBElSYyB5vXM6CeLvllkdEdg

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55b198b5ed1bd02e77f84c6971a69d5c2160c0c32fd770ce33405e194750f5fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsY_e2XVzAB&v=APEucNURz60uNQj3nL5bxck_ggueKwL0_3A1QjbE4jHbWD59LQdWzQEa5KTqDuAtHgkVISs_C6vBElSYyB5vXM6CeLvllkdEdg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkNxOTec-G25-zV9dwQOGPaWHFSVZr7KDUFWKv5Wy-MOrOtdserq-3RPoXF
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 30 Jul 2021 01:34:04 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4A12 24 KB
13 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D8jcWiEmJ2mmfqbxr-RUYZIUS7O1-1Sj5R9xZlDleHh6jE-re8jfjO-hJGH-h2m7YOAPxozsOeFbH-RKsW7L4agZ4jZzTz-W_TarqlHYdXkhVii-9LIcQnCrxuZ1nLWPJtclFXyF37zO6CL8QBaGCOK6RCFA&cry=1&dbm_d=AKAmf-AjqIeIFm4ULi1tSwg9Ydeb6CX3MTGlqp97pGBPdYMOe7K_BeIK1ZwGfJlAmweOq45Z6D_paEK8Fw8XMfNT_nYMRHx2Euau_XBDmPKwm-kVjvnDoWn167Um_GksVKBo2D-PkU9kwaEmetEoAUH4zw-v4APZs3dGqfxjmn5H3TinAoQnRHdvCo7GEXvpbPt6GHJtSmZORaRV0Zs_8WOxK33Evo4-vbokMLOh5kSNC4OQC2xHhTNF9dHtZ6gOY3xYpLA9RPep4dzpUL8RePKeitZTPAdeRDXGQo-TmswH5uK8BfJCIzxUdsLUn9EuHk4u3bZ2AnQjKc2IFcZQF5HUeahFvMCf5PtjvrhQ4wp_NcDAjoS2k2JMCcZuwY0SJRn2IuJdrTkddcx0BlvCYQUNYGXz8bUJ8n7eFbuVSA4i2_NYVM1c3pZiM-ZShonmE5ad53hDvwZD27PWoXl2FoiTuwQd0xO2pPjYzU1FtyAvB95UDmG9UbDhLp5wdSsauYTwTJ2LvmnrOUAF545allcFzrqGsfHAVypLD-0aS3zy2iLsF3aqCgk8_bh-74NxvlLfeSGmCnWfAOIMC_6B7oYZ66cWKDUpCq5ySGKIwuQs7KKWwfl04E0aNCFyFEBShRP-xxa801xOTLTQkWdXrxhaQXow0-CPDhQdskewKUL-1xh9vOpL9cT3jy0eMXueOx_GLBhZAyzwb2SgzidjND8AiBpaGaO6dNubiCek95YrvSPfk7oDV0qKuLQ2qlSnt_5Gzner8CFwbDSgMqAW24FCRyVRdlHzviryZGPcmfz2JlkgHtIJLHyr2YbLeC7ume6Y-gxEQ1aVxmEINt9B-oLwyIAp0qSlThuJtQdcKCuRoCjl75szxo7MlXsTXsD6pfPFBqI4bJ0KcJhyNtNYz6zpicZqs6qezqrNBtGqOJIDGUfhNjv_mAgH5Nu8wPvUH2IrHBggHtBHPwDadpXVPwCQCwicrqAKdcPGxiV68ZofHL3o8wlHOdanrsjPkWZkWqlx1OwE_Q17C5KOOcCp6AChVOfSEkK4ecCOLOWk0KT7pjJ3m__TNdkzOcvgC6ss52wBpND2oNb0pBx6UDFLp93ZzVrWHiq_jp0RlfxhCkTCGkT6PtES6POePHjtp_5leeQ-_1At-dGalVUz3q6CKH63RBfdL48IORDPWZc9fTOZO5YFK1FBxXQ8rc2QgIAYicj_W3adbRieBvLGxz88H6q-8TB7Itogtt1d1abfvAqqZRYHKf-HADnqFI8oVw_0C5fiQldrbPoxuevx_U6Y26dfUW9Yp7EKPD-P21OYcwaiCA5OyyEb7EgVlhCPcwIzYlMRCOn3TJ_qHi9N8wYLsSBHL7HSUXlQ13ua5eSe66eUTvWxk7vULnvb-O-WjzTDFxD_vuTSzjsDcEnaFF3LSezRYj7U8tibB2Ut2sp6e5UxUw7oZrVQqUERVQbFk8X8zJ6vdYnXD1Yqd6icW58sRMbQJ0PKpviFzTdFlDfdze9YY8hOx5_4aMgeOpIaibc0posFucv4TN8Zz-30N-2OCX2a-gzBcirgmVsT1LQKf9PQGDeMqfTsaY3Zc_HUPx_rkhspnpN1fYUkBzmfTyO0N1IHu4czli9BukBxfHJchSMeF_T-UxGi8L7hpQr4CEiC9PKaI3tMIKbTQAXDuYo0Du1OnDo2l9Y1EmLM6PfED4Bf8z0InjwGokwKEjV_voudpxhTV7PS5DDXBPOtu2VC2OqSqFm2Ju3QwVEictK7X726hLadnYy1bxG8uRuHMfmARBL42f7gKNARHUWlJkOD2oZZ324o9hXDtZa-DIT5nTq7bAwzMeuA1XOCdxKsdMGf9wMhBu5AWTwOSCeOIukh7k8HO2rN_0Lzw-HSCQlMY7Bp-61rCFYW14zMdkC9nYdsGXZUTNH7PktZemPsJ4ilLdRyycfkuGmhliJxM-ZnttTBfqWJgNi-GcQcNParQej1PSwACRCrFboQZj9WMaPXPTwCkdEgPNpL8PegsM6OpCgNgLm_LvXf_9epr-mrkUJxmJk5M8Od888gWm6-QeifTq4kh_PYeVx44-9uoTp6RpReonYRq4pTeZTWf6naDgX-3bXG5UkD7qu_Ifo_6YgU6lhf7akI565NkVDheNxvPlV_ije9sXurTc8jPjMHi4SUmZgmbg_OyjTELvludbuUOHUBo_6-uliRC_ICC9go1ymad3hPpzPQ40x0BlpAfqX_xcJtpHuEkK1elc5Qe0vtKrTam8PQ4uljOkQon15Y9_I0Yn2MXVYYvhgu301_WohYCmttL4uh--FqvelWILZd5yU9n6fzZZBQW3WVDURoJwHXyfASDHY34BJT2oXUgrQKPGChxKLNY6p_vGDUotRZTtvEo6v7rH-L-PBG-8UkfYt3CsxuJIIjUYl80NRcahl6jFjw-zUJEWN_FspnTlm7xl9F_WZJCjl9c-nEhvyhIcp2lZhZmv5v84qvXtYYMC4thcx8L1E8V77eQXFkNJWwcvFY89d-EtcWlqOc5YEewsNdLB15m7yueuQAs8khFneSbxJQ1lQCWYXb9GBUwFRizeWRND3DuFq2M7rV94NJWsmV-GLZb_HbuQmYKJXWjBU8mnOEErjomPDz85NCBsrYrvHniDM7jVN21Nky26wee9KxmTndEMCL0kJQP1ip4rRpTilpya6w0wVmWx4QfDOM8q4GqQI6wq1_z-jYjoQCUxB1s3D8y8EiVO_Zg6jzybDG9jI20ozgqqeOiQNMzcvLpypYK1VC6lhGwpwWkB3Xekifzpbi2BK0zPzCVgAP-Hcm5jUWchurEUhNy43vOI3VHygrXUtz9NZLfVh3xa2ghEmw2ONDqovJeejAC7VUGXsNJDtV4HWkUnDTZAHVsnVHTGqIMN-Pr4nOxy5tqvb7LJa0wvnARmAoTjVel9IgaYMNzatjJ54TScAUpYQI0Xb889Ndvvd3_ZBUwGEPtadvWiKyprQOQ-9tXWgSkv84BkV_CRcZP3qFumHd6dg0E0yZQ-zDD79KMo-mANOUqQqsOWofDPwRoSvX00H2ME-0lD7ombhxKwHpHEJlnExw9uYQLOgDoTtjDXM2-gS5j3rWK7DKVxwUBQMGjwRFzps23zdCRD42SH0ueGkh6_H9GgGWRYyfvbavPEHy0g&cid=CAASFeRoJx0Xiybp-F0OgLxGLPWwfIpBpw&rfl=1%2Chttps%253A%252F%252Ftinyurl.com%252F%240

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36d4873b20b62bfa33862a55c9a9b01fab4bd9fbe8c664b5492948833d304fd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12847
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4A12 42 B
63 B 56ms
39ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BGJ0Xw49HOI4KPPbgR1a_Kbjo1xYUXkaM46w4gP9j4isuq3wv2GfWP_Dq5PmWm39gTxXKhtffniEFSpa00xYYbJVjMZTRhmImFRIMWVl9OzbRVqb4

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/ Frame 4A12 2 KB
1 KB 16ms
6ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/window_focus_fy2019.js

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:27:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 385
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Aug 2021 01:27:39 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4A12 124 KB
37 KB 29ms
24ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0964703aceadd0f8a443019b3d10e976a88d91cb124b39c0a9518b844e94ba8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627472092244076"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38161
x-xss-protection: 0
expires: Fri, 30 Jul 2021 01:34:04 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/ Frame 4A12 14 KB
6 KB 15ms
6ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d8a9aaecb7cd39329dcfad9a882ce0d174802ded027e150440484e097c73cb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:29:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 258
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 18081889583213459188
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Aug 2021 01:29:46 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 4A12 0
0 23ms
14ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRyCWeQWZYEARHzUVv0FxXgkT67FqdgUatrI5NE71i209LWIgbXKpzK0k-lGeHnttpUcU8dDiwru59BycmNlCHG0bIzgg
Requested by: Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3DC9 441 B
248 B 20ms
16ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfWWBDBzOgCGNLesJ8BMAE&v=APEucNX7wb_FiciLYW2q3azFjYgrNUewI_E3eyCamBcfkQgwtIJlewc9Muf0qVkAxfO9NvV7HObylujm4l5rSKEnQQIlEO60cg

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf051f3ee7aa85b70fbdb5a9c4dbe61dc57372814f700b1b23ecb4f7dfb9ce63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CLfWWBDBzOgCGNLesJ8BMAE&v=APEucNX7wb_FiciLYW2q3azFjYgrNUewI_E3eyCamBcfkQgwtIJlewc9Muf0qVkAxfO9NvV7HObylujm4l5rSKEnQQIlEO60cg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkNxOTec-G25-zV9dwQOGPaWHFSVZr7KDUFWKv5Wy-MOrOtdserq-3RPoXF
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 30 Jul 2021 01:34:04 GMT
server: cafe
cache-control: private
content-length: 227
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A7EC 63 KB
25 KB 77ms
70ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CVcF4UxkvY8C2EPmk6dqNZS4wGVmK8C8wki_-Pubba6ZJ3YvH5dpYzrakautMboqyckIuOx39U0z1ZeTvq_oYb5xOy8qOns3i5APK-85e8v7BheI0zqM4H7cHDtVLW3d_2fDR6ApLBCFufc85rcg1pIUJvGQ&dbm_d=AKAmf-AVpixqFxkeyJ2j3Nggmcje80p9fFMLAQG8uLME6fkYq8HlX2DTYyrKhJ_0SYjqYYBCpTrQj6fMpo6t6byk5wasWiVV2hqEiedT1u-vvBmBTEvQnsgeds3HGp5QbqOKg10W5uMtUQI3kSFXuARr7Nx_OXng9-oXe7YJrZ_t8kFEu7tICEd4RdDFReEzbC-1hCXqPYrWObkBpwmobS2XwiYJMM88i7nUEjNHzVYBPRyMuIeLacnkgxdLkodkmGhOTgMhLo-EHMR6MZN3Kue5MjWMh6gt0GYeVkNkXvENk6RMr0-OIhdaUZLfN2RxnhFMW7f1f0ShW-kK5xFdNBX51-N_Di3A9y862fiPQK5tjY4Qhmjdg4t7_NnPnNxLswDFsYM4eZIl25RIw8aWBen1_jrvOu71CNk73kIn22cYCDwBwiZVRjqD1mJfi0R43DAp0THlLjQ9Ks0iiCGaWHTfHDqcuZX10Wl2dvwvEBzwcAEvAot8vQ-ez8E1VD4yChg0CfWHnufCUYXM41Zihocvc5zRqVWUz9LCOcv0BQJpvFOoKWDDmzjncF34SvJkujUwQgV9Jsy9ieErADIB_AL2Np10GZJTl54BMCxAnVSKNpJgQono9C7poeKY9PQ0S6J-LX2EaYxhqpbFswRUHJ4G6WN6OFDoaYR0Stw9WOek14AK8niTTO0W03rs_9f-8w2K_6tnghRoDJW93ZK50fvyevanqLdHcn2wvmeAe-dtvz82x753xEag1AICcln4dH2FhHFWEI83xQBFzoduqxia_2IE6WymWX6dqrBhi7d8Q0psb6VZR72fxgfVULWKjP56xOZ-FnyyQHAkC9BWGliRITnRCrBb4iruq7vxMzzMrJuNy6vncdmMejZe8DQONcj5RHKDDAIZrU-jT-2iuy-Ux8R03ww-jGRfzO0xBBGygPGOgWgSlkIMIqhdN1tyX4izuaAxWUYtuW9USlMkNjvENQY4Lj2coqlENAP_djUOaUQTb3YnBskwFE7MdRgYWDJDc56boowmrdE7OazVE2T4uiaHAekAChtJ3E_hVsJ9ArfxrKjqUcY-d7nlmV3mwTgn-GdPzhx3vuap9x_kF22EHl6SpGmZavYIdWZrRyia0XY2OppZYFtrGKvRxhkK6VwikHM-vSctZHMp5oyCcZDTLkupwg8HGeZ2-bDbARlpvLI0DnlqZhzngiZgRbP3K0oUWZ-iS8h4-c7hKZXpmHrmRDNN002AdyQOtVFzmvL7I1kzfpOtwts2UIA5rqEgwurLlgGiWmX7NbQs8iSgVgPA5GprEUwjvp-S0o5GGVHU0goJlPe_eBE18wVBtFHvZ-NZO2XtWr7c6EExulPH1KzwPalISkrk-YYG34RVswEVbS9APes8y-I6aqU7PfGgH5o1Ububyt2ip6I0hHt7SJp7nmBI5SKX9kgPjVN62gpEZtFQ-UWtkicZ7s2kEiIn6yrvHra7GO01A7E1NDM1PNi7IsFez8EpAoBbmjJQGJJ3TgMBvK5JuM4LzB0lIq5gNWEIB4ewFFQxJJDxgUwVfqqECbiwy5vr9zRuPNrX5G6rUqpa_9S5HdYzIg7tnfFCsgLkisk0VEWGgOyvNQDVNUzZd1iJLIUQJBcrL6xGmG6yrx80pQ2k5u0kM8ofIjchZ3_dtuolWs-7ffqWHIE64QIpuE1cqAsMNo_qkWlx6CbzsunlzbZ0K1RSHURilf0IANGzT9KZsHCsauZKe_HSNSxGB4TRg-XjYLb6rd3juyAgTV1BSRwN05bOTX7qPOxVqMiVeoSaYR79wEQY5mJRcdGbPKWVDxDedA1mcLmN3ogPLzuSZj6UmZMsuYz8l-ANSHoRRZwatL7h_dEJ40UCtP2-VtoH5y1L80izv_AjQsm1IoWy9CwvzBkITC0XbAeKTKPCnGONzE9ZNO9lpJFklFrT3BbLOPPfGJ0PyTO2ahaR31FHxT9TkanaFbASsYzxOt4NdTJMXeGasZuKlMVcHWPGVuah_ZNVywPrjXTIntBy_VE2TS0r5mCkSykHlvKuwlDdMTv4kdQ4h-Y_85PrKldttv39h1SZs36fryIbBiTNGWDQj9fSvBqdev3LZHzFwnSjoF8hXsRjSl6tSDt-VjPcanAvumuTqcSOAf-RACW_jp_WXQ4qopLGXPaJDWQWZcY7v0Qw2ZPmk5-1YTLjm3_RbCtDSORfjWQYunVhjg-f-R8lnkAYJkEV-uLr2RagTBR-WN40xI7lNELYt-b8dKpvPKwBn-X9Zsg38UefQYRVlpbJv7fIKdJbupfiZIjLMQt5yFHsnv2hqCROPHl42frvkPHJsW883YvjgRgesPDPMEoLF2GE6KK-Ratp-wBaqYjSd2uFFs2yLNlkQ7bh3flphWzo5h9cB3JWoMIT1_KDRt0vw0ibNtPKI6RM1Pm-AMANtr3IFwHkK2INQDk6fh3S-63XWkNZDiM87a6Dey3zdnpy1_oDPlHJNxgIAGYUHUClr0oiHUmmUZmu2eDlk5wNBKID31jlvjU8pmVQB3iPRcjZB3J7Db5d7a6YgmZTJolRPX95Az0MxOBcWIDnYyFxDpqI-C0LzVFCXHTNdgCZ3lRVvn5c6WMjE37qol9Btm_6jDIpyDkieO076LbQxJIzlrOlR_91I84v4RLcqtH-E2c3lyLMecqlFB80OXiglrpMM9mI7aG165frOqw5THZUcpN48ODizEh47FVcNN9C0QsZnVRrigpq2jO1quuRhn0i6cJPUabAGeHKiXykxjidxoFMcEMoY1tJOjMZwCVmfS_X4ZvgG-Hu9n7V0tHeYmoRPVFBtnrUUbcbiWR77oRa1c4voass5BxenK9xDC_w7anYKQzyUZ5erJpVblHafL9h2T0Nf8iw6p5zPy31UpsWgrmoXRayQJVOQ5OJhOoZqyTFu_wEuJchIFciMeu1-T-OSkwuPsFNm-n_sTctex-ePl_58J_zkyzAQWU6lTiXGlyueKto193G61pNa608TZsEzMpLQv0-wyIMvl9KtMTl4EK1rENPyRgb5SxQ_s_-p5dij5Z84Iu3j2VIRxrN4o18OaCeos4mdXW0p8Kxxu6VnIAdAqSErB_fTqhBj0e5Q86DwpAtgAoRaAzEGMYgB7oOBsapIlhCHrvb7pzIRh5pr-XL5hkO6iBgjtjQYzCbRCzBdH-2eG8dVeUjHYXiSIkepr9R9CbeYh9oHKDMPgFbeRkYVvXZ4fkNhgHFpOjyhv_JW6Eo0TBR-7uQlOffVA1sLLhS3UtV&cid=CAASFeRoQkNW5MLjKFqaM88qSWOZ9p761g&rfl=1%2Chttps%253A%252F%252Ftinyurl.com%252F%240

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b915fb290deafa2ff55ee65641afe2d5abebf6b3fc0a5b4a87d35834118d8c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25711
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A7EC 42 B
63 B 84ms
73ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CrmLvP7bewluoM8ytVrfia64JaNcghESBGlsmAcgGVA_E5Z1G7X2udzdbtGxUUZDr-rwDP3isrhC1eRnMqBRnlMcg0kh6d5BeVTlyDLs8JbbMOm7A

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/ Frame A7EC 2 KB
1 KB 16ms
11ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/window_focus_fy2019.js

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:27:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 385
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Aug 2021 01:27:39 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A7EC 124 KB
37 KB 31ms
28ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0964703aceadd0f8a443019b3d10e976a88d91cb124b39c0a9518b844e94ba8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627472092244076"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38161
x-xss-protection: 0
expires: Fri, 30 Jul 2021 01:34:04 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/ Frame A7EC 14 KB
6 KB 14ms
11ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d8a9aaecb7cd39329dcfad9a882ce0d174802ded027e150440484e097c73cb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:29:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 258
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 18081889583213459188
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Aug 2021 01:29:46 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame A7EC 0
0 17ms
13ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQdb7V7SeYMeyi843oZsnXefzNME2M7hc6F2SdRkdWDwBmSm8WCxwh9xv4QGjHBNE5ImvQICxv0ZcdNe-FjHgkDwqWrHg
Requested by: Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

POST
H2 200 tinyurl.com Show response
e.deployads.com/e/ 2 B
126 B 56ms
56ms XHR
text/plain 18.202.37.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://e.deployads.com/e/tinyurl.com
Requested by: Host: tags-cdn.deployads.com
URL: https://tags-cdn.deployads.com/a/tinyurl.com.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.37.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-37-41.eu-west-1.compute.amazonaws.com
Software: Jetty(7.6.12.v20130726) /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Fri, 30 Jul 2021 01:34:04 GMT
server: Jetty(7.6.12.v20130726)
content-length: 2
content-type: text/plain;charset=UTF-8

GET
H2 200 integrator.js Show response
adservice.google.ch/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ch/adsid/integrator.js?domain=tinyurl.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=tinyurl.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 34 KB
12 KB 247ms
247ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4472886863985705&correlator=3343017254222222&output=ldjh&impl=fifs&eid=31061161%2C31062031%2C31061200%2C31061963%2C20211866&vrg=2021072701&ptt=17&sc=1&sfv=1-0-38&ecs=20210730&iu_parts=1966186%3A34718310%2CPub_tinyurl.com_728x90_7&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&prev_scp=s%3D0%26v%3D3%26u%3D1ps%26sdbg%3D1%26st%3D8&cust_params=pt%3Dyd9ojkxx%26ab%3DD%26pm%3D1&cookie_enabled=1&bc=31&abxe=1&lmt=1627608844&dt=1627608844568&dlt=1627608842903&idt=704&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1265&adks=162780659&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftinyurl.com%2Fyd9ojkxx&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x-1&msz=1600x-1&ga_vid=1144776219.1627608843&ga_sid=1627608843&ga_hid=1039931547&ga_fc=false&fws=0&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28eb547a7f467be3d69301e7477d1a04067414be7ad75d8641ceed3f4fc87131

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11757
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://tinyurl.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210728/r20110914/ Frame 4368 24 KB
9 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210728/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AiHx3cC5ltrDEOFeBTBanaDWnbukc15Ip3DEIhzfT8F8KyWgvDs7Y209zxpq3JPwggXTwm6JlVRkXO0n7Rmjexvfxv0A2I1782VLnw3yxnaIu0W-A-F6Iyk37p6P-kMcK9cDnYOTtdLpDHNDBwtjqyJeLm-w&cry=1&dbm_d=AKAmf-CdCz6QTmRscn6BKkgO1w0pQt5Emqlaa9L8NTpmNEIoqGUVxvHR9z1DJXktQP7hZ-UrI_gdSyfL2SEwqCRFjaQHzZ3dfH6dTdtNAAUCgHHUJVMMaq7BQ8jIBz5w2SkArm2IB4WZ9B2JGgxmaYNKn9Id1L0aEkZOV30oEe47NK60-HQtUTZzlu5Gtno82eW69wX42hC8D_RHlgBv0f1X8dgm_OHbbm1xgL78qLu8GrVhRpuBVeXKiKbR-hR0RLyimFtLXlBVVwwd3xUhvpH1mY-IMydRAUA38NqOpwfIbyzArym9zuylBB1Dv5R2cyPIXhzkZRxsSvdofLUNpSgjBzZnHgD8Law7VJkMRCzF_cQaq753h6cW2H_fFkPVFG6-uifmKkVHSI8lAnFxFNZYbax54LQ0pCrQQwGIbeWPWCdlU44VmsB8Mb3hLSunDMqyNCGcpeHRUgY53Oi7YP13Gl3ERoORtI56nNlNKtLGb2qW3b-LbAKAJjCmeZdVo1eZ_pwgMK5aUZulufBnmHaGeIucbFE1O94dsiGHK1zSPizR5sKSFyhd8NQZa2zuA7Gjqo0uNOOtNWA-3lOoxeVrw6CJ_ZzasdfuKwyXRxYAR8Gc7j9esASQ3UebXZjL2XQW9engq7VX4Sa0rVSRkTAjQ9nnlv8AlTjo1hm9vsGgLvEpNBIOSpEfKWA40IYT3_ME_0tMZkCXr4e875bLn6fRjO-QHVUVTOmzeUNKG409rDfDqTGQZ0CAhVr3m9GeRWzIq7n7eu32Wydpe3-HPk8_TZLcfbZfjYwEFWp-rJZq3Mc3rz6doGSXeqjOPemg-iDxbjhq011QZwMXc52VNlTC9jpuV7AJz30zBzEE4ZABLHmj1Y-x4yDU9mbciVx3DsjuY95dyJOC22uGXXE1SdaoOHfrHClgH8yD8khkjtD7c7AmUFCuSeoaklBDa-k7BtIVj0w82dNur14GOFMsVDgdiaeMV1Z2_Znzh32WGNgu26Krz4guh1bnVMDV_9MEXZf2u8jHMYxZmd_FMmOQsboyMGtoAj4D6Sd1TLzsKKyypCU7jy1-A8T1JLsOlo0SyhOTqTJ4rqyOfAcqVuZpdvbqfuq_Bsho9XP4jdOgsOXH4rGtEatz5iZVqNVtc31o4sPO8Zs1DmSYoDpdYOtv044qDf9ajD5D0Zp0er1LJhVpMRVO97NcfcqSff7HR16jjpfe3g7GKVDAHOR6gAuAayHpmBEqiS7cylNkKeIW9RXBD5pm-fxY61WmctfQK50kwoJBoTM7Vk1g8ekcRQGNtVnb6NwbnJJKEwvCsfzKXUGd-TAF4NwJzISPGGApmwio4wrrzcEcOLXjAmeTCTADUqhyA17OtPour-uu5f6DuxrUtKAmEjvEbeWFgD3Nzyr0DZlY29ZS0SVxOlaN1JNqO3wsro-ngKDiYXA8UIpKLQy21cFqS4zH1lM1upa2KlFlWhBhsc610URLy7kevlr8EA3VoOczVqxCGGp1oZp3UeiHXHzdBKq4gywfNzXUCobebReNRtQc6zVc2sGdepio1xFZsf9SqdgkdDymR3VJUfoR8tOsgy9jqedvLgd_B9qPRBLGoq4_JrfMvOaC0-usFIwr4u5QLyupCB81vrPqaqlcmW82K0YqKWep-ruh0fmsKbXnwpB_DW5nuOHotfc5GD0MGS1-vtBBMbe1YBratqymsCJZToY1FylJUlyh5Tv21rrzcJy4OXeC74D6rKn6oYb0syHdQuskvaaKPCBSCYZLt1VDrmBV15OXxwPXT-shI1QiiA6r5UNUCb8QoVkKN1Z37OHuvp4jIO17D4EvaTHpztKU5fsTtlh8UnzYBob8_D97fUnGmOgm0DYDewopbJ9ZY6jYnv3USQwplVMdp8YstjeKZw8L4H2HlQRGkom-EjAKt38s9i5qSTKvwIpGcVAuh_4c0MrQS69FCd_0cISqH9NHObrxuOI5vq_Kngf_djMcSLnzFUSESlBO1oU_iLdz4U2cGK3hyfo34Zjgo662okQ0hRziueW5gmb0WtMM8RIMtSWdFZ3fCbbsmdYbqZM3SXVqByBdusS-KdS3HaszfsGQxNuK_Acga7V44hu4sEoFrXg0kajTGUOrEWIDDdcHKDXpaVwC060jdBfKC0WHcdqa3SOkP2P9pFynwwWTOiRYmYHsdTjoOtaqA2GP8PFdBCzxcC01Mcb0348wlZKGVH-16JrmudtmfZ4SXnFK32YowW_mGnAoU_4Egz94MPVIoPAc6x-uO6_yvKVtoDaKT_rEt4D37Bylnd7zcFtic5nSA05Ub8VzRH_4vXzGMq6ip-p9k3UOj70940JIWVLmKFleBaPJAQdyHwciDicBShb35AxMLHUFHnflNaYz9j2uJHzkbNCRrwUUo_vcgIYZP7PrBPpeIUEdsd5JsjndybAQci7Yawps2aOAAarrP46oClOT_EynIHAVcjBY_E6uNeK-6PjA4HlFFZ9LWvHVASOxiItDoiu32wlewDRixCm0XwTuvfkLVE1ahbU-nMw5g9eqEv-Q_NjKIDBJUsxfB1FtVeWPhmwW7LZmEVGOZD0tq6UbPIQFJZfJ5_LBr8nPbV0TCcGLGFujewOC9u0UIos2tP6aihOoGiLS2DOmBrLi-Own6vYJzTgxrkoLhsqstA6j0dEzP9TqelIjCKUqPY77Q1qgr1zt4VkL_IVwt1_abI1--uh7CxDekVm_w_P3OiHBtmdir9CxGzSrcgY5II0zR8uE7M_A_tgwVY5IoufOjdwa2SJOrDmY27891gEHkWDCbMU6QMJrJ7gnzdv9stffA5XgH-NaGw1sA2wyC01UsxY6Dm7IJ-1caYSF3m9zZX3cY5laE1QZ4z2-qK2gG8xlUfQtO3Q2dApSfNq89JIHUpGIfji7B_4wxpKC-04hTpZJQKVolhmsCDdQpkbIdUsbZ0Y4o6OW_xSIE89pK7x1m5171Aj-lVzkwzjI9FBFKOvvK4roLzHveO544_ZL1tYVmOvRCGPKE82oE-k7lkY-RgvyrrQQ9GiVZkjG4JVFYw0lMxvy-8rvT-3JUGI13Ptqpsiysu4BzI-689oj_2vGCISL-h-sjjJLelbz8f7Fo08k7IcJSWUaqVGV0V8gPX0mg9040dJSg8DGjqJjabSEfShp8F2eCQ&cid=CAASFeRo3G7JFp2q0_IOU-eIQ1qqgsT4oA&rfl=1%2Chttps%253A%252F%252Ftinyurl.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e0b072e0b1f96186a779eee12b838fb8ac4372baff6c3af22d3d27caeb18bf4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:27:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 390
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9340
x-xss-protection: 0
server: cafe
etag: 14963318235020188028
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Aug 2021 01:27:34 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4368 41 KB
15 KB 23ms
8ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 10:46:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 226077
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 10:46:07 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210728/r20110914/ Frame 4A12 24 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210728/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D8jcWiEmJ2mmfqbxr-RUYZIUS7O1-1Sj5R9xZlDleHh6jE-re8jfjO-hJGH-h2m7YOAPxozsOeFbH-RKsW7L4agZ4jZzTz-W_TarqlHYdXkhVii-9LIcQnCrxuZ1nLWPJtclFXyF37zO6CL8QBaGCOK6RCFA&cry=1&dbm_d=AKAmf-AjqIeIFm4ULi1tSwg9Ydeb6CX3MTGlqp97pGBPdYMOe7K_BeIK1ZwGfJlAmweOq45Z6D_paEK8Fw8XMfNT_nYMRHx2Euau_XBDmPKwm-kVjvnDoWn167Um_GksVKBo2D-PkU9kwaEmetEoAUH4zw-v4APZs3dGqfxjmn5H3TinAoQnRHdvCo7GEXvpbPt6GHJtSmZORaRV0Zs_8WOxK33Evo4-vbokMLOh5kSNC4OQC2xHhTNF9dHtZ6gOY3xYpLA9RPep4dzpUL8RePKeitZTPAdeRDXGQo-TmswH5uK8BfJCIzxUdsLUn9EuHk4u3bZ2AnQjKc2IFcZQF5HUeahFvMCf5PtjvrhQ4wp_NcDAjoS2k2JMCcZuwY0SJRn2IuJdrTkddcx0BlvCYQUNYGXz8bUJ8n7eFbuVSA4i2_NYVM1c3pZiM-ZShonmE5ad53hDvwZD27PWoXl2FoiTuwQd0xO2pPjYzU1FtyAvB95UDmG9UbDhLp5wdSsauYTwTJ2LvmnrOUAF545allcFzrqGsfHAVypLD-0aS3zy2iLsF3aqCgk8_bh-74NxvlLfeSGmCnWfAOIMC_6B7oYZ66cWKDUpCq5ySGKIwuQs7KKWwfl04E0aNCFyFEBShRP-xxa801xOTLTQkWdXrxhaQXow0-CPDhQdskewKUL-1xh9vOpL9cT3jy0eMXueOx_GLBhZAyzwb2SgzidjND8AiBpaGaO6dNubiCek95YrvSPfk7oDV0qKuLQ2qlSnt_5Gzner8CFwbDSgMqAW24FCRyVRdlHzviryZGPcmfz2JlkgHtIJLHyr2YbLeC7ume6Y-gxEQ1aVxmEINt9B-oLwyIAp0qSlThuJtQdcKCuRoCjl75szxo7MlXsTXsD6pfPFBqI4bJ0KcJhyNtNYz6zpicZqs6qezqrNBtGqOJIDGUfhNjv_mAgH5Nu8wPvUH2IrHBggHtBHPwDadpXVPwCQCwicrqAKdcPGxiV68ZofHL3o8wlHOdanrsjPkWZkWqlx1OwE_Q17C5KOOcCp6AChVOfSEkK4ecCOLOWk0KT7pjJ3m__TNdkzOcvgC6ss52wBpND2oNb0pBx6UDFLp93ZzVrWHiq_jp0RlfxhCkTCGkT6PtES6POePHjtp_5leeQ-_1At-dGalVUz3q6CKH63RBfdL48IORDPWZc9fTOZO5YFK1FBxXQ8rc2QgIAYicj_W3adbRieBvLGxz88H6q-8TB7Itogtt1d1abfvAqqZRYHKf-HADnqFI8oVw_0C5fiQldrbPoxuevx_U6Y26dfUW9Yp7EKPD-P21OYcwaiCA5OyyEb7EgVlhCPcwIzYlMRCOn3TJ_qHi9N8wYLsSBHL7HSUXlQ13ua5eSe66eUTvWxk7vULnvb-O-WjzTDFxD_vuTSzjsDcEnaFF3LSezRYj7U8tibB2Ut2sp6e5UxUw7oZrVQqUERVQbFk8X8zJ6vdYnXD1Yqd6icW58sRMbQJ0PKpviFzTdFlDfdze9YY8hOx5_4aMgeOpIaibc0posFucv4TN8Zz-30N-2OCX2a-gzBcirgmVsT1LQKf9PQGDeMqfTsaY3Zc_HUPx_rkhspnpN1fYUkBzmfTyO0N1IHu4czli9BukBxfHJchSMeF_T-UxGi8L7hpQr4CEiC9PKaI3tMIKbTQAXDuYo0Du1OnDo2l9Y1EmLM6PfED4Bf8z0InjwGokwKEjV_voudpxhTV7PS5DDXBPOtu2VC2OqSqFm2Ju3QwVEictK7X726hLadnYy1bxG8uRuHMfmARBL42f7gKNARHUWlJkOD2oZZ324o9hXDtZa-DIT5nTq7bAwzMeuA1XOCdxKsdMGf9wMhBu5AWTwOSCeOIukh7k8HO2rN_0Lzw-HSCQlMY7Bp-61rCFYW14zMdkC9nYdsGXZUTNH7PktZemPsJ4ilLdRyycfkuGmhliJxM-ZnttTBfqWJgNi-GcQcNParQej1PSwACRCrFboQZj9WMaPXPTwCkdEgPNpL8PegsM6OpCgNgLm_LvXf_9epr-mrkUJxmJk5M8Od888gWm6-QeifTq4kh_PYeVx44-9uoTp6RpReonYRq4pTeZTWf6naDgX-3bXG5UkD7qu_Ifo_6YgU6lhf7akI565NkVDheNxvPlV_ije9sXurTc8jPjMHi4SUmZgmbg_OyjTELvludbuUOHUBo_6-uliRC_ICC9go1ymad3hPpzPQ40x0BlpAfqX_xcJtpHuEkK1elc5Qe0vtKrTam8PQ4uljOkQon15Y9_I0Yn2MXVYYvhgu301_WohYCmttL4uh--FqvelWILZd5yU9n6fzZZBQW3WVDURoJwHXyfASDHY34BJT2oXUgrQKPGChxKLNY6p_vGDUotRZTtvEo6v7rH-L-PBG-8UkfYt3CsxuJIIjUYl80NRcahl6jFjw-zUJEWN_FspnTlm7xl9F_WZJCjl9c-nEhvyhIcp2lZhZmv5v84qvXtYYMC4thcx8L1E8V77eQXFkNJWwcvFY89d-EtcWlqOc5YEewsNdLB15m7yueuQAs8khFneSbxJQ1lQCWYXb9GBUwFRizeWRND3DuFq2M7rV94NJWsmV-GLZb_HbuQmYKJXWjBU8mnOEErjomPDz85NCBsrYrvHniDM7jVN21Nky26wee9KxmTndEMCL0kJQP1ip4rRpTilpya6w0wVmWx4QfDOM8q4GqQI6wq1_z-jYjoQCUxB1s3D8y8EiVO_Zg6jzybDG9jI20ozgqqeOiQNMzcvLpypYK1VC6lhGwpwWkB3Xekifzpbi2BK0zPzCVgAP-Hcm5jUWchurEUhNy43vOI3VHygrXUtz9NZLfVh3xa2ghEmw2ONDqovJeejAC7VUGXsNJDtV4HWkUnDTZAHVsnVHTGqIMN-Pr4nOxy5tqvb7LJa0wvnARmAoTjVel9IgaYMNzatjJ54TScAUpYQI0Xb889Ndvvd3_ZBUwGEPtadvWiKyprQOQ-9tXWgSkv84BkV_CRcZP3qFumHd6dg0E0yZQ-zDD79KMo-mANOUqQqsOWofDPwRoSvX00H2ME-0lD7ombhxKwHpHEJlnExw9uYQLOgDoTtjDXM2-gS5j3rWK7DKVxwUBQMGjwRFzps23zdCRD42SH0ueGkh6_H9GgGWRYyfvbavPEHy0g&cid=CAASFeRoJx0Xiybp-F0OgLxGLPWwfIpBpw&rfl=1%2Chttps%253A%252F%252Ftinyurl.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e0b072e0b1f96186a779eee12b838fb8ac4372baff6c3af22d3d27caeb18bf4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:27:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 390
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9340
x-xss-protection: 0
server: cafe
etag: 14963318235020188028
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Aug 2021 01:27:34 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4A12 41 KB
15 KB 17ms
6ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 10:46:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 226077
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 10:46:07 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
147 B 6ms
5ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=196261077476671&ev=Microdata&dl=https%3A%2F%2Ftinyurl.com%2Fyd9ojkxx&rl=&if=false&ts=1627608844583&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22TinyURL.com%20-%20shorten%20that%20long%20URL%20into%20a%20tiny%20URL%22%2C%22meta%3Adescription%22%3A%22TinyURL.com%20is%20the%20original%20URL%20shortener%20that%20shortens%20your%20unwieldly%20links%20into%20more%20manageable%20and%20useable%20URLs.%22%2C%22meta%3Akeywords%22%3A%22tinyurl%20url%20save%20share%20shorten%20analyze%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.44&r=stable&ec=1&o=30&fbp=fb.1.1627608844582.1147606805&it=1627608843019&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Fri, 30 Jul 2021 01:34:04 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame DFB2 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Thu, 29 Jul 2021 20:49:47 GMT
expires: Fri, 29 Jul 2022 20:49:47 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 17057
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 29FB 783 B
533 B 21ms
20ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f2b99ce48f12c9e814987473c9ac1ab7f11c705dcadb88c79d3eb629e217dd30

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-8s5N5Oy9fOWbZ6+2585m3w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

expires: Fri, 30 Jul 2021 01:34:04 GMT
date: Fri, 30 Jul 2021 01:34:04 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-8s5N5Oy9fOWbZ6+2585m3w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame A7EC 169 KB
59 KB 32ms
6ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 14:30:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39838
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 30 Jul 2021 14:30:06 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210728/r20110914/elements/html/ Frame A7EC 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210728/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CVcF4UxkvY8C2EPmk6dqNZS4wGVmK8C8wki_-Pubba6ZJ3YvH5dpYzrakautMboqyckIuOx39U0z1ZeTvq_oYb5xOy8qOns3i5APK-85e8v7BheI0zqM4H7cHDtVLW3d_2fDR6ApLBCFufc85rcg1pIUJvGQ&dbm_d=AKAmf-AVpixqFxkeyJ2j3Nggmcje80p9fFMLAQG8uLME6fkYq8HlX2DTYyrKhJ_0SYjqYYBCpTrQj6fMpo6t6byk5wasWiVV2hqEiedT1u-vvBmBTEvQnsgeds3HGp5QbqOKg10W5uMtUQI3kSFXuARr7Nx_OXng9-oXe7YJrZ_t8kFEu7tICEd4RdDFReEzbC-1hCXqPYrWObkBpwmobS2XwiYJMM88i7nUEjNHzVYBPRyMuIeLacnkgxdLkodkmGhOTgMhLo-EHMR6MZN3Kue5MjWMh6gt0GYeVkNkXvENk6RMr0-OIhdaUZLfN2RxnhFMW7f1f0ShW-kK5xFdNBX51-N_Di3A9y862fiPQK5tjY4Qhmjdg4t7_NnPnNxLswDFsYM4eZIl25RIw8aWBen1_jrvOu71CNk73kIn22cYCDwBwiZVRjqD1mJfi0R43DAp0THlLjQ9Ks0iiCGaWHTfHDqcuZX10Wl2dvwvEBzwcAEvAot8vQ-ez8E1VD4yChg0CfWHnufCUYXM41Zihocvc5zRqVWUz9LCOcv0BQJpvFOoKWDDmzjncF34SvJkujUwQgV9Jsy9ieErADIB_AL2Np10GZJTl54BMCxAnVSKNpJgQono9C7poeKY9PQ0S6J-LX2EaYxhqpbFswRUHJ4G6WN6OFDoaYR0Stw9WOek14AK8niTTO0W03rs_9f-8w2K_6tnghRoDJW93ZK50fvyevanqLdHcn2wvmeAe-dtvz82x753xEag1AICcln4dH2FhHFWEI83xQBFzoduqxia_2IE6WymWX6dqrBhi7d8Q0psb6VZR72fxgfVULWKjP56xOZ-FnyyQHAkC9BWGliRITnRCrBb4iruq7vxMzzMrJuNy6vncdmMejZe8DQONcj5RHKDDAIZrU-jT-2iuy-Ux8R03ww-jGRfzO0xBBGygPGOgWgSlkIMIqhdN1tyX4izuaAxWUYtuW9USlMkNjvENQY4Lj2coqlENAP_djUOaUQTb3YnBskwFE7MdRgYWDJDc56boowmrdE7OazVE2T4uiaHAekAChtJ3E_hVsJ9ArfxrKjqUcY-d7nlmV3mwTgn-GdPzhx3vuap9x_kF22EHl6SpGmZavYIdWZrRyia0XY2OppZYFtrGKvRxhkK6VwikHM-vSctZHMp5oyCcZDTLkupwg8HGeZ2-bDbARlpvLI0DnlqZhzngiZgRbP3K0oUWZ-iS8h4-c7hKZXpmHrmRDNN002AdyQOtVFzmvL7I1kzfpOtwts2UIA5rqEgwurLlgGiWmX7NbQs8iSgVgPA5GprEUwjvp-S0o5GGVHU0goJlPe_eBE18wVBtFHvZ-NZO2XtWr7c6EExulPH1KzwPalISkrk-YYG34RVswEVbS9APes8y-I6aqU7PfGgH5o1Ububyt2ip6I0hHt7SJp7nmBI5SKX9kgPjVN62gpEZtFQ-UWtkicZ7s2kEiIn6yrvHra7GO01A7E1NDM1PNi7IsFez8EpAoBbmjJQGJJ3TgMBvK5JuM4LzB0lIq5gNWEIB4ewFFQxJJDxgUwVfqqECbiwy5vr9zRuPNrX5G6rUqpa_9S5HdYzIg7tnfFCsgLkisk0VEWGgOyvNQDVNUzZd1iJLIUQJBcrL6xGmG6yrx80pQ2k5u0kM8ofIjchZ3_dtuolWs-7ffqWHIE64QIpuE1cqAsMNo_qkWlx6CbzsunlzbZ0K1RSHURilf0IANGzT9KZsHCsauZKe_HSNSxGB4TRg-XjYLb6rd3juyAgTV1BSRwN05bOTX7qPOxVqMiVeoSaYR79wEQY5mJRcdGbPKWVDxDedA1mcLmN3ogPLzuSZj6UmZMsuYz8l-ANSHoRRZwatL7h_dEJ40UCtP2-VtoH5y1L80izv_AjQsm1IoWy9CwvzBkITC0XbAeKTKPCnGONzE9ZNO9lpJFklFrT3BbLOPPfGJ0PyTO2ahaR31FHxT9TkanaFbASsYzxOt4NdTJMXeGasZuKlMVcHWPGVuah_ZNVywPrjXTIntBy_VE2TS0r5mCkSykHlvKuwlDdMTv4kdQ4h-Y_85PrKldttv39h1SZs36fryIbBiTNGWDQj9fSvBqdev3LZHzFwnSjoF8hXsRjSl6tSDt-VjPcanAvumuTqcSOAf-RACW_jp_WXQ4qopLGXPaJDWQWZcY7v0Qw2ZPmk5-1YTLjm3_RbCtDSORfjWQYunVhjg-f-R8lnkAYJkEV-uLr2RagTBR-WN40xI7lNELYt-b8dKpvPKwBn-X9Zsg38UefQYRVlpbJv7fIKdJbupfiZIjLMQt5yFHsnv2hqCROPHl42frvkPHJsW883YvjgRgesPDPMEoLF2GE6KK-Ratp-wBaqYjSd2uFFs2yLNlkQ7bh3flphWzo5h9cB3JWoMIT1_KDRt0vw0ibNtPKI6RM1Pm-AMANtr3IFwHkK2INQDk6fh3S-63XWkNZDiM87a6Dey3zdnpy1_oDPlHJNxgIAGYUHUClr0oiHUmmUZmu2eDlk5wNBKID31jlvjU8pmVQB3iPRcjZB3J7Db5d7a6YgmZTJolRPX95Az0MxOBcWIDnYyFxDpqI-C0LzVFCXHTNdgCZ3lRVvn5c6WMjE37qol9Btm_6jDIpyDkieO076LbQxJIzlrOlR_91I84v4RLcqtH-E2c3lyLMecqlFB80OXiglrpMM9mI7aG165frOqw5THZUcpN48ODizEh47FVcNN9C0QsZnVRrigpq2jO1quuRhn0i6cJPUabAGeHKiXykxjidxoFMcEMoY1tJOjMZwCVmfS_X4ZvgG-Hu9n7V0tHeYmoRPVFBtnrUUbcbiWR77oRa1c4voass5BxenK9xDC_w7anYKQzyUZ5erJpVblHafL9h2T0Nf8iw6p5zPy31UpsWgrmoXRayQJVOQ5OJhOoZqyTFu_wEuJchIFciMeu1-T-OSkwuPsFNm-n_sTctex-ePl_58J_zkyzAQWU6lTiXGlyueKto193G61pNa608TZsEzMpLQv0-wyIMvl9KtMTl4EK1rENPyRgb5SxQ_s_-p5dij5Z84Iu3j2VIRxrN4o18OaCeos4mdXW0p8Kxxu6VnIAdAqSErB_fTqhBj0e5Q86DwpAtgAoRaAzEGMYgB7oOBsapIlhCHrvb7pzIRh5pr-XL5hkO6iBgjtjQYzCbRCzBdH-2eG8dVeUjHYXiSIkepr9R9CbeYh9oHKDMPgFbeRkYVvXZ4fkNhgHFpOjyhv_JW6Eo0TBR-7uQlOffVA1sLLhS3UtV&cid=CAASFeRoQkNW5MLjKFqaM88qSWOZ9p761g&rfl=1%2Chttps%253A%252F%252Ftinyurl.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 00:41:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3168
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Aug 2021 00:41:16 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210728/r20110914/ Frame A7EC 24 KB
9 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210728/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e0b072e0b1f96186a779eee12b838fb8ac4372baff6c3af22d3d27caeb18bf4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:27:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 390
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9340
x-xss-protection: 0
server: cafe
etag: 14963318235020188028
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Aug 2021 01:27:34 GMT

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 1469 170 B
243 B 30ms
29ms Image
image/png 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_dbm

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYjP_gOjAB&v=APEucNWc24jmzUPnRKOT7obkr3mk6p4GxqyhW1FdgtivEvOJ5viFkb0BYQ6JqfK1adrhjMUILq3FxGcxOqGq-CYodWBQriinyA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1469
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOdLWkt_hceVnrA_aePwClg&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOdLWkt_hceVnrA_aePwClg&google_cver=1&C=1

43 B
1014 B

39ms
39ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOdLWkt_hceVnrA_aePwClg&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYjP_gOjAB&v=APEucNWc24jmzUPnRKOT7obkr3mk6p4GxqyhW1FdgtivEvOJ5viFkb0BYQ6JqfK1adrhjMUILq3FxGcxOqGq-CYodWBQriinyA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:04 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 30 Jul 2021 01:34:04 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:04 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOdLWkt_hceVnrA_aePwClg&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Fri, 30 Jul 2021 01:34:04 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1469
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YQNXDMo2YWGX1jZs98Vm8gAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOdLWkt_hceVnrA_aePwClg&google_cver=1

43 B
894 B

46ms
45ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOdLWkt_hceVnrA_aePwClg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYjP_gOjAB&v=APEucNWc24jmzUPnRKOT7obkr3mk6p4GxqyhW1FdgtivEvOJ5viFkb0BYQ6JqfK1adrhjMUILq3FxGcxOqGq-CYodWBQriinyA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:04 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 30 Jul 2021 01:34:04 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOdLWkt_hceVnrA_aePwClg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame C88F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESECEIZWnbOfD-7NCFRDBRZjo&google_cver=1

43 B
1008 B

30ms
30ms

Image
image/gif

185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESECEIZWnbOfD-7NCFRDBRZjo&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY_e2XVzAB&v=APEucNURz60uNQj3nL5bxck_ggueKwL0_3A1QjbE4jHbWD59LQdWzQEa5KTqDuAtHgkVISs_C6vBElSYyB5vXM6CeLvllkdEdg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:04 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: b209d4b2-b08e-4e73-989d-f15000e3b802
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESECEIZWnbOfD-7NCFRDBRZjo&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C88F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njk5NjUyNTUxOTI3MjQ2NzEwNQ%3D%3D

170 B
188 B

38ms
38ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njk5NjUyNTUxOTI3MjQ2NzEwNQ%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:04 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 33797f8b-41cd-4f9f-9471-68bdecd694cb
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njk5NjUyNTUxOTI3MjQ2NzEwNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame C88F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPkmATbzV2DVIFPecGme5l8&google_cver=1

43 B
106 B

26ms
25ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPkmATbzV2DVIFPecGme5l8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY_e2XVzAB&v=APEucNURz60uNQj3nL5bxck_ggueKwL0_3A1QjbE4jHbWD59LQdWzQEa5KTqDuAtHgkVISs_C6vBElSYyB5vXM6CeLvllkdEdg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.211.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
via: 1.1 google
server: OXGW/16.211.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPkmATbzV2DVIFPecGme5l8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C88F
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjAyNmU1MmYtMzc4My0yY2U5LWViODYtYTUwYWU4YWYxNWRm

170 B
188 B

45ms
44ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjAyNmU1MmYtMzc4My0yY2U5LWViODYtYTUwYWU4YWYxNWRm

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
server: OXGW/16.211.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjAyNmU1MmYtMzc4My0yY2U5LWViODYtYTUwYWU4YWYxNWRm
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame 3DC9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEBh3fVCP1Zsi3YV4f3Aq37U&google_cver=1

23 B
288 B

125ms
117ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEBh3fVCP1Zsi3YV4f3Aq37U&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfWWBDBzOgCGNLesJ8BMAE&v=APEucNX7wb_FiciLYW2q3azFjYgrNUewI_E3eyCamBcfkQgwtIJlewc9Muf0qVkAxfO9NvV7HObylujm4l5rSKEnQQIlEO60cg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
cache-control: max-age=0, no-cache, no-store
expires: Fri, 30 Jul 2021 01:34:04 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEBh3fVCP1Zsi3YV4f3Aq37U&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3DC9
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=NmI4ZjFjYmMtMWE5ZS00Mjk5LWIxYzgtMjkwNmUzNjM4NTRl

170 B
188 B

30ms
29ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=NmI4ZjFjYmMtMWE5ZS00Mjk5LWIxYzgtMjkwNmUzNjM4NTRl

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfWWBDBzOgCGNLesJ8BMAE&v=APEucNX7wb_FiciLYW2q3azFjYgrNUewI_E3eyCamBcfkQgwtIJlewc9Muf0qVkAxfO9NvV7HObylujm4l5rSKEnQQIlEO60cg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
server: akka-http/10.2.3
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=NmI4ZjFjYmMtMWE5ZS00Mjk5LWIxYzgtMjkwNmUzNjM4NTRl
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Fri, 30 Jul 2021 01:34:04 GMT

GET
H2

200

sync
partners.tremorhub.com/ Frame 3DC9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm
https://partners.tremorhub.com/sync?UIGL=CAESEGQGm1a9UTzs8qYnu1Fxo68&google_cver=1

43 B
182 B

102ms
99ms

Image
image/gif

2600:1f18:612b:4232:493f:fde9:3e0c:462
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIGL=CAESEGQGm1a9UTzs8qYnu1Fxo68&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfWWBDBzOgCGNLesJ8BMAE&v=APEucNX7wb_FiciLYW2q3azFjYgrNUewI_E3eyCamBcfkQgwtIJlewc9Muf0qVkAxfO9NvV7HObylujm4l5rSKEnQQIlEO60cg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4232:493f:fde9:3e0c:462 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://partners.tremorhub.com/sync?UIGL=CAESEGQGm1a9UTzs8qYnu1Fxo68&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 283
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 65A7 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 27 Jul 2021 10:46:08 GMT
expires: Wed, 27 Jul 2022 10:46:08 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 226076
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 97C6 22 KB
8 KB 10ms
10ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 27 Jul 2021 10:46:08 GMT
expires: Wed, 27 Jul 2022 10:46:08 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 226076
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK jaca9pdc7b7l Show response
hal9000.redintelligence.net/zone/ Frame 4368 11 KB
4 KB 79ms
24ms Script
text/html 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/jaca9pdc7b7l?subid=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCofcDFcDYbmMCrKR7_UPtdOHgA3ktKqDV5fKqP-uB_AuEAEgvKXMIWD1lc6B4ATIAQmpAqfa7SnD8bM-qAMBqgTMAU_Q-PuAszgE1k_yXF7bWPgDq_q4p7xAXE5bn3POCVlaIueVvfLV6fHP7PcPCpNn0z7XTJ6sD3vheduY-xKgFLEy82iwG6DHmSAJeaDe6PrlQKwg3h8EmMwOe9vrezAlp7yc0rtmxe8VtVUtn3gbKDatydCTKUkbEq4Dl69rlI58xjii9-yHiOeTaiECvi8SFxbBZxxMYxV7fKg57r05oTHawUwf9Qb4_xjsiXPNoRBQHet7ZSAOnec9ohlhRwrKCKKiJ3E6eVFrMQclHsAE5ZTf0c4B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgbqAeqm7EC2AcA0ggHCIhhEAEYHfIIG2FkeC1zdWJzeW4tNDcyNzUwMzYxMjEyMzY2OYAKA5gLAcgLAYAMAbAThcC1CtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRo3G7JFp2q0_IOU-eIQ1qqgsT4oA%26sig%3DAOD64_2iNmcjA2DfvRkXgHBjhznI1HXHWA%26client%3Dca-pub-3153065230153281%26dbm_c%3DAKAmf-DfdVhVoPvaBksetNWT7SwQz88E5dmqLPRjl1eFVTAawzeaUH3HOgz3ogUi7ke2Zu2gXzRu3-c71kmy7VaY7XFPpxLJt4o35ki-jwyBHLLUpE02MGbVkhHgpv8RDzuoG7Xljz6fQPegzLV05HfjeVYA5FHDgw%26cry%3D1%26dbm_d%3DAKAmf-CZV346R9Ujoawmi1N9aveE786Engyz1CC8GhsqXgu2i4jUwxZFzgFnAAwzb9bmbHbrc_3_zFTiiLrxYjNciq-bzobBTBWzNR7Zbpltg9koq57VvG2-aDDRuF2-ctvQlqjV2QxcPryk5FpA-Xg8rrtZxqGBrLPTXU-hbQqwE9q1HeWwhWul4gf0vcDnh9pWB2kYW2gfIM8W1kRxppMs3f5NElZMGrmPhuJniZkcraSNT6dhISHDGSv2hLsYkpXzmQ5-wbcC2JzRkENIQKr-4Ht_Iut20VjcdWeaNCAZTtUIT1-xwqFWPOtJ2TOb2DOPRHV7vPNLkryC4q_e-JI_yIWEL3S9TZpNVUn7lVoqpTPWE0N2P_2n4dnuNqc5-FGbx0txkOBxd_f1ZObtLyPtIJvkCUgNnaLhBvr9a_Ujt4WDuTDJA9oHsYS498k8F8-iTrCcAj1k%26adurl%3D
Requested by: Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: 1b2613f66eaeb72782bc9320afe63a0e0d082d38620a61e4be745f401aeae7d9

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 30 Jul 2021 01:34:04 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3897
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK aoap14h2vy87 Show response
hal9000.redintelligence.net/zone/ Frame 4A12 11 KB
4 KB 75ms
23ms Script
text/html 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/aoap14h2vy87?subid=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCetDzDFcDYbiMCrKR7_UPtdOHgA3ktKqDV7jDyMepCvAuEAEgvKXMIWD1lc6B4ATIAQmpAqfa7SnD8bM-qAMBqgTKAU_QCS3ZRKd5KoTrm-msyl8DyJ9Pl8lN-67k1qrGCfo3kPc6SlygihfLdiwxVK-kztig-prhpVLp1bCS4U8Y6dhNDHC2s2mDUIvl92fQmqLFKZCGqect7uja6mjysMGp6RdOUalTtM2peqEwSDUS0mTPkWl-tCf7-tdkfrXNRzgHDP9C8-3WGDx77aq0Y83yRpGcVhF7hXx9inFKa-PC9pOpLv7S8ndx4r1w6NYPPjHGI4GxZQWrUVCgaJvPX9DQcBkFv3ZHc5F9gb7ABOWU39HOAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAtgHANIIBwiIYRABGB3yCBthZHgtc3Vic3luLTQ3Mjc1MDM2MTIxMjM2NjmACgOYCwHICwGADAGwE4XAtQrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoJx0Xiybp-F0OgLxGLPWwfIpBpw%26sig%3DAOD64_13-DuMLqShYCDKMs1q3XfzjNlKxQ%26client%3Dca-pub-3153065230153281%26dbm_c%3DAKAmf-BzGL5YL2d29mUzFSwafcwlIGnC5C0gv8FPKB6SRLdhUu2SEaIoWxUXF6N2-WU2hPI7tMLkJ1GNqIkiDxiB7IOKHFVlccr49_LzrE_ItHMa2bYquWmddlBY7nZXYMLXQwIn3t_HtAisdlktxw0V0hhddMBtVg%26cry%3D1%26dbm_d%3DAKAmf-Ahi_KHlk7LrJC89b8871caNBgg_PQDsL8QAWCr-BOGK3HaVaACdBb7HA6hLxzkasXjYg4nHNEeAjMpdkeRjJlqP6unI3My2T9oqK3xLeM8RIZjE2Gc0pgXP5MVAFd6zre-BrGC-XaylvgumD5JrbcSNiIizNjODDhYpxLaasiOV-cPlrxeqfr6lRJ0rjajvT6rYnm46AQHyFTHlwAWSl7J6bChoa7xdY9Tdef1G8R4WLK6Yi_TfSvRJ7HqMSB-0a3QuuXshHVknkVYHuQKuO8e73Iyusf8yiE0RF2Fi3px8CWbritJeMp7mHf-myE9HZ-HZ0cDGSezJUIniLzJEuUI_dKcUvXoeDI_m6fsMwmt4u3D-oA6dTcHaawEv8uhUg_yZrJDDND57aCc_a3m5o3IKfkLYxbm--7gXtvTRpEXpTsLpIQ-61-w494X_D-klUw0aopq%26adurl%3D
Requested by: Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: e3bef66a03d23d89e3f2c592b02f3c657d8f5f3aa9f2c5c357f6b914e1d3a4dd

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 30 Jul 2021 01:34:04 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3903
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A7EC 41 KB
15 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 10:46:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 226077
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 10:46:07 GMT

GET
DATA 200
OK truncated
/ Frame A7EC 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2a2dd84179f3767cc08a91e593042e8d969e6e1bd51684c2b04bfe1217ccd20d

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 index.html Show response
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 21 KB
4 KB 29ms
15ms Document
text/html 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5aadfebce3e6cfeb6992e41540367d8f070b348c70e7594978af0ddd4c4d98ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Fri, 30 Jul 2021 01:34:04 GMT
expires: Sat, 30 Jul 2022 01:34:04 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A7EC 0
592 B 107ms
38ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss58jLIaxc_r2XYI2yRY4XTQ4btXWtizYTrBhfPxdRUddyuIDMceuPcNwiti059x6tISbWAfFxgvsXdQkZk08yKxioH8AD-VW9A5iMKVKe1uHDvn9hvhC1O-eEQ94jdUV1XDNkJo6P00AfnSVALzet1M0RaR_Ax-Pb3pYNw9fJpDOF15ArRXVCzGTQPGngdTmG67ZOSDGnm3pw-BlGRpXuKLlpeEhQEccjSl7KSM3cUe7tkOfNr9SowQRGyl3qPVdvzg4vMl9EdlMoOo03J3JrB4At8FJOPQ4S8VGicFN53q6XQJRWFSGJEId3utGHp3fjvuID8yMFpa75nYB8SDFUgslzhkv81Sw7-AUFpd5tInhqGrgDNz6lnV727T_v5xGnrhLo6mf05sFPdhNA4YjhABzya2NNwgSlsUu5kH8FwhXM4FKdKb54SjYEbp4TG8QXkuq7qTNq_jdDzZqTyU2XfbwWtQ_NZVleLiaNifNdrD2qZpJ7y6RGN18SxsPuqrDNiKdfoUbuDA-yEVO0z7QNlDEzWPL8LMl7j7Xm16MV2_mSTVs8r8-s3fyiilRfuz8f8kaeGJg5sgPgyvtU39Xz2-yWHZXVr7a0P31SEq2ueqX7qPgr93ZyJlLZzXYvJerXUiz39y1vOR99k4bFby2qj6QdRCCEVaBtWVWCk4eJrRXupCKfC2ng89qsd2s4AeGQeyAhA3UWrjWOACGRBiP5Pre65PFd5fXbSKudaPdcccoVxIPfYGrZNFyUMWQKyYTgkes3lr2UcQgUnPg9n6k2H-ZtxqR5G8BA09NkehuJswiQi3ek19139T_F8VZOop9vgOfyqiYDQgxpg8W3NEFsjTQzBbwi1eANULljYZekCO6zR3JZm5zWRszo2z3GsU23jLu8JcoH0OemxvyOciYTqZH1sLKkjIjZ1qB742Sg0xsmTPlcsyacHTkFVIqg5_tY95X3gDclCBflLPIrSQ5ekOmWZWNPpEmC8YcE-QPcTd595sPh20vblfa6ttDz6o_zwSzBsP6Kft5gDgB4SNGYz59PyFYlKkze2N4qC_x0FU3CW3heFngZyWjq0t2W1wCqKRhvfS9-Bs7WpzUlwleLsWmEEKhLDsg69UyKwfx7QPzCtK0UJjwi9PjGxPVWKAuwG7lkDKoCEa0qHOWloH1IpXEy0UlcKiqOTiFA7ZbZOck6xegFAfALD4WZyRzs9vByAUT2IWLAKA0HEmqO359cczLSl&sai=AMfl-YRC_8rq4s6eF2G1WdkZSAZGyfwRu15YZ_BTEeqGwkI74v0bEDTzeM8qowL6fDUzkv7ieJqZhv1X95jr8VvMf8DLVg1xzHgxon0MtGqdDLuFz2C7jKwW5IlPmXrvjBYw6WJk_4PSwz917WQWRufMXvqUsiyE52UJTR1a3bw&sig=Cg0ArKJSzF_08oVk_5gbEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=134&cbvp=1&cstd=128&cisv=r20210728.62941&adurl=

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Fri, 30 Jul 2021 01:34:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H2 200 tinyurl.com Show response
e.deployads.com/e/ 2 B
126 B 52ms
51ms XHR
text/plain 18.202.37.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://e.deployads.com/e/tinyurl.com
Requested by: Host: tags-cdn.deployads.com
URL: https://tags-cdn.deployads.com/a/tinyurl.com.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.37.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-37-41.eu-west-1.compute.amazonaws.com
Software: Jetty(7.6.12.v20130726) /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Fri, 30 Jul 2021 01:34:04 GMT
server: Jetty(7.6.12.v20130726)
content-length: 2
content-type: text/plain;charset=UTF-8

GET
H/1.1

200
OK

request.php Show response
hal900028.redintelligence.net/ Frame 4A12
Redirect Chain

https://hal900028.redintelligence.net/request.php?zone=aoap14h2vy87&nw=20&renderingType=javascript&namespace=e9d27b437a&subid=&uid=ef4fb6c89124c5a6&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900028.redintelligence.net/request.php?zone=aoap14h2vy87&nw=20&renderingType=javascript&namespace=e9d27b437a&subid=&uid=ef4fb6c89124c5a6&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

613 B
937 B

155ms
90ms

Script
application/x-javascript

88.99.165.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900028.redintelligence.net/request.php?zone=aoap14h2vy87&nw=20&renderingType=javascript&namespace=e9d27b437a&subid=&uid=ef4fb6c89124c5a6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=160x600&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCetDzDFcDYbiMCrKR7_UPtdOHgA3ktKqDV7jDyMepCvAuEAEgvKXMIWD1lc6B4ATIAQmpAqfa7SnD8bM-qAMBqgTKAU_QCS3ZRKd5KoTrm-msyl8DyJ9Pl8lN-67k1qrGCfo3kPc6SlygihfLdiwxVK-kztig-prhpVLp1bCS4U8Y6dhNDHC2s2mDUIvl92fQmqLFKZCGqect7uja6mjysMGp6RdOUalTtM2peqEwSDUS0mTPkWl-tCf7-tdkfrXNRzgHDP9C8-3WGDx77aq0Y83yRpGcVhF7hXx9inFKa-PC9pOpLv7S8ndx4r1w6NYPPjHGI4GxZQWrUVCgaJvPX9DQcBkFv3ZHc5F9gb7ABOWU39HOAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAtgHANIIBwiIYRABGB3yCBthZHgtc3Vic3luLTQ3Mjc1MDM2MTIxMjM2NjmACgOYCwHICwGADAGwE4XAtQrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoJx0Xiybp-F0OgLxGLPWwfIpBpw%26sig%3DAOD64_13-DuMLqShYCDKMs1q3XfzjNlKxQ%26client%3Dca-pub-3153065230153281%26dbm_c%3DAKAmf-BzGL5YL2d29mUzFSwafcwlIGnC5C0gv8FPKB6SRLdhUu2SEaIoWxUXF6N2-WU2hPI7tMLkJ1GNqIkiDxiB7IOKHFVlccr49_LzrE_ItHMa2bYquWmddlBY7nZXYMLXQwIn3t_HtAisdlktxw0V0hhddMBtVg%26cry%3D1%26dbm_d%3DAKAmf-Ahi_KHlk7LrJC89b8871caNBgg_PQDsL8QAWCr-BOGK3HaVaACdBb7HA6hLxzkasXjYg4nHNEeAjMpdkeRjJlqP6unI3My2T9oqK3xLeM8RIZjE2Gc0pgXP5MVAFd6zre-BrGC-XaylvgumD5JrbcSNiIizNjODDhYpxLaasiOV-cPlrxeqfr6lRJ0rjajvT6rYnm46AQHyFTHlwAWSl7J6bChoa7xdY9Tdef1G8R4WLK6Yi_TfSvRJ7HqMSB-0a3QuuXshHVknkVYHuQKuO8e73Iyusf8yiE0RF2Fi3px8CWbritJeMp7mHf-myE9HZ-HZ0cDGSezJUIniLzJEuUI_dKcUvXoeDI_m6fsMwmt4u3D-oA6dTcHaawEv8uhUg_yZrJDDND57aCc_a3m5o3IKfkLYxbm--7gXtvTRpEXpTsLpIQ-61-w494X_D-klUw0aopq%26adurl%3D&documentReferer=https%3A%2F%2Ftinyurl.com%2F&ancestorOrigins=https%3A%2F%2Ftinyurl.com&random=8021522806443&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.165.19 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.19.165.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 86636d807c6a83978c2a5949461170b44c4f9ca5755cbc03b22ef01aaf427b07

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:05 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 17118100009323200710158011671028
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 331
Expires: Fri, 30 Jul 2021 02:34:05 +0200

Redirect headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:04 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=aoap14h2vy87&nw=20&renderingType=javascript&namespace=e9d27b437a&subid=&uid=ef4fb6c89124c5a6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=160x600&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCetDzDFcDYbiMCrKR7_UPtdOHgA3ktKqDV7jDyMepCvAuEAEgvKXMIWD1lc6B4ATIAQmpAqfa7SnD8bM-qAMBqgTKAU_QCS3ZRKd5KoTrm-msyl8DyJ9Pl8lN-67k1qrGCfo3kPc6SlygihfLdiwxVK-kztig-prhpVLp1bCS4U8Y6dhNDHC2s2mDUIvl92fQmqLFKZCGqect7uja6mjysMGp6RdOUalTtM2peqEwSDUS0mTPkWl-tCf7-tdkfrXNRzgHDP9C8-3WGDx77aq0Y83yRpGcVhF7hXx9inFKa-PC9pOpLv7S8ndx4r1w6NYPPjHGI4GxZQWrUVCgaJvPX9DQcBkFv3ZHc5F9gb7ABOWU39HOAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAtgHANIIBwiIYRABGB3yCBthZHgtc3Vic3luLTQ3Mjc1MDM2MTIxMjM2NjmACgOYCwHICwGADAGwE4XAtQrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoJx0Xiybp-F0OgLxGLPWwfIpBpw%26sig%3DAOD64_13-DuMLqShYCDKMs1q3XfzjNlKxQ%26client%3Dca-pub-3153065230153281%26dbm_c%3DAKAmf-BzGL5YL2d29mUzFSwafcwlIGnC5C0gv8FPKB6SRLdhUu2SEaIoWxUXF6N2-WU2hPI7tMLkJ1GNqIkiDxiB7IOKHFVlccr49_LzrE_ItHMa2bYquWmddlBY7nZXYMLXQwIn3t_HtAisdlktxw0V0hhddMBtVg%26cry%3D1%26dbm_d%3DAKAmf-Ahi_KHlk7LrJC89b8871caNBgg_PQDsL8QAWCr-BOGK3HaVaACdBb7HA6hLxzkasXjYg4nHNEeAjMpdkeRjJlqP6unI3My2T9oqK3xLeM8RIZjE2Gc0pgXP5MVAFd6zre-BrGC-XaylvgumD5JrbcSNiIizNjODDhYpxLaasiOV-cPlrxeqfr6lRJ0rjajvT6rYnm46AQHyFTHlwAWSl7J6bChoa7xdY9Tdef1G8R4WLK6Yi_TfSvRJ7HqMSB-0a3QuuXshHVknkVYHuQKuO8e73Iyusf8yiE0RF2Fi3px8CWbritJeMp7mHf-myE9HZ-HZ0cDGSezJUIniLzJEuUI_dKcUvXoeDI_m6fsMwmt4u3D-oA6dTcHaawEv8uhUg_yZrJDDND57aCc_a3m5o3IKfkLYxbm--7gXtvTRpEXpTsLpIQ-61-w494X_D-klUw0aopq%26adurl%3D&documentReferer=https%3A%2F%2Ftinyurl.com%2F&ancestorOrigins=https%3A%2F%2Ftinyurl.com&random=8021522806443&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Fri, 30 Jul 2021 02:34:04 +0200

GET
H/1.1

200
OK

request.php Show response
hal90007.redintelligence.net/ Frame 4368
Redirect Chain

https://hal90007.redintelligence.net/request.php?zone=jaca9pdc7b7l&nw=20&renderingType=javascript&namespace=9f3502357f&subid=&uid=432259e75935736b&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90007.redintelligence.net/request.php?zone=jaca9pdc7b7l&nw=20&renderingType=javascript&namespace=9f3502357f&subid=&uid=432259e75935736b&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

610 B
933 B

124ms
81ms

Script
application/x-javascript

138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/request.php?zone=jaca9pdc7b7l&nw=20&renderingType=javascript&namespace=9f3502357f&subid=&uid=432259e75935736b&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCofcDFcDYbmMCrKR7_UPtdOHgA3ktKqDV5fKqP-uB_AuEAEgvKXMIWD1lc6B4ATIAQmpAqfa7SnD8bM-qAMBqgTMAU_Q-PuAszgE1k_yXF7bWPgDq_q4p7xAXE5bn3POCVlaIueVvfLV6fHP7PcPCpNn0z7XTJ6sD3vheduY-xKgFLEy82iwG6DHmSAJeaDe6PrlQKwg3h8EmMwOe9vrezAlp7yc0rtmxe8VtVUtn3gbKDatydCTKUkbEq4Dl69rlI58xjii9-yHiOeTaiECvi8SFxbBZxxMYxV7fKg57r05oTHawUwf9Qb4_xjsiXPNoRBQHet7ZSAOnec9ohlhRwrKCKKiJ3E6eVFrMQclHsAE5ZTf0c4B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgbqAeqm7EC2AcA0ggHCIhhEAEYHfIIG2FkeC1zdWJzeW4tNDcyNzUwMzYxMjEyMzY2OYAKA5gLAcgLAYAMAbAThcC1CtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRo3G7JFp2q0_IOU-eIQ1qqgsT4oA%26sig%3DAOD64_2iNmcjA2DfvRkXgHBjhznI1HXHWA%26client%3Dca-pub-3153065230153281%26dbm_c%3DAKAmf-DfdVhVoPvaBksetNWT7SwQz88E5dmqLPRjl1eFVTAawzeaUH3HOgz3ogUi7ke2Zu2gXzRu3-c71kmy7VaY7XFPpxLJt4o35ki-jwyBHLLUpE02MGbVkhHgpv8RDzuoG7Xljz6fQPegzLV05HfjeVYA5FHDgw%26cry%3D1%26dbm_d%3DAKAmf-CZV346R9Ujoawmi1N9aveE786Engyz1CC8GhsqXgu2i4jUwxZFzgFnAAwzb9bmbHbrc_3_zFTiiLrxYjNciq-bzobBTBWzNR7Zbpltg9koq57VvG2-aDDRuF2-ctvQlqjV2QxcPryk5FpA-Xg8rrtZxqGBrLPTXU-hbQqwE9q1HeWwhWul4gf0vcDnh9pWB2kYW2gfIM8W1kRxppMs3f5NElZMGrmPhuJniZkcraSNT6dhISHDGSv2hLsYkpXzmQ5-wbcC2JzRkENIQKr-4Ht_Iut20VjcdWeaNCAZTtUIT1-xwqFWPOtJ2TOb2DOPRHV7vPNLkryC4q_e-JI_yIWEL3S9TZpNVUn7lVoqpTPWE0N2P_2n4dnuNqc5-FGbx0txkOBxd_f1ZObtLyPtIJvkCUgNnaLhBvr9a_Ujt4WDuTDJA9oHsYS498k8F8-iTrCcAj1k%26adurl%3D&documentReferer=https%3A%2F%2Ftinyurl.com%2F&ancestorOrigins=https%3A%2F%2Ftinyurl.com&random=2953757787867&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a9f0751d98f2074417f1d6142c4cffefa40e2c837f83cd02a2245322c9d1462c

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:05 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 88258200008334600710152011671007
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 327
Expires: Fri, 30 Jul 2021 02:34:05 +0200

Redirect headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:04 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=jaca9pdc7b7l&nw=20&renderingType=javascript&namespace=9f3502357f&subid=&uid=432259e75935736b&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCofcDFcDYbmMCrKR7_UPtdOHgA3ktKqDV5fKqP-uB_AuEAEgvKXMIWD1lc6B4ATIAQmpAqfa7SnD8bM-qAMBqgTMAU_Q-PuAszgE1k_yXF7bWPgDq_q4p7xAXE5bn3POCVlaIueVvfLV6fHP7PcPCpNn0z7XTJ6sD3vheduY-xKgFLEy82iwG6DHmSAJeaDe6PrlQKwg3h8EmMwOe9vrezAlp7yc0rtmxe8VtVUtn3gbKDatydCTKUkbEq4Dl69rlI58xjii9-yHiOeTaiECvi8SFxbBZxxMYxV7fKg57r05oTHawUwf9Qb4_xjsiXPNoRBQHet7ZSAOnec9ohlhRwrKCKKiJ3E6eVFrMQclHsAE5ZTf0c4B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgbqAeqm7EC2AcA0ggHCIhhEAEYHfIIG2FkeC1zdWJzeW4tNDcyNzUwMzYxMjEyMzY2OYAKA5gLAcgLAYAMAbAThcC1CtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRo3G7JFp2q0_IOU-eIQ1qqgsT4oA%26sig%3DAOD64_2iNmcjA2DfvRkXgHBjhznI1HXHWA%26client%3Dca-pub-3153065230153281%26dbm_c%3DAKAmf-DfdVhVoPvaBksetNWT7SwQz88E5dmqLPRjl1eFVTAawzeaUH3HOgz3ogUi7ke2Zu2gXzRu3-c71kmy7VaY7XFPpxLJt4o35ki-jwyBHLLUpE02MGbVkhHgpv8RDzuoG7Xljz6fQPegzLV05HfjeVYA5FHDgw%26cry%3D1%26dbm_d%3DAKAmf-CZV346R9Ujoawmi1N9aveE786Engyz1CC8GhsqXgu2i4jUwxZFzgFnAAwzb9bmbHbrc_3_zFTiiLrxYjNciq-bzobBTBWzNR7Zbpltg9koq57VvG2-aDDRuF2-ctvQlqjV2QxcPryk5FpA-Xg8rrtZxqGBrLPTXU-hbQqwE9q1HeWwhWul4gf0vcDnh9pWB2kYW2gfIM8W1kRxppMs3f5NElZMGrmPhuJniZkcraSNT6dhISHDGSv2hLsYkpXzmQ5-wbcC2JzRkENIQKr-4Ht_Iut20VjcdWeaNCAZTtUIT1-xwqFWPOtJ2TOb2DOPRHV7vPNLkryC4q_e-JI_yIWEL3S9TZpNVUn7lVoqpTPWE0N2P_2n4dnuNqc5-FGbx0txkOBxd_f1ZObtLyPtIJvkCUgNnaLhBvr9a_Ujt4WDuTDJA9oHsYS498k8F8-iTrCcAj1k%26adurl%3D&documentReferer=https%3A%2F%2Ftinyurl.com%2F&ancestorOrigins=https%3A%2F%2Ftinyurl.com&random=2953757787867&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Fri, 30 Jul 2021 02:34:04 +0200

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 09DE 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 27 Jul 2021 10:46:08 GMT
expires: Wed, 27 Jul 2022 10:46:08 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 226076
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame DFB2 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 18:46:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 197242
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 27 Jul 2022 18:46:42 GMT

GET
H3-29 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame 65A7 35 KB
13 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 18:46:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 197242
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 27 Jul 2022 18:46:42 GMT

GET
H3-29 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame 97C6 35 KB
13 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 18:46:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 197242
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 27 Jul 2022 18:46:42 GMT

GET
H3-29 200 gwdpage_style.css
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 55 B
101 B 7ms
7ms Stylesheet
text/css 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwdpage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 01:01:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 261144
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 01:01:40 GMT

GET
H3-29 200 gwdpagedeck_style.css
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 731 B
261 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwdpagedeck_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:04:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 271760
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 22:04:44 GMT

GET
H3-29 200 gwdgooglead_style.css
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 24 B
70 B 27ms
9ms Stylesheet
text/css 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwdgooglead_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 06:13:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242433
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 06:13:31 GMT

GET
H3-29 200 gwdtaparea_style.css
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 157 B
142 B 26ms
8ms Stylesheet
text/css 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwdtaparea_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 03:56:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 250672
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 115
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 03:56:12 GMT

GET
H3-29 200 gwdimage_style.css
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 281 B
185 B 37ms
19ms Stylesheet
text/css 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwdimage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d3251d937d209def48e958bfeec683ca39dc0f15eb22f99bc3e7035995cd552

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 23:11:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 267762
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 158
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 23:11:22 GMT

GET
H3-29 200 gwdvideo_style.css
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 388 B
206 B 36ms
18ms Stylesheet
text/css 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwdvideo_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e66fb907a79a93d3c9813f2f348b42bd1bf6f3bf140331fe57bc7cc30a816246

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 04:46:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 247641
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 179
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 04:46:43 GMT

GET
H3-29 200 googbase_min.js Show response
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 247 B
223 B 38ms
20ms Script
application/x-javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/googbase_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

503621190c75700c18c84fd3ec0977bf31b083d66e331d1009bb9cd17cdb85da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 06:54:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 239981
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 196
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 06:54:23 GMT

GET
H3-29 200 gwd_webcomponents_v1_min.js Show response
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 21 KB
6 KB 37ms
19ms Script
application/x-javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwd_webcomponents_v1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c51a4086e332a8b351790a53582dbba5bd78b7a1f021b829d93da3ad59ca575f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 05:44:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 244200
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6286
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 05:44:04 GMT

GET
H3-29 200 gwdpage_min.js Show response
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 3 KB
1 KB 36ms
18ms Script
application/x-javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwdpage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

257c9947bb8a45c4a0519f4ddc8769ecc7f889e268a046b0f05c17dfc7912eee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 04:46:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 247641
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1306
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 04:46:43 GMT

GET
H3-29 200 gwdpagedeck_min.js Show response
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 8 KB
3 KB 41ms
21ms Script
application/x-javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwdpagedeck_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07b9621ff6886bdda3fbafc4d21319eab9a92a7922d38bacca72f5679249ac32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 21:11:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 274958
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3145
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 21:11:26 GMT

GET
H3-29 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame 7C54 110 KB
38 KB 40ms
21ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 14:30:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39786
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 30 Jul 2021 14:30:58 GMT

GET
H3-29 200 gwdgooglead_min.js Show response
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 13 KB
4 KB 40ms
21ms Script
application/x-javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwdgooglead_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ac5c3a1604eb19f5c47e157ea3b58b4297428e653b74d6def6b41661a25eb5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 21:11:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 274958
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4332
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 21:11:26 GMT

GET
H3-29 200 gwdtaparea_min.js Show response
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 4 KB
2 KB 39ms
20ms Script
application/x-javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwdtaparea_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e99c54c8d777d1b291f68296ac99fe0c7b8f51153eb7b36b1a88b4783bfd2bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 01:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 260268
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1746
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 01:16:16 GMT

GET
H3-29 200 gwdparallax_min.js Show response
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 8 KB
3 KB 38ms
20ms Script
application/x-javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwdparallax_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a45792c7db4934ab03ec970a8c0ba92d5b85e5af4482112dc9727fe94197250

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 12:29:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 219862
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3436
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 12:29:42 GMT

GET
H3-29 200 gwdvideo_min.js Show response
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 9 KB
3 KB 37ms
19ms Script
application/x-javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwdvideo_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

249f537d8e7349dab5ab2e541e485351315526451ae2e8979422f33a215307c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 04:54:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 247170
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3083
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 04:54:34 GMT

GET
H3-29 200 gwd-events-support.1.0.js Show response
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 2 KB
721 B 47ms
30ms Script
application/x-javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/gwd-events-support.1.0.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

72a80770f582b1bb93c4686c2d8f7d96cd6e911198e518ba3f19cd50cb108804

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 23:53:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 351608
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 687
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 Jul 2022 23:53:56 GMT

GET
H3-29 200 mig_gwd-events-support.1.0.js Show response
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 4 KB
1 KB 39ms
21ms Script
application/x-javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/mig_gwd-events-support.1.0.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de0026beacb0fa66759930355e717fe89078974692859c2aeea06f11b64c1de0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 04:46:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 247641
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1039
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 04:46:43 GMT

GET
H3-29 200 mig_gwd-id.js Show response
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 3 KB
1 KB 39ms
20ms Script
application/x-javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/mig_gwd-id.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a48949e222f4d06fa2b976a5a69eeaca967c0c0579e10c43104c04bc4f46bba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 09:49:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 229486
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1044
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 09:49:18 GMT

GET
H3-29 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 7C54 60 KB
24 KB 36ms
28ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 30 Jul 2021 01:34:04 GMT

GET
H3-29 200 easepack_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 7C54 2 KB
1 KB 34ms
30ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/easepack_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b4fe6e33e24427ff09805210219fe3cc19e22ed637e003efeea9131ecbd9121

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1356
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:22:46 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 30 Jul 2021 01:34:04 GMT

GET
H3-29 200 main.js Show response
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 43 KB
9 KB 32ms
27ms Script
application/x-javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c994c4f85325aad2b7aa5889dece3e6857d152802041896fda849e9e4373367a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 01:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 260268
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9371
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 01:16:16 GMT

GET
H2 200 container.html Show response
95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F723 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Fri, 30 Jul 2021 01:34:04 GMT
expires: Sat, 30 Jul 2022 01:34:04 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame 09DE 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 18:46:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 197242
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 27 Jul 2022 18:46:42 GMT

GET
H3-29 200 video_placeholder.jpg
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 3 KB
3 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/video_placeholder.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b354b27eaa1d96d60682f3b62da4e53e0f3516bd6a9bae5ec9e16b77952cc246

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 08:34:29 GMT
x-content-type-options: nosniff
age: 233975
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3529
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 08:34:29 GMT

GET
H3-29 200 bg.jpg
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 5 KB
5 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/bg.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7f4f7b899801a18ae0e670c0263e75efb66bdd53ebd05442bdaaf0e11206b843

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 01:16:16 GMT
x-content-type-options: nosniff
age: 260268
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5525
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 01:16:16 GMT

GET
H3-29 200 slide_4.jpg
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 32 KB
32 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/slide_4.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8b410cc9e62780bd5ebc7e8c9a1e19652c923a61c048d4b345b81eaf3fab2129

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 01:16:17 GMT
x-content-type-options: nosniff
age: 260267
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32849
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 01:16:17 GMT

GET
H3-29 200 slide_3.jpg
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 28 KB
29 KB 11ms
10ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/slide_3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bda642c3efe6cdb87ff3ecbdcf60d8c23e6ec13345f13c4cadb352f3f8e74811

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 06:20:27 GMT
x-content-type-options: nosniff
age: 242017
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29168
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 06:20:27 GMT

GET
H3-29 200 slide_2.jpg
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 31 KB
31 KB 9ms
8ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/slide_2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95551f64bac49033db55bf41c01e654bd90751d4a7093f8872263ad3e2b025d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 07:07:39 GMT
x-content-type-options: nosniff
age: 239185
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31243
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 07:07:39 GMT

GET
H3-29 200 btn_replay.png
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 1 KB
1 KB 12ms
9ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/btn_replay.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c43bfe09464c1287a10d59bff6b65d6c092fa46a0c934658b7356d887d83298f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 05:00:28 GMT
x-content-type-options: nosniff
age: 246816
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1452
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 05:00:28 GMT

GET
H3-29 200 btn_sound_on.png
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 1 KB
1 KB 9ms
6ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/btn_sound_on.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

866f08b17d3165c38575d30b589f1618a808b84cce697fdc1e0853f0818d6fb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 09:49:19 GMT
x-content-type-options: nosniff
age: 229485
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1429
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 09:49:19 GMT

GET
H3-29 200 btn_sound_off.png
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 1 KB
1 KB 10ms
7ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/btn_sound_off.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

47eacf324dce72bfde7a7da80d1132b0b722da49d9f0b17110d045b9c7924a12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 01:16:16 GMT
x-content-type-options: nosniff
age: 260268
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1432
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 01:16:16 GMT

GET
H3-29 200 btn_play.png
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 1 KB
1 KB 13ms
10ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/btn_play.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c9d0c8e2322a1e361ba0fab1e225b26d727680a55cd6a659a3d0b483533d4e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 07:24:14 GMT
x-content-type-options: nosniff
age: 238190
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1162
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 07:24:14 GMT

GET
H3-29 200 btn_pause.png
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 823 B
854 B 12ms
9ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/btn_pause.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e87a1822ffd837074c51af3fb1616f487371da697775a99473d9443125358595

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 03:56:13 GMT
x-content-type-options: nosniff
age: 250671
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 823
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 03:56:13 GMT

GET
H3-29 200 btn_play_big.png
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 4 KB
4 KB 11ms
8ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/btn_play_big.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e6d129416f5f78de3ff4d93837e7f7e3fde5b613306a9305b1ba9667b91f290

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 19:33:54 GMT
x-content-type-options: nosniff
age: 280810
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3705
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 19:33:54 GMT

GET
H3-29 200 sprite_video_elements_retina.png
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 131 KB
131 KB 15ms
12ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/sprite_video_elements_retina.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dab251f7a51a105d4e6bc06fcd39e6fcbacba67c65e9595c5e2c52584914220f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 00:50:02 GMT
x-content-type-options: nosniff
age: 261842
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133636
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 00:50:02 GMT

GET
H3-29 200 btn.png
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 6 KB
6 KB 15ms
12ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/btn.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef955d1a0f4c13d28546a8d19b33e51763c1914a1ee3fcdff33da54e68f5dcc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 01:16:16 GMT
x-content-type-options: nosniff
age: 260268
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6213
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 01:16:16 GMT

GET
H3-29 200 btn_prev.png
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 1 KB
1 KB 15ms
12ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/btn_prev.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8b4643db16628165fda3b9356b61347d7fd8a871d93769d1ce4c5eb82012995a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 21:11:26 GMT
x-content-type-options: nosniff
age: 274958
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1088
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 21:11:26 GMT

GET
H3-29 200 btn_next.png
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 1 KB
1 KB 14ms
11ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/btn_next.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7a6bce57e9eb3cf51aa53bd7b58e8b58657733346f099fd26d173c996937a98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 04:06:51 GMT
x-content-type-options: nosniff
age: 250033
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1091
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 04:06:51 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame F723 4 KB
713 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 30 Jul 2021 00:46:21 GMT
server: ESF
date: Fri, 30 Jul 2021 01:34:05 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 30 Jul 2021 01:34:05 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame F723 4 KB
690 B 51ms
50ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 30 Jul 2021 00:42:20 GMT
server: ESF
date: Fri, 30 Jul 2021 01:34:05 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 30 Jul 2021 01:34:05 GMT

GET
H3-29 200 m_js_controller_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/ Frame F723 31 KB
12 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/m_js_controller_fy2019.js

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

56e15c9e3542a7457433e608f6180bf8877083db9c231bcfb137aa4a14fb1b53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:07:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1611
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12641
x-xss-protection: 0
server: cafe
etag: 13371490116692223486
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Aug 2021 01:07:14 GMT

GET
H3-29 200 40933678460698624
tpc.googlesyndication.com/simgad/ Frame F723 1 KB
755 B 7ms
6ms Image
image/svg+xml 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/40933678460698624

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09fba596f1ba572cf4b3ceb9c1f3962d1b75bbb4a6d6d7707f1f93e2fe889aee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 00:50:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 261790
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 728
x-xss-protection: 0
last-modified: Thu, 26 Oct 2017 18:18:20 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 00:50:55 GMT

GET
H3-29 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame F723 22 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 14:52:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38469
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Jul 2022 14:52:56 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/ Frame F723 2 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/window_focus_fy2019.js

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:27:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 386
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Aug 2021 01:27:39 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F723 124 KB
37 KB 26ms
25ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0964703aceadd0f8a443019b3d10e976a88d91cb124b39c0a9518b844e94ba8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:05 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627472092244076"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38161
x-xss-protection: 0
expires: Fri, 30 Jul 2021 01:34:05 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/ Frame F723 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210728/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d8a9aaecb7cd39329dcfad9a882ce0d174802ded027e150440484e097c73cb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:29:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 259
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 18081889583213459188
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Aug 2021 01:29:46 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame F723 0
0 14ms
13ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT1q33_C2hikJlcFKnuxB8xGMo9DLlrTKx0HeQWmU9zUfMyGdq-KMxtzNqTaMJxaivddf5FKUf5KWqd6wlnYrxWlcQErA
Requested by: Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame A7EC 0
23 B 55ms
29ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a2-16-186-155.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Fri, 30 Jul 2021 01:34:05 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H2 200 tinyurl.com Show response
e.deployads.com/e/ 2 B
126 B 54ms
54ms XHR
text/plain 18.202.37.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://e.deployads.com/e/tinyurl.com
Requested by: Host: tags-cdn.deployads.com
URL: https://tags-cdn.deployads.com/a/tinyurl.com.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.37.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-37-41.eu-west-1.compute.amazonaws.com
Software: Jetty(7.6.12.v20130726) /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Fri, 30 Jul 2021 01:34:05 GMT
server: Jetty(7.6.12.v20130726)
content-length: 2
content-type: text/plain;charset=UTF-8

GET
H/1.1 200
OK request_content.php Show response
hal90007.redintelligence.net/ Frame 6AD9 7 KB
3 KB 85ms
37ms Document
text/html 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/request_content.php?s=88258200008334600710152011671007&a=23be2e45
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=jaca9pdc7b7l&nw=20&renderingType=javascript&namespace=9f3502357f&subid=&uid=432259e75935736b&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCofcDFcDYbmMCrKR7_UPtdOHgA3ktKqDV5fKqP-uB_AuEAEgvKXMIWD1lc6B4ATIAQmpAqfa7SnD8bM-qAMBqgTMAU_Q-PuAszgE1k_yXF7bWPgDq_q4p7xAXE5bn3POCVlaIueVvfLV6fHP7PcPCpNn0z7XTJ6sD3vheduY-xKgFLEy82iwG6DHmSAJeaDe6PrlQKwg3h8EmMwOe9vrezAlp7yc0rtmxe8VtVUtn3gbKDatydCTKUkbEq4Dl69rlI58xjii9-yHiOeTaiECvi8SFxbBZxxMYxV7fKg57r05oTHawUwf9Qb4_xjsiXPNoRBQHet7ZSAOnec9ohlhRwrKCKKiJ3E6eVFrMQclHsAE5ZTf0c4B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgbqAeqm7EC2AcA0ggHCIhhEAEYHfIIG2FkeC1zdWJzeW4tNDcyNzUwMzYxMjEyMzY2OYAKA5gLAcgLAYAMAbAThcC1CtATANgTA4gUAdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRo3G7JFp2q0_IOU-eIQ1qqgsT4oA%26sig%3DAOD64_2iNmcjA2DfvRkXgHBjhznI1HXHWA%26client%3Dca-pub-3153065230153281%26dbm_c%3DAKAmf-DfdVhVoPvaBksetNWT7SwQz88E5dmqLPRjl1eFVTAawzeaUH3HOgz3ogUi7ke2Zu2gXzRu3-c71kmy7VaY7XFPpxLJt4o35ki-jwyBHLLUpE02MGbVkhHgpv8RDzuoG7Xljz6fQPegzLV05HfjeVYA5FHDgw%26cry%3D1%26dbm_d%3DAKAmf-CZV346R9Ujoawmi1N9aveE786Engyz1CC8GhsqXgu2i4jUwxZFzgFnAAwzb9bmbHbrc_3_zFTiiLrxYjNciq-bzobBTBWzNR7Zbpltg9koq57VvG2-aDDRuF2-ctvQlqjV2QxcPryk5FpA-Xg8rrtZxqGBrLPTXU-hbQqwE9q1HeWwhWul4gf0vcDnh9pWB2kYW2gfIM8W1kRxppMs3f5NElZMGrmPhuJniZkcraSNT6dhISHDGSv2hLsYkpXzmQ5-wbcC2JzRkENIQKr-4Ht_Iut20VjcdWeaNCAZTtUIT1-xwqFWPOtJ2TOb2DOPRHV7vPNLkryC4q_e-JI_yIWEL3S9TZpNVUn7lVoqpTPWE0N2P_2n4dnuNqc5-FGbx0txkOBxd_f1ZObtLyPtIJvkCUgNnaLhBvr9a_Ujt4WDuTDJA9oHsYS498k8F8-iTrCcAj1k%26adurl%3D&documentReferer=https%3A%2F%2Ftinyurl.com%2F&ancestorOrigins=https%3A%2F%2Ftinyurl.com&random=2953757787867&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 63c8977cc984033133ccc8577ced42386fa78e33a5cc007b33dfa1977424ca55

Request headers

Host: hal90007.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=7a34876d36f9b671
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/

Response headers

Date: Fri, 30 Jul 2021 01:34:05 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Fri, 30 Jul 2021 02:34:05 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2307
Connection: close
Content-Type: text/html; charset=utf-8

GET
DATA 200
OK truncated
/ Frame 4368 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0b31839eef006c0ec5a8f6265f058bc948c4de9870f4f0ca74388c346d9e8f5a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 7C54 5 KB
4 KB 47ms
33ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1ec07a459ed783373e7fb0db26e0c3eef8bc2fd82929f45acfe448d3736d7933

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Jul 2021 01:34:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4266
x-xss-protection: 0

GET
H3-29 200 video_placeholder.jpg
s0.2mdn.net/sadbundle/17983571879200222662/ Frame 7C54 3 KB
3 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17983571879200222662/video_placeholder.jpg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b354b27eaa1d96d60682f3b62da4e53e0f3516bd6a9bae5ec9e16b77952cc246

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 08:34:29 GMT
x-content-type-options: nosniff
age: 233976
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3529
x-xss-protection: 0
last-modified: Mon, 08 Mar 2021 14:19:04 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 08:34:29 GMT

GET
H/1.1 200
OK request_content.php Show response
hal900028.redintelligence.net/ Frame B6B8 4 KB
2 KB 98ms
33ms Document
text/html 88.99.165.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900028.redintelligence.net/request_content.php?s=17118100009323200710158011671028&a=e65b5977
Requested by: Host: hal900028.redintelligence.net
URL: https://hal900028.redintelligence.net/request.php?zone=aoap14h2vy87&nw=20&renderingType=javascript&namespace=e9d27b437a&subid=&uid=ef4fb6c89124c5a6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=160x600&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCetDzDFcDYbiMCrKR7_UPtdOHgA3ktKqDV7jDyMepCvAuEAEgvKXMIWD1lc6B4ATIAQmpAqfa7SnD8bM-qAMBqgTKAU_QCS3ZRKd5KoTrm-msyl8DyJ9Pl8lN-67k1qrGCfo3kPc6SlygihfLdiwxVK-kztig-prhpVLp1bCS4U8Y6dhNDHC2s2mDUIvl92fQmqLFKZCGqect7uja6mjysMGp6RdOUalTtM2peqEwSDUS0mTPkWl-tCf7-tdkfrXNRzgHDP9C8-3WGDx77aq0Y83yRpGcVhF7hXx9inFKa-PC9pOpLv7S8ndx4r1w6NYPPjHGI4GxZQWrUVCgaJvPX9DQcBkFv3ZHc5F9gb7ABOWU39HOAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG6gHqpuxAtgHANIIBwiIYRABGB3yCBthZHgtc3Vic3luLTQ3Mjc1MDM2MTIxMjM2NjmACgOYCwHICwGADAGwE4XAtQrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoJx0Xiybp-F0OgLxGLPWwfIpBpw%26sig%3DAOD64_13-DuMLqShYCDKMs1q3XfzjNlKxQ%26client%3Dca-pub-3153065230153281%26dbm_c%3DAKAmf-BzGL5YL2d29mUzFSwafcwlIGnC5C0gv8FPKB6SRLdhUu2SEaIoWxUXF6N2-WU2hPI7tMLkJ1GNqIkiDxiB7IOKHFVlccr49_LzrE_ItHMa2bYquWmddlBY7nZXYMLXQwIn3t_HtAisdlktxw0V0hhddMBtVg%26cry%3D1%26dbm_d%3DAKAmf-Ahi_KHlk7LrJC89b8871caNBgg_PQDsL8QAWCr-BOGK3HaVaACdBb7HA6hLxzkasXjYg4nHNEeAjMpdkeRjJlqP6unI3My2T9oqK3xLeM8RIZjE2Gc0pgXP5MVAFd6zre-BrGC-XaylvgumD5JrbcSNiIizNjODDhYpxLaasiOV-cPlrxeqfr6lRJ0rjajvT6rYnm46AQHyFTHlwAWSl7J6bChoa7xdY9Tdef1G8R4WLK6Yi_TfSvRJ7HqMSB-0a3QuuXshHVknkVYHuQKuO8e73Iyusf8yiE0RF2Fi3px8CWbritJeMp7mHf-myE9HZ-HZ0cDGSezJUIniLzJEuUI_dKcUvXoeDI_m6fsMwmt4u3D-oA6dTcHaawEv8uhUg_yZrJDDND57aCc_a3m5o3IKfkLYxbm--7gXtvTRpEXpTsLpIQ-61-w494X_D-klUw0aopq%26adurl%3D&documentReferer=https%3A%2F%2Ftinyurl.com%2F&ancestorOrigins=https%3A%2F%2Ftinyurl.com&random=8021522806443&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.165.19 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.19.165.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 19941cf9cd8ebbb4014d723d782c3032cd987f69c2590c7b5eb2d06fdc78945a

Request headers

Host: hal900028.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=7a34876d36f9b671
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/

Response headers

Date: Fri, 30 Jul 2021 01:34:05 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Fri, 30 Jul 2021 02:34:05 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1538
Connection: close
Content-Type: text/html; charset=utf-8

GET
DATA 200
OK truncated
/ Frame 4A12 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eaf4b9c1ca96fd1585dc2dfb93ffd53c0e43de8703299f3a95ed6971885a2820

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 prod_studio_01_245_videomodule.js Show response
s0.2mdn.net/879366/ Frame 7C54 13 KB
5 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/prod_studio_01_245_videomodule.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

236888a9bde0a1cabbd288498b6ba4fb3f4ec7119d2d06666a5a48a82f51f042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17983571879200222662/index.html?e=69&leftOffset=0&topOffset=0&c=51LGrAjNUc&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 03:35:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79105
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4849
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 30 Jul 2021 03:35:40 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 7C54 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Fri, 30 Jul 2021 01:34:05 GMT

GET
H/1.1

206
Partial Content

file.webm
r3---sn-4g5ednek.c.2mdn.net/videoplayback/id/4f81951dad557d2b/itag/43/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3759661297/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,... Frame 7C54
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/4f81951dad557d2b/itag/43/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3759661297/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/signat...
https://r3---sn-4g5ednek.c.2mdn.net/videoplayback/id/4f81951dad557d2b/itag/43/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3759661297/sparams/acao,ctier,expire,id,ip,ipbits,itag...

596 KB
596 KB

33ms
6ms

Media
video/webm

2a00:1450:4001:53::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r3---sn-4g5ednek.c.2mdn.net/videoplayback/id/4f81951dad557d2b/itag/43/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3759661297/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/2C067D09E3EE2B61E2C5A10E4747EF958D895582.49BCFD155005502E91182ABE4BFE2A36248C44BB/key/cms1/cms_redirect/yes/mh/4T/mip/2a01:4f8:192:5414::2/mm/42/mn/sn-4g5ednek/ms/onc/mt/1627608268/mv/m/mvi/3/pl/52/file/file.webm

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:53::9 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

a7c3f2e51ceddded21be5176aae3de199e952ec9197941529c5a6ffb7cdf315f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 30 Jul 2021 01:34:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 08 Mar 2021 14:19:13 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/webm
Content-Range: bytes 0-609955/609956
Cache-Control: private, max-age=86400
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 609956
Expires: Fri, 30 Jul 2021 01:34:05 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:05 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r3---sn-4g5ednek.c.2mdn.net/videoplayback/id/4f81951dad557d2b/itag/43/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3759661297/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/2C067D09E3EE2B61E2C5A10E4747EF958D895582.49BCFD155005502E91182ABE4BFE2A36248C44BB/key/cms1/cms_redirect/yes/mh/4T/mip/2a01:4f8:192:5414::2/mm/42/mn/sn-4g5ednek/ms/onc/mt/1627608268/mv/m/mvi/3/pl/52/file/file.webm
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 650
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame F723 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame F723 0
0 55ms
55ms Fetch
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C5WkfDFcDYbyRJaqh7_UPmJyl6AyRrcW8XN3m7KbuAsCNtwEQASAAYPWVzoHgBIIBF2NhLXB1Yi0zMTUzMDY1MjMwMTUzMjgxyAEJqQJr41L443OFPuACAKgDAcgDAqoE6wFP0BCsfN1T_Yw1DffnUoHZcBqencGv60U5OLDi30Pc62btdA_aMDKbCAtS34H-ItOQudufzwvf1hkY77SeAzkt32KJB97W750ezQRdwxOxgnZtIIG-P-0VDscsmcWF9sknlDWpWjcZ99KD7P6OWhMdZUuufhreHywYcUUxlsgh7p20RC8h3Sopn3t11eXpjf_QiWx28BsRHm6ObMBVkNApmHLqosOo-0G9YNrwMVDDo9jbCnCUq2nzIhW5MWwfRcuQaMiiJk3-7hQwjrvWM9Wili3P7bLuXep_g-pxaJVSCXIdtUywYrj7da0j4AQBgAbG6J2jp6mEwrABoAYhqAemvhuoB_DZG6gH8tkbqAfs1RuoB5bYG6gHqpuxAtgHANIIBQiAYRAB8ggbYWR4LXN1YnN5bi00NzI3NTAzNjEyMTIzNjY5gAoD-gsCCAGADAHQFQGAFwGyFxgKFhIUcHViLTMxNTMwNjUyMzAxNTMyODE&sigh=iOdPrrTbmHA
Requested by: Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 /
track.adform.net/serving/event/ Frame F723 35 B
0 100ms
32ms Fetch
image/gif 37.157.3.28
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/serving/event/?bn=48266703&event=179&rtbdata=sE7aJDcJuehSyZUApr-fxXriiGtUBoNoYRenYG6braw3KF9OQ8YdHw6lzVbaIVSCjsYMF32zccl_FwTwMA6PjgelUWw-Y90HJlxZuu8LHHaWSDhQpxUa2FRIAVDUnmlIxhr9aV-juKCKjZRJl8rllZGyq0NWwx0eNhQiMFUFoP5sPk74S19XbexPlhoHsmqATW8USgtsbNeVvDXKvKKZ8s004uk8ZE6CoaWiyEmAAY2awRJrTP7XIy0o3aPKzugGQeEimShqzcc1

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.3.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:05 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
expires: -1

GET
H2 200 winnotice
track.adform.net/rtb/ Frame F723 0
0 100ms
32ms Fetch 37.157.3.28
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/rtb/winnotice?bn=48266703&winparams=ML43nxeiXQhxURYYTdNpB4p9HM83XWaiy2nYn4UiJoNxC31HnPXspgsptvGhoNX88SToQFloQbO8U7EuhrBf8VX0b5KNHciw286-tUrNWNyoy-4otgeXJ66ULKRXfpdmXEDQ0DWF9WL0bDtFsQztHPV6eYhim5Req_zo39m5-qiKRLIxjpcCXA3RNtldh-SOAxQGWIZ6DDPaAiH0xHiTJA2&rtbdata=sE7aJDcJuehSyZUApr-fxXriiGtUBoNoYRenYG6braw3KF9OQ8YdHw6lzVbaIVSCjsYMF32zccl_FwTwMA6PjgelUWw-Y90HJlxZuu8LHHaWSDhQpxUa2FRIAVDUnmlIxhr9aV-juKCKjZRJl8rllZGyq0NWwx0eNhQiMFUFoP5sPk74S19XbexPlhoHsmqATW8USgtsbNeVvDXKvKKZ8s004uk8ZE6CoaWiyEmAAY2awRJrTP7XIy0o3aPKzugGQeEimShqzcc1&rtbwp=YQNXDAAJSLwIu9CqAAlOGA_OfdiYNHTiFQCh6w&adfrnd=1017653804

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.3.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 30 Jul 2021 01:34:05 GMT
cache-control: private
server: nginx
content-length: 0
strict-transport-security: max-age=31536000; includeSubDomains
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame F723 0
0 55ms
55ms Fetch
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C5WkfDFcDYbyRJaqh7_UPmJyl6AyRrcW8XN3m7KbuAsCNtwEQASAAYPWVzoHgBIIBF2NhLXB1Yi0zMTUzMDY1MjMwMTUzMjgxyAEJqQJr41L443OFPuACAKgDAcgDAqoE6wFP0BCsfN1T_Yw1DffnUoHZcBqencGv60U5OLDi30Pc62btdA_aMDKbCAtS34H-ItOQudufzwvf1hkY77SeAzkt32KJB97W750ezQRdwxOxgnZtIIG-P-0VDscsmcWF9sknlDWpWjcZ99KD7P6OWhMdZUuufhreHywYcUUxlsgh7p20RC8h3Sopn3t11eXpjf_QiWx28BsRHm6ObMBVkNApmHLqosOo-0G9YNrwMVDDo9jbCnCUq2nzIhW5MWwfRcuQaMiiJk3-7hQwjrvWM9Wili3P7bLuXep_g-pxaJVSCXIdtUywYrj7da0j4AQBgAbG6J2jp6mEwrABoAYhqAemvhuoB_DZG6gH8tkbqAfs1RuoB5bYG6gHqpuxAtgHANIIBQiAYRAB8ggbYWR4LXN1YnN5bi00NzI3NTAzNjEyMTIzNjY5gAoD-gsCCAGADAHQFQGAFwGyFxgKFhIUcHViLTMxNTMwNjUyMzAxNTMyODE&sigh=iOdPrrTbmHA&vt=10
Requested by: Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7584 143 B
163 B 7ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUneryl9oWF-yotd6Y_60ltVYCfEpMncAocD-uT7Cz-LQwMzc2Llk99qZA4juUE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 30 Jul 2021 01:16:24 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1061
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C0D8 1 KB
749 B 8ms
6ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Thu, 29 Jul 2021 03:09:05 GMT
expires: Fri, 30 Jul 2021 03:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 80700
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK 9994008.jpg
s1.adform.net/Banners/Elements/Files/256124/ Frame F723 142 KB
142 KB 101ms
33ms Image
image/jpeg 2.16.186.155
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/256124/9994008.jpg?bv=1

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2.16.186.155 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

26fa11830a771f7460e536ac17f0d25987abe7158242d148be9262be4785a8f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security: max-age=0
Last-Modified: Wed, 14 Jul 2021 09:00:17 GMT
Server: nginx
ETag: "60eea7a1-23748"
X-Cache-Status: HIT
P3P: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=14567
Date: Fri, 30 Jul 2021 01:34:05 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/jpeg
Content-Length: 145224

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame F723 15 KB
15 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 18:26:24 GMT
x-content-type-options: nosniff
age: 284861
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 18:26:24 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame F723 16 KB
16 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 17:17:27 GMT
x-content-type-options: nosniff
age: 202598
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 17:17:27 GMT

GET
DATA 200
OK truncated
/ Frame F723 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 82616968e3eb5e6c91a13bc271174248484e92581b6d2d08d9d94d7c9d3764c1

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.6.2/ Frame 6AD9 89 KB
32 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js

Requested by

Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=88258200008334600710152011671007&a=23be2e45

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 00:06:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 437242
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32245
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 Jul 2022 00:06:43 GMT

GET
H/1.1 200
OK 728x90_OMAC_2016_Launch%20(4).jpg
cdn.contentspread.net/24i/advertiser/33019/creativesup/ Frame 6AD9 44 KB
44 KB 140ms
55ms Image
image/jpeg 88.99.65.215
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.contentspread.net/24i/advertiser/33019/creativesup/728x90_OMAC_2016_Launch%20(4).jpg
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=88258200008334600710152011671007&a=23be2e45
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.65.215 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.215.65.99.88.clients.your-server.de
Software: nginx /
Resource Hash: e8ec2a4d84f51a4860526181c3822b954b3a134dc14446ba753b37708470171d

Request headers

Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 30 Jul 2021 01:34:05 GMT
Last-Modified: Tue, 21 Jun 2016 09:44:26 GMT
Server: nginx
ETag: "57690c7a-af88"
Content-Type: image/jpeg
Connection: close
Accept-Ranges: bytes
Content-Length: 44936

GET
H3-29 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame 6E4F 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 18:46:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 197243
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 27 Jul 2022 18:46:42 GMT

GET
H/1.1 200
OK 160x600-MSSTORE-Office2016-Launch%20(2)%20(1).jpg
cdn.contentspread.net/24i/advertiser/33019/creativesup/ Frame B6B8 47 KB
47 KB 152ms
53ms Image
image/jpeg 88.99.65.215
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.contentspread.net/24i/advertiser/33019/creativesup/160x600-MSSTORE-Office2016-Launch%20(2)%20(1).jpg
Requested by: Host: hal900028.redintelligence.net
URL: https://hal900028.redintelligence.net/request_content.php?s=17118100009323200710158011671028&a=e65b5977
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.65.215 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.215.65.99.88.clients.your-server.de
Software: nginx /
Resource Hash: a6d1867d43b9fbb0217e51b5dc3ddd0a4292f937bfa66696f3eba26d1e64d0f6

Request headers

Referer: https://hal900028.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 30 Jul 2021 01:34:05 GMT
Last-Modified: Tue, 21 Jun 2016 09:38:24 GMT
Server: nginx
ETag: "57690b10-ba9e"
Content-Type: image/jpeg
Connection: close
Accept-Ranges: bytes
Content-Length: 47774

GET
H/1.1 200
OK viewability Show response
hal900028.redintelligence.net/ Frame B6B8 0
150 B 118ms
36ms Script
text/html 88.99.165.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900028.redintelligence.net/viewability?s=17118100009323200710158011671028&a=b0408173&vb=m
Requested by: Host: hal900028.redintelligence.net
URL: https://hal900028.redintelligence.net/request_content.php?s=17118100009323200710158011671028&a=e65b5977
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.165.19 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.19.165.99.88.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal900028.redintelligence.net/request_content.php?s=17118100009323200710158011671028&a=e65b5977
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 30 Jul 2021 01:34:05 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame B6B8 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK viewability Show response
hal90007.redintelligence.net/ Frame 6AD9 0
150 B 83ms
23ms Script
text/html 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/viewability?s=88258200008334600710152011671007&a=7d00eded&vb=m
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=88258200008334600710152011671007&a=23be2e45
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal90007.redintelligence.net/request_content.php?s=88258200008334600710152011671007&a=23be2e45
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 30 Jul 2021 01:34:05 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame 6AD9 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C0D8
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEHuk8gRkztfZUheFRYVWMUw&google_cver=1&google_push=AYg5qPKiekc85k1TobIQgZ9AXVdYyHI1ReBCN0rG72xKdbLZpyWa626q-K2unaem646GNmbxNoBsFk3...
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=8&google_gid=CAESEHuk8gRkztfZUheFRYVWMUw&google_cver=1&google_push=AYg5qPKiekc85k1TobIQgZ9AXVdYyHI1ReBCN0rG72xKdbLZpyWa626q-K2unaem646GN...
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Vjt64s4mSVCt70jWcixgn2EDVw0

170 B
188 B

31ms
30ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Vjt64s4mSVCt70jWcixgn2EDVw0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:05 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Vjt64s4mSVCt70jWcixgn2EDVw0
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C0D8
Redirect Chain

https://sync.tidaltv.com/genericusersync.ashx?dpid=glrdr&google_gid=CAESEJsfZvFVUgUCEIejz_oG6yo&google_cver=1&google_push=AYg5qPLqykkJgkeB7TTvDtNamUOg7WRwmNdMTGKzqkuLXAWHk2X59-qjr9qJRA-V146Bi7qGqm7...
https://sync.tidaltv.com/genericusersync.ashx?dpid=glrdr&google_gid=CAESEJsfZvFVUgUCEIejz_oG6yo&google_cver=1&google_push=AYg5qPLqykkJgkeB7TTvDtNamUOg7WRwmNdMTGKzqkuLXAWHk2X59-qjr9qJRA-V146Bi7qGqm7...
https://cm.g.doubleclick.net/pixel?google_nid=lucid1&google_push&google_hm=8VHx5k1VT-mHw4bf-_wpaA&gdpr=1&gdpr_consent=

170 B
188 B

30ms
30ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lucid1&google_push&google_hm=8VHx5k1VT-mHw4bf-_wpaA&gdpr=1&gdpr_consent=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:05 GMT
server: Apache-Coyote/1.1
location: https://cm.g.doubleclick.net/pixel?google_nid=lucid1&google_push&google_hm=8VHx5k1VT-mHw4bf-_wpaA&gdpr=1&gdpr_consent=
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
x-xss-protection: 1; mode=block
expires: 0

GET adxcookie
match.adsby.bidtheatre.com/ Frame C0D8 0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C0D8
Redirect Chain

https://a.c.appier.net/gcm?google_gid=CAESEM3HtPkfYNE6ZPe20tmbcXk&google_cver=1&google_push=AYg5qPJJaDpwIbaZijKc_DWA-9QvMH-_9jBrzTa6urlOI4aQ9hJED2MbzQZLh7vpFx62fbI7d78-8sntPbDrtE4fDefg1QrlzEw
https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=cUdVSXhLMThDQjZqbU1oMkRsY0RZUQ%3D%3D&google_push=AYg5qPJJaDpwIbaZijKc_DWA-9QvMH-_9jBrzTa6urlOI4aQ9hJED2MbzQZLh7vpFx62fbI7d78-8sntPbDrt...
https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=cUdVSXhLMThDQjZqbU1oMkRsY0RZUQ%3D%3D&google_push=AYg5qPJJaDpwIbaZijKc_DWA-9QvMH-_9jBrzTa6urlOI4aQ9hJED2MbzQZLh7vpFx62fbI7d78-8sntPbDrt...

170 B
188 B

29ms
28ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=cUdVSXhLMThDQjZqbU1oMkRsY0RZUQ%3D%3D&google_push=AYg5qPJJaDpwIbaZijKc_DWA-9QvMH-_9jBrzTa6urlOI4aQ9hJED2MbzQZLh7vpFx62fbI7d78-8sntPbDrtE4fDefg1QrlzEw&google_tc=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:06 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=cUdVSXhLMThDQjZqbU1oMkRsY0RZUQ%3D%3D&google_push=AYg5qPJJaDpwIbaZijKc_DWA-9QvMH-_9jBrzTa6urlOI4aQ9hJED2MbzQZLh7vpFx62fbI7d78-8sntPbDrtE4fDefg1QrlzEw&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 431
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET match
um.wbtrk.net/doubleclick/user/ Frame C0D8 0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C0D8
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESEB74o_PpijmeQ0h_f35HJG8&google_cver=1&google_push=AYg5qPJnN9KK_p49fJp-0Ggwvl3jHuZ8uyjhqaXyhmBG0On7x5kPf-lxxlOAD-AFx7__K7ohSg9_1m2V8Hwb7-YnbOYRjPJUjg
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPJnN9KK_p49fJp-0Ggwvl3jHuZ8uyjhqaXyhmBG0On7x5kPf-lxxlOAD-AFx7__K7ohSg9_1m2V8Hwb7-YnbOYRjPJUjg&google_hm=Z2ZmYjIwZWY5MWFjOGM3ZT...

170 B
188 B

30ms
29ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPJnN9KK_p49fJp-0Ggwvl3jHuZ8uyjhqaXyhmBG0On7x5kPf-lxxlOAD-AFx7__K7ohSg9_1m2V8Hwb7-YnbOYRjPJUjg&google_hm=Z2ZmYjIwZWY5MWFjOGM3ZTc3NGU=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:05 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPJnN9KK_p49fJp-0Ggwvl3jHuZ8uyjhqaXyhmBG0On7x5kPf-lxxlOAD-AFx7__K7ohSg9_1m2V8Hwb7-YnbOYRjPJUjg&google_hm=Z2ZmYjIwZWY5MWFjOGM3ZTc3NGU=
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame C0D8 0
12 B 53ms
52ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K6PTnfpAJX9sn2kSDcN7nK5UqEMlLPSQ6gvx5PwGkS4sTvXoQXncVJqG3wI3XQ7Q

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:05 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7584
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

37ms
36ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: 95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com
URL: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUneryl9oWF-yotd6Y_60ltVYCfEpMncAocD-uT7Cz-LQwMzc2Llk99qZA4juUE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Fri, 30 Jul 2021 01:34:05 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Fri, 30-Jul-2021 02:34:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 30 Jul 2021 01:34:05 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Fri, 30 Jul 2021 01:34:05 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A7EC 42 B
64 B 44ms
44ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvPAZHYJNMen7rdcmqfwnG0f2Nu4lXelw4icSn3OGV6cKSOa6ZsrQkxcugJdo1OGWaYbieLoSPCMDN0DUp1W-Q1Gqa0utUQSq-zIq_iABlHVf0XVYVHIoUmDGM&sai=AMfl-YQEo_Oxgdb4q6YwEDbedVDKVzmxcyWJLt2LljSSXsg5YhhvlRfAG_JnByScuujEXHfD7aCfCmFyKs_vp1MzIZP3Bx4TJJk2d2ZLnyZJytrOAouT8OCw1ocD2PCcKgE0&sig=Cg0ArKJSzGrz5BgtKXMdEAE&cid=CAASFeRoQkNW5MLjKFqaM88qSWOZ9p761g&id=lidar2&mcvt=1023&p=243,1280,493,1580&mtos=1023,1023,1023,1023,1023&tos=1023,0,0,0,0&v=20210728&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=392238017&rs=4&met=ce&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1627608844419&dlt=17&rpt=323&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 44ms
42ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021072701&jk=4472886863985705&bg=!sbKlsvbNAAals0SOpbM7ACkAdvg8WuNVb0EOLqrKRgWeUZPZiokUgQc9gekfbkEJKhin0K8os9BcPwIAAAK7UgAAAH1oAQcKAHKbYhz1Olq2pZyKsGRfCX2ubeGzR40N9nYLtyVZ7qTnjy_6VrMnU45GSItbWiYVA9kcZNruq_U8poD5P4v6K1Ytv1ZWGqWlLrhtSpm2oa9IHw9KApLJzaNQNWLxrH2vwVXEjoFw-jz1GIZbCmefjS7eS0mZAnoZi8Q_FkrsWFvLOYprwItdXtA2UtNRVVgDENoa6QYdEbfL9F-OueMzou1EhO8_0PTlXK3H-vV3C0GnJBKrsiMFkQR2ZcxjrUsqYhOmLFKKvirhxHW7golGLoJmf0-n1PbvLRYSy2gGe4aNi9Y4M8VKrYheUkjWv1PubVGB1f-AVgG58Pe3u08OVmouoxjVnPU2zHo8RSkLAGmSr2cvZIfU8VOndfbbILWNhgbkPkqukvr1eT9jm8xEUZT11g-bng0kGifPLCxIsfx6uiNTeDaS6xa7ND84ovQJdoztFocxnLgdFagPRh-lwlDkQzbyhhyUIVOg1HYFcdtZqWBjiBN0mLBYYE77LEfEgcshEotmGEu7SxzOB0LJOdc7AevUAyvI7jqSNA7uEAKTWEOzK7sNWUeeFehkJ-C5ERYFDSm-7v8-XdQZfvo7g0uZi6zrTtl2sMXda7iCU4sZrNDGFrqmOHJ42gYxuTRGX0fHvQdHmXHq_DFdy9OktxpsZj2Ji8hcqMtZXZQzzOTFvUFslBRIyXEu1ia1W6p6WYLuMVwd-YmMN2gKfklE6iIZHu4h07RcUnUSPWYN3irrWkwU9RNC1-6apcOcZTO872UJ97S_pl2RriJj4aqf5ffxFgcA2SFPzQYljbcGdyw6U6wB3f-WSeXEvBgPV7_HRdcT0xQd6w592r70HYgkPMd-clC9FE4ccVWdWL773i80C4i8ZGqn8Q-YUqu7n0EyNlHZj8AR7vxW0t_PCmkfvpcc60tbMjN370t27TF2ztXDyNugiEtOo152xXorbPxeGjIvI3uXulOWotuKndeuMoqGS9-aR34v-RyibHHYeqb6

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 97C6 0
20 B 42ms
42ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BqZcZDFcDYcCZHIeIx_APnfG64AYAAAAAOAHgBAI&bg=!DwylDEjNAAals0SOpbM7ACkAdvg8WtWIHz0ziPNxLCt9fAD2fvUe__qkWEl2MOyMroMzPdwPBFwMuAIAAAKtUgAAAGhoAQcKAIvfYBKplZqdmAQ-A_K-eOgaJCg5l9sU8XqQTuCdiMCwBEhimuAdIABnGslUZfLJ4HuCimfBlNFOb-VZVqay9CrkqxHmIg0SiGyWgp2LBrS9NcwjFs-fBMyniOGEmnc9XdDMHB8bAAoUptRi-O7ngXj-L2mNkLUrGWsR2QWdvYMcnyM4R-So3mBg7xESmQLDcU0eHMHGRZJz7QMbLwWfj71SPtwWIpWraStV5XbHru1jreEEL6hRCnoRcwmTWEP9TUMVF9_IMQ6vFu7hoe98o0TKHo8V09uJy30JrmYpGxhwwpjAW-WJf3CmJtWccaCWTa9sS9-duL9K_gAlXLwPqvUH1toR9rRC3k_fOGK3ZHGpY3DnXJVegyzDje3jrz3Z7aiSaz0jDqA5p7Ee2u83YrTlTQqdzReF95T-hfoZr1u64lniCl6iFg5T2WjFt4UQBKYJCuLe0EkOSI51ueKJVnSxKEUyDo0URozJBqXW8mRAheQJpmD350nCnBR7jfuIv_KML9QbpejL6PEvrIw2V-28MtNZ6qgL2XSve03Hb9vd8c3MXHAWTsCdcllodIx6YosOD-AXHAK8WhOIb48AioUfQOTjcTr0A-GMrXpNJq3F0CezeXgNNboJ-SbDTiTHkdIfCmRRX77Wc0kIryO5ZgeOAMro7ZDm71dnsL-GyZXnN-ktKqtT86tG_TuHaygD9EcMm--FoFuWndFQheQLOTbnXDC_OFb6axdYrcdG6hd4IqFHhXz0fuBDS5ZYLnbswByxRfTNs2Jcwhzb0qYUvob29e4t3rquM65Y2mRtM6c8YoX0E-3tgES9BCtG10ySXmSlui11id2pMA7WD8JwS8jqQGw_o52aRdhYI8JRARg1DeExBfdgjNQAHSvXmSoaojzsEb5WnKcctVKUo1KVY6auc6vVj9FofFHhQ4pQ_QsqP0YiveEb2RsAkEX_dOWkCBZ5c1aTrrhHj-1eSVdo1X64bQQpy2YCmbN1Eoql59oMDIURZqhQHsQQGHLJUhDLOAvpl2YpYRXyo92OECFygPHHwaUTuA4-GtpOhAbcwfBVtg75LJngE_S-LXrrgV_O8y8CQIio4jRsi7eycG8_HCiHz9hlDNCnpWuBz-pNuSoXlKQ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 65A7 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BiSCYDFcDYf3ZHeCW7_UP5O2j6A0AAAAAOAHgBAI&bg=!zM-lz4vNAAals0SOpbM7ACkAdvg8WkHbPGB3P6Krl1szoDkrY4gDhUrbxyekhHAYoXllgxHX1GcJSAIAAALfUgAAAGBoAQcKANpvzj6DHaomiKYMeSVGH0puxnx_SIhRfwYM0LAxG2QBN-I-O3FoDw41LxmsqWJEaBnaGjMobW1raAzJQgYjrvl6sJYuzOLv71rLzA-xkJpm1dUL2cOFSftiasYtpuTIlBmlgdoHAj3kMdNZOFnqQmCb9Kauwpolob6r23OBplkJ5dlAOa-NhwlC1zuoOEKOjGzbi6FIWH7rFDnWlWROGnS5_OSQj5HdEJNgoBwXsv0j16sjcLxD1GPbqAHn9sy5z-dkjsVcFIbLlTnxdWsivUezRbF2jHTEvjF3ApkCtlX99NT93kh7vEzWZQOAq20BDYpATJNwlXHAOlCc4SZFMUpxxSXYyG4VjEcikGNrSZttzblzVY4Stwd9Hkt47R0grJR7bMnfEEAzoVfV7iN7JunVHllZyJvV2LlX9IN9vnme3JgtL_mlb9ccw2bj58CI53e9vBJSXFX5eFuoNmTZIWzlKxcQEfmomAg64nZDb22ZMYWcytyzgIASbcYL1lRZdEczsJ5uxmsQOQJ8iFUdz-v-vUsYiFf8ABrtmjDdZc-ixr-gBP17Ix5j_RcHEMjHNp-C7tw_UcM_gkio575arYhArJE9f8u0C9rzE9G0zsq2j_W6JM4dercJKDTyaxXX0faeUkgRE6pZbWO0joeTCD1XX2ZRbOjBaov_jefGrbSO8tIdpUPUxFO-ooYvXqXFJvWs2weA6iaSWEAVV09aQRCmXv5KdPLSVRvfJv268LFrRMuHaFYoXQ_0xRHYZTLhOufen7aVs6eneiPOivVnMqwYIl70ToQHnCIEOTOthx7oMGDdcQWhMkszeonRfHlbKppD2fXezP9JH4lm2fTviNZ1mNYHvzS33mpUXtcd1lQst0lUM1G-H6TIYWxVjcN0PTw7gtrTSuE4r1YDtJr28Tkmf8NUErfUcaHHiULF-WELoRwG2dO9V0a4R6yh_pJgtMluFdkThmN2ruFtXJ5Yzs98H1obb6f9c9zSM2zIh3Esd6LYzlehmPS8V7fwraagp0QRYYSfxIELwNkGFq4avaeI-gLBZEPXT-IJKHebULziCBgFgyI60kv8xC2GM-y8lRNKcWZpKtnAkMoZJB1X3_3t7g01L0EIlSpbdA8GoWlXdN7McI0qdVbTtlnj_diz0hzQpRX3LAVQytvHrZjWF8zML9ZMkgRqkYnFW32LLo7K-veT-HGOPs635gUq-z9-bvn4TtQ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 09DE 0
20 B 43ms
42ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BQTCTDFcDYb_4H9-KjuwP18OfsAoAAAAAOAHgBAI&bg=!e3ileDzNAAals0SOpbM7ACkAdvg8WnzSuzwWAUn5BgMliDHJfP1yFy9gkQG8wp_3wlZavNirN1uzegIAAAKwUgAAAC1oAQcKAAIrWJkCu0K6sJQYErC6F85j_3guqUO7zW_JOpnf8qyYPA23144wz6z5xOtK_dsRZkOetWlzPaohXn3CH90pZe4jfHN6h8MEIrpDvs4dbPSNNqvQxj5-lMTtkYRR1WExLp60ahrW27rIZaJBE_Y3uTzLh2jhjogry6cjCz9V_s0TR7VWP320ET9SqoNj1BrZifbFifNLXxlp2QSEUeuuoSRAhEbFWc3ed1_t1jkg6wiS85wmRwZuks1b2wA6116zSAsZTmgBRINkB5NveJlOyjdUMK3km9_h2exbwnn9H6045erwkARd246-O8qAJ9dU-zQi4XoCL9yMvsiFrkHWbgl0QsGXS9vad5Ff3U81yzYOxJrJF5FjzQ5BvHM6khEAla9vPnTBXW_Mn2Rw_LCr8aB3YUVdGFXEOqU-jdg1kQ3wndTtgabK4zAZWqRe4BBe2qAeSg4ShvwMVB3VPc3wST-MSjxfwx3yzm_FTTBl-SNgYgcJ2xSmPbqhT2aEeOSPDQ-KShnbKvHuEq0--F4psGNHdqGMFS5vqu92XV5fZuW82JPruK5dpIzXFbwGJ2KQI65tc0EnnoMT58I0fg-W5pW8wZJDCZmQXuf-lrEQVW3LAA2-Lq0hHjgZAhaCOz-tabbzgvxLkK0BylhdTiVLmmnsS8FydgE-w_7CDqOj9ONwH_rSA13e_6cubdD6k0FXtlBz0SR8EWfvZVgebJEIeLF5XqgyFxaknKfTmd4rVtgcJdMNcsZhyzjmgswADEtiwrrViT1AQLLS_10jDcle4ngoQbh4_YwkhKH7ygQuw0i1SI_ka8n8Cf_lRZgvJKSAI68a7N4HjgVeeLG8az_fLi7oqYpkeAT0pau8OADM57oqHQd1pu3XUR1aCOPh80HsjUqJ7NiB2ExnTd4UmjoanurZK7OXBWf9aJQkZmH8AtH8ew

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4368 42 B
174 B 42ms
42ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu9iTS2bYfD_Hsy2TLHf9TDKHbFWNPGoLEYJcXCUJvgpTb336OGcKSYWTsxNyTtPi9Vg3sf0MKaPml_I21TaXfENKeyqyUh4oc-OymlqfgCEg&sai=AMfl-YTfW1zxxd2hSbrLmcrKljVKIONHVstXo5xhkjK8EGR99CGB3C6SQsMqduaCv5DYl9w_yrBXwu1k7pOTQ9rhoFYNXmOiQ0dtDaXH5dZXlVji-hkX1CzTWdYrU-PRzY_l&sig=Cg0ArKJSzOkN0wqRXumcEAE&cid=CAASFeRo3G7JFp2q0_IOU-eIQ1qqgsT4oA&id=lidar2&mcvt=1000&p=123,523,213,1251&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210728&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3534186949&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1627608844419&dlt=10&rpt=779&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4A12 42 B
64 B 41ms
41ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv0aAWMCViKqHAvNuCYX_8OgRQsd4la11Y7zOmqxtvphkQGLssfF9HJY8i51dQWoalGJTdUmZQREI8L9acTjrbgjMGihWbzvMJd0cOmpJjMDw&sai=AMfl-YQflUcq5F1GJCQ4SnmFZCDoSJnm4lSyyBKyFu6okvCGIf0WMtaXQFOEf4-DnACeKUbSZ5Rz0LLx2yHjb9ybWojRS0p__kO5t5YwrUJTII07CqWgfSBiZ-dqHNbrRh7y&sig=Cg0ArKJSzLT4ULOU3c2SEAE&cid=CAASFeRoJx0Xiybp-F0OgLxGLPWwfIpBpw&id=lidar2&mcvt=1000&p=357,8,957,168&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210728&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1379951554&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1627608844418&dlt=15&rpt=863&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 tinyurl.com Show response
e.deployads.com/e/ 2 B
126 B 52ms
52ms XHR
text/plain 18.202.37.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://e.deployads.com/e/tinyurl.com
Requested by: Host: tags-cdn.deployads.com
URL: https://tags-cdn.deployads.com/a/tinyurl.com.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.37.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-37-41.eu-west-1.compute.amazonaws.com
Software: Jetty(7.6.12.v20130726) /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Fri, 30 Jul 2021 01:34:06 GMT
server: Jetty(7.6.12.v20130726)
content-length: 2
content-type: text/plain;charset=UTF-8

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F723 42 B
64 B 39ms
39ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuFhdtXtLLZcsogWC08U_ypFdzv9kHaiA-X9T29Z-BLrPv502LJNkEJ4YAci-madA_z2ENJj1zrFRdy8ICnYsGoUyV5cGwpJg&sig=Cg0ArKJSzOOfYmHCN99ZEAE&cid=CAASFeRoxw28D8rbSAY9_25d5NmWeENHyg&id=lidar2&mcvt=1000&p=1101,437,1170,1165&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210728&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=9&adk=162780659&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1627608844869&dlt=30&rpt=1&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900028.redintelligence.net/ Frame B6B8 0
150 B 69ms
23ms Script
text/html 88.99.165.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900028.redintelligence.net/viewability?s=17118100009323200710158011671028&a=b0408173&vb=v
Requested by: Host: hal900028.redintelligence.net
URL: https://hal900028.redintelligence.net/request_content.php?s=17118100009323200710158011671028&a=e65b5977
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.165.19 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.19.165.99.88.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal900028.redintelligence.net/request_content.php?s=17118100009323200710158011671028&a=e65b5977
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 30 Jul 2021 01:34:06 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK viewability Show response
hal90007.redintelligence.net/ Frame 6AD9 0
150 B 75ms
26ms Script
text/html 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/viewability?s=88258200008334600710152011671007&a=7d00eded&vb=v
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=88258200008334600710152011671007&a=23be2e45
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal90007.redintelligence.net/request_content.php?s=88258200008334600710152011671007&a=23be2e45
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 30 Jul 2021 01:34:06 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

POST
H2 200 tinyurl.com Show response
e.deployads.com/e/ 2 B
126 B 52ms
52ms XHR
text/plain 18.202.37.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://e.deployads.com/e/tinyurl.com
Requested by: Host: tags-cdn.deployads.com
URL: https://tags-cdn.deployads.com/a/tinyurl.com.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.37.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-37-41.eu-west-1.compute.amazonaws.com
Software: Jetty(7.6.12.v20130726) /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Fri, 30 Jul 2021 01:34:06 GMT
server: Jetty(7.6.12.v20130726)
content-length: 2
content-type: text/plain;charset=UTF-8

GET
H2

200

VZNM
c.deployads.com/cs/
Redirect Chain

https://pixel.advertising.com/ups/58282/sync?&gdpr=&gdpr_consent=&redir=true
https://pixel.advertising.com/ups/58282/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
https://ups.analytics.yahoo.com/ups/58282/sync?&gdpr=&gdpr_consent=&redir=true&apid=UP3b28339e-f0d6-11eb-821a-02407095623c
https://ups.analytics.yahoo.com/ups/58282/sync?&gdpr=&gdpr_consent=&redir=true&apid=UP3b28339e-f0d6-11eb-821a-02407095623c&verify=true
https://c.deployads.com/cs/VZNM?b=y-04ZRJH9E2uGHw_Un7Ev2sCqwrMhOACUx~A~UP3b28339e-f0d6-11eb-821a-02407095623c

43 B
337 B

43ms
42ms

Image
image/gif

52.51.116.157
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.deployads.com/cs/VZNM?b=y-04ZRJH9E2uGHw_Un7Ev2sCqwrMhOACUx~A~UP3b28339e-f0d6-11eb-821a-02407095623c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.116.157 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-116-157.eu-west-1.compute.amazonaws.com
Software: SortableCactus/1.0 /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:07 GMT
cache-control: no-cache
server: SortableCactus/1.0
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Fri, 30 Jul 2021 01:34:07 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://c.deployads.com/cs/VZNM?b=y-04ZRJH9E2uGHw_Un7Ev2sCqwrMhOACUx~A~UP3b28339e-f0d6-11eb-821a-02407095623c
Connection: keep-alive
Content-Length: 0

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 6AB8 0
0 358ms
115ms Document
text/plain 208.100.17.172
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=d9HhYeaj8r6QaoaKkGJozW&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.100.17.172 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
Software: 33XP001 /
Resource Hash

Request headers

:method: GET
:authority: ssc-cms.33across.com
:scheme: https
:path: /ps/?m=xch&rt=html&ru=deb&id=d9HhYeaj8r6QaoaKkGJozW&gdpr_consent=undefined&us_privacy=undefined
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

x-33x-status: 200000000000000002020008
server: 33XP001
date: Fri, 30 Jul 2021 01:34:06 GMT

GET
H2 204 index.html
cdn.districtm.io/ids/ Frame 38D0 0
0 20ms
18ms Document
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: cdn.districtm.io
:scheme: https
:path: /ids/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

date: Fri, 30 Jul 2021 01:34:07 GMT
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Origin
access-control-allow-methods: GET, HEAD, POST, OPTIONS
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 676ad7be6d2a0204-ZRH

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame C7F1 52 KB
17 KB 73ms
21ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://tinyurl.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Wed, 21 Jul 2021 04:42:55 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Fri, 30 Jul 2021 01:34:07 GMT
Age: 75057
X-Served-By: cache-lga13620-LGA, cache-fra19171-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 2, 500784
X-Timer: S1627608847.153581,VS0,VE0
Vary: Accept-Encoding

GET
H2

200

sync Show response
eb2.3lift.com/ Frame BC88
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

1 KB
1 KB

19ms
18ms

Document
text/html

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: 07f6c71d37c78c9f69fb2ae2887f5a104e4ad72de615cc466673353afd56f7ee

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?&ld=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tluid=8980672802649688197
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

date: Fri, 30 Jul 2021 01:34:07 GMT
content-type: text/html; charset=utf-8
content-length: 478
set-cookie: sync=CgoIgQIQuKawqK8vCgoIkQIQuKawqK8vCgoI4gEQuKawqK8vCgoIkgIQuKawqK8vCgoI5gEQuKawqK8vCgoIhwIQuKawqK8vCgkIOhC4prCory8KCQgLELimsKivLwoJCF8QuKawqK8vCgkIHxC4prCory8=; Max-Age=7776000; Expires=Thu, 28 Oct 2021 01:34:07 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=8980672802649688197; Max-Age=7776000; Expires=Thu, 28 Oct 2021 01:34:07 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

date: Fri, 30 Jul 2021 01:34:07 GMT
content-length: 0
set-cookie: tluid=12182365756712150554; Max-Age=7776000; Expires=Thu, 28 Oct 2021 01:34:07 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

sync Show response
eb2.3lift.com/ Frame AA17
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

1 KB
1 KB

19ms
19ms

Document
text/html

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: 07f6c71d37c78c9f69fb2ae2887f5a104e4ad72de615cc466673353afd56f7ee

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?&ld=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tluid=8980672802649688197
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

date: Fri, 30 Jul 2021 01:34:07 GMT
content-type: text/html; charset=utf-8
content-length: 478
set-cookie: sync=CgoIgQIQt6awqK8vCgoIkQIQt6awqK8vCgoI4gEQt6awqK8vCgoIkgIQt6awqK8vCgoI5gEQt6awqK8vCgoIhwIQt6awqK8vCgkIOhC3prCory8KCQgLELemsKivLwoJCF8Qt6awqK8vCgkIHxC3prCory8=; Max-Age=7776000; Expires=Thu, 28 Oct 2021 01:34:07 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=8980672802649688197; Max-Age=7776000; Expires=Thu, 28 Oct 2021 01:34:07 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

date: Fri, 30 Jul 2021 01:34:07 GMT
content-length: 0
set-cookie: tluid=8980672802649688197; Max-Age=7776000; Expires=Thu, 28 Oct 2021 01:34:07 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 204 index.html
cdn.districtm.io/ids/ Frame 0C91 0
0 19ms
19ms Document
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: cdn.districtm.io
:scheme: https
:path: /ids/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

date: Fri, 30 Jul 2021 01:34:07 GMT
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Origin
access-control-allow-methods: GET, HEAD, POST, OPTIONS
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 676ad7be6d2c0204-ZRH

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 7F88 52 KB
17 KB 90ms
29ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://tinyurl.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Wed, 21 Jul 2021 04:42:55 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Fri, 30 Jul 2021 01:34:07 GMT
Age: 75057
X-Served-By: cache-lga13620-LGA, cache-fra19158-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 2, 500037
X-Timer: S1627608847.177286,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/ib/static/usersync/v3/ Frame 0E84 995 B
1 KB 86ms
27ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash: 8730c26defc411dd8a51f1da47e5ae3804fab6868f7914a26b09d8e0791bbe39

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://tinyurl.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

Connection: keep-alive
Content-Length: 506
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: W/"573e714d-3e3"
Expires: Thu, 06 May 2021 05:24:22 GMT
Cache-Control: max-age=31536000
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Fri, 30 Jul 2021 01:34:07 GMT
Age: 7330186
X-Served-By: cache-lga21975-LGA, cache-fra19120-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 11367, 77188
X-Timer: S1627608847.180396,VS0,VE0
Vary: Accept-Encoding

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 407A 0
0 347ms
116ms Document
text/plain 208.100.17.172
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=bggfyaakar6PmwaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.100.17.172 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
Software: 33XP002 /
Resource Hash

Request headers

:method: GET
:authority: ssc-cms.33across.com
:scheme: https
:path: /ps/?m=xch&rt=html&ru=deb&id=bggfyaakar6PmwaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tinyurl.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

x-33x-status: 2020008
server: 33XP002
date: Fri, 30 Jul 2021 01:34:07 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/ib/static/usersync/v3/ Frame EA18 995 B
1 KB 93ms
29ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: tinyurl.com
URL: https://tinyurl.com/yd9ojkxx
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash: 8730c26defc411dd8a51f1da47e5ae3804fab6868f7914a26b09d8e0791bbe39

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://tinyurl.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tinyurl.com/

Response headers

Connection: keep-alive
Content-Length: 506
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: W/"573e714d-3e3"
Expires: Thu, 06 May 2021 05:24:22 GMT
Cache-Control: max-age=31536000
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Fri, 30 Jul 2021 01:34:07 GMT
Age: 7330185
X-Served-By: cache-lga21975-LGA, cache-fra19153-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 11367, 140867
X-Timer: S1627608847.185028,VS0,VE0
Vary: Accept-Encoding

GET
H2

200

TTD
c.deployads.com/cs/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=ge1y7yp&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=ge1y7yp&ttd_tpi=1
https://c.deployads.com/cs/TTD?b=1498516d-4364-4b9b-9b6b-bfe3931ffeb9

43 B
301 B

44ms
44ms

Image
image/gif

52.51.116.157
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.deployads.com/cs/TTD?b=1498516d-4364-4b9b-9b6b-bfe3931ffeb9
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.116.157 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-116-157.eu-west-1.compute.amazonaws.com
Software: SortableCactus/1.0 /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:07 GMT
cache-control: no-cache
server: SortableCactus/1.0
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:07 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://c.deployads.com/cs/TTD?b=1498516d-4364-4b9b-9b6b-bfe3931ffeb9
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 169

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=fb9580c293&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=fb9580c293&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us.gif?nw=td&nuid=1498516d-4364-4b9b-9b6b-bfe3931ffeb9&pubid=fb9580c293

49 B
509 B

192ms
26ms

Image
image/gif

178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=td&nuid=1498516d-4364-4b9b-9b6b-bfe3931ffeb9&pubid=fb9580c293

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Madrid, Spain, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:07 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-9
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: image/gif
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:07 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.go.sonobi.com/us.gif?nw=td&nuid=1498516d-4364-4b9b-9b6b-bfe3931ffeb9&pubid=fb9580c293
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 227

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/
Redirect Chain

https://x.bidswitch.net/sync?ssp=sonobi&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=sonobi&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=sonobi&bsw_param=366e95b5-b3d5-4db0-a920-9acf4ff3d382&google_hm=MzY2ZTk1YjUtYjNkNS00ZGIwLWE5MjAtOWFjZjRmZjNkMzgy
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEG9txWYidgsrdgxjRuCeSLs&google_cver=1&ssp=sonobi&bsw_param=366e95b5-b3d5-4db0-a920-9acf4ff3d382
https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=366e95b5-b3d5-4db0-a920-9acf4ff3d382

49 B
509 B

173ms
31ms

Image
image/gif

178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=366e95b5-b3d5-4db0-a920-9acf4ff3d382

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Madrid, Spain, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:07 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-9
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: image/gif
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: //sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=366e95b5-b3d5-4db0-a920-9acf4ff3d382
date: Fri, 30 Jul 2021 01:34:07 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/
Redirect Chain

https://sync.1rx.io/usersync2/sonobi&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=7704316612
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=7704316612
https://sync.1rx.io/usersync/tradedesk/086ad688-c0b2-4f19-8279-4ca9e5716a1e
https://sync.targeting.unrulymedia.com/csync/RX-2aade3ee-92ec-4c20-8d06-ef8667e26cc4-003?redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Drhythmxchange%26nuid%3DRX-2aade3ee-92ec-4c20-8d06-ef8...
https://sync.go.sonobi.com/us.gif?nw=rhythmxchange&nuid=RX-2aade3ee-92ec-4c20-8d06-ef8667e26cc4-003

49 B
513 B

28ms
28ms

Image
image/gif

178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=rhythmxchange&nuid=RX-2aade3ee-92ec-4c20-8d06-ef8667e26cc4-003

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Madrid, Spain, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:08 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-129
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: image/gif
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://sync.go.sonobi.com/us.gif?nw=rhythmxchange&nuid=RX-2aade3ee-92ec-4c20-8d06-ef8667e26cc4-003
date: Fri, 30 Jul 2021 01:34:08 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX2aade3ee92ec4c208d06ef8667e26cc4003
content-type: text/html

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/
Redirect Chain

https://p.rfihub.com/cm?pub=35683&in=1
https://sync.go.sonobi.com/us.gif?nw=zt&nuid=1870471597083423240

49 B
509 B

164ms
27ms

Image
image/gif

178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=zt&nuid=1870471597083423240

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Madrid, Spain, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:07 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-9
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: image/gif
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://sync.go.sonobi.com/us.gif?nw=zt&nuid=1870471597083423240
Date: Fri, 30 Jul 2021 01:34:07 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/
Redirect Chain

https://sync.1rx.io/usersync2/sortable
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5271779459
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5271779459
https://sync.1rx.io/usersync/tradedesk/086ad688-c0b2-4f19-8279-4ca9e5716a1e
https://sync.targeting.unrulymedia.com/csync/RX-2aade3ee-92ec-4c20-8d06-ef8667e26cc4-003?redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Drhythmxchange%26nuid%3DRX-2aade3ee-92ec-4c20-8d06-ef8...
https://sync.go.sonobi.com/us.gif?nw=rhythmxchange&nuid=RX-2aade3ee-92ec-4c20-8d06-ef8667e26cc4-003

49 B
509 B

28ms
27ms

Image
image/gif

178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=rhythmxchange&nuid=RX-2aade3ee-92ec-4c20-8d06-ef8667e26cc4-003

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Madrid, Spain, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:08 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-9
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: image/gif
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://sync.go.sonobi.com/us.gif?nw=rhythmxchange&nuid=RX-2aade3ee-92ec-4c20-8d06-ef8667e26cc4-003
date: Fri, 30 Jul 2021 01:34:08 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX2aade3ee92ec4c208d06ef8667e26cc4003
content-type: text/html

GET cs
cs.lkqd.net/ 0
0

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/
Redirect Chain

https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dmediamath%26nuid%3D[MM_UUID]
https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=5e036103-570f-4300-8c73-0deaa3b876d3

49 B
513 B

141ms
27ms

Image
image/gif

178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=5e036103-570f-4300-8c73-0deaa3b876d3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Madrid, Spain, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:07 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-129
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: image/gif
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Fri, 30 Jul 2021 01:34:07 GMT
Server: MT3 3810 5cb7d7e master zrh-pixel-x7
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=5e036103-570f-4300-8c73-0deaa3b876d3
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 30 Jul 2021 01:34:06 GMT

GET
H2

200

cent
c.deployads.com/cs/
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=99
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=99
https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=c1eb92ac-141e-429c-b904-6daf1e7c766a-6103570f-4348&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=c1eb92ac-141e-429c-b904-6daf1e7c766a-6103570f-4348&partner_url=https%3A%2F%2Fc.deployads.com%2Fcs%2Fcent%3Fb%3Dc1eb92ac-141e...
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=c1eb92ac-141e-429c-b904-6daf1e7c766a-6103570f-4348&partner_url=https%3A%2F%2Fc.deployads.com%2Fcs%2Fcent%3Fb%3Dc1eb92a...
https://c.deployads.com/cs/cent?b=c1eb92ac-141e-429c-b904-6daf1e7c766a-6103570f-4348&gdpr=0&gdpr_consent=

43 B
377 B

44ms
44ms

Image
image/gif

52.51.116.157
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.deployads.com/cs/cent?b=c1eb92ac-141e-429c-b904-6daf1e7c766a-6103570f-4348&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.116.157 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-116-157.eu-west-1.compute.amazonaws.com
Software: SortableCactus/1.0 /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://tinyurl.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:07 GMT
cache-control: no-cache
server: SortableCactus/1.0
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://c.deployads.com/cs/cent?b=c1eb92ac-141e-429c-b904-6daf1e7c766a-6103570f-4348&gdpr=0&gdpr_consent=
date: Fri, 30 Jul 2021 01:34:07 GMT
via: 1.1 google
alt-svc: clear
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame BC88 70 B
264 B 41ms
37ms Image
image/gif 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:07 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

200

xuid
eb2.3lift.com/ Frame BC88
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEOFQHJpTVXm-jPQGepDpVQ0&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1

37 B
352 B

22ms
21ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEOFQHJpTVXm-jPQGepDpVQ0&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:07 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:07 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEOFQHJpTVXm-jPQGepDpVQ0&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BC88
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODk4MDY3MjgwMjY0OTY4ODE5Nw%3D%3D

170 B
188 B

30ms
29ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODk4MDY3MjgwMjY0OTY4ODE5Nw%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODk4MDY3MjgwMjY0OTY4ODE5Nw%3D%3D
date: Fri, 30 Jul 2021 01:34:07 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 c.gif
c.bing.com/ Frame BC88 42 B
320 B 36ms
28ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=8980672802649688197&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:06 GMT
etag: "9d284f105d6fd71:0"
last-modified: Fri, 02 Jul 2021 16:12:32 GMT
x-msedge-ref: Ref A: 738860E5615A4ACB8AA7EFE5F7DE3FC0 Ref B: FRAEDGE1212 Ref C: 2021-07-30T01:34:07Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

GET
H2

200

xuid
eb2.3lift.com/ Frame BC88
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/8980672802649688197?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-JDpU5m9E2oSCZkzi2RfFH3EKOK1INrQbWNc1g.NOmg--~A&dongle=0883

37 B
352 B

21ms
20ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-JDpU5m9E2oSCZkzi2RfFH3EKOK1INrQbWNc1g.NOmg--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:07 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Fri, 30 Jul 2021 01:34:07 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-JDpU5m9E2oSCZkzi2RfFH3EKOK1INrQbWNc1g.NOmg--~A&dongle=0883
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame BC88
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=1%26gdpr_consent=
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Feb2.3lift.com%252Fxuid%253Fmid%253D3335%2526xuid%253D%2524UID%2526dongle%253D4d58%2526gdpr%3D1%2526gdpr_consent%3D
https://eb2.3lift.com/xuid?mid=3335&xuid=8444760456266515894&dongle=4d58&gdpr=1&gdpr_consent=

37 B
352 B

20ms
20ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3335&xuid=8444760456266515894&dongle=4d58&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:08 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:08 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 0b78c587-6f19-4af3-be29-2388f2727a31
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://eb2.3lift.com/xuid?mid=3335&xuid=8444760456266515894&dongle=4d58&gdpr=1&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame BC88
Redirect Chain

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=8980672802649688197
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=8980672802649688197&dcc=t

0
0

233ms
116ms

Image
text/html

209.54.178.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=8980672802649688197&dcc=t
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.54.178.82 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:07 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 3MXND5G7WXSZ64ZZTMPK
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=8980672802649688197&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame BC88
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1

37 B
139 B

19ms
18ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:08 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:08 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Content-Length: 95
Content-Type: text/html; charset=utf-8

GET
H/1.1 400
Request failed due to privacy signals setuid
ib.adnxs.com/prebid/ Frame BC88 0
0 34ms
30ms Image
text/html 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/prebid/setuid?bidder=triplelift_native&gdpr=1&gdpr_consent=&uid=8980672802649688197
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 400
Request failed due to privacy signals setuid
ib.adnxs.com/prebid/ Frame BC88 0
0 71ms
30ms Image
text/html 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/prebid/setuid?bidder=triplelift&gdpr=1&gdpr_consent=&uid=8980672802649688197
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame AA17 70 B
264 B 41ms
36ms Image
image/gif 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:07 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

200

xuid
eb2.3lift.com/ Frame AA17
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEPnXOIgFI9hr5CCKNf2JeTE&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1

37 B
352 B

20ms
20ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEPnXOIgFI9hr5CCKNf2JeTE&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:07 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:07 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEPnXOIgFI9hr5CCKNf2JeTE&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame AA17
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODk4MDY3MjgwMjY0OTY4ODE5Nw%3D%3D

170 B
188 B

32ms
30ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODk4MDY3MjgwMjY0OTY4ODE5Nw%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODk4MDY3MjgwMjY0OTY4ODE5Nw%3D%3D
date: Fri, 30 Jul 2021 01:34:07 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 c.gif
c.bing.com/ Frame AA17 42 B
245 B 33ms
30ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=8980672802649688197&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:06 GMT
etag: "9d284f105d6fd71:0"
last-modified: Fri, 02 Jul 2021 16:12:32 GMT
x-msedge-ref: Ref A: 81A66D100D234856BB5D6C5C5BB22803 Ref B: FRAEDGE1212 Ref C: 2021-07-30T01:34:07Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

GET
H2

200

xuid
eb2.3lift.com/ Frame AA17
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/8980672802649688197?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-oubTyIVE2oQ0t0ssVMMRLN.O.3mwgePos_367nC42A--~A&dongle=0883

37 B
352 B

20ms
19ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-oubTyIVE2oQ0t0ssVMMRLN.O.3mwgePos_367nC42A--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:07 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Fri, 30 Jul 2021 01:34:07 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-oubTyIVE2oQ0t0ssVMMRLN.O.3mwgePos_367nC42A--~A&dongle=0883
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame AA17
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=1%26gdpr_consent=
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Feb2.3lift.com%252Fxuid%253Fmid%253D3335%2526xuid%253D%2524UID%2526dongle%253D4d58%2526gdpr%3D1%2526gdpr_consent%3D
https://eb2.3lift.com/xuid?mid=3335&xuid=5394170927635131020&dongle=4d58&gdpr=1&gdpr_consent=

37 B
352 B

20ms
20ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3335&xuid=5394170927635131020&dongle=4d58&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:08 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:08 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 60bd8492-d6a6-4d86-bf56-1d43ce76b643
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://eb2.3lift.com/xuid?mid=3335&xuid=5394170927635131020&dongle=4d58&gdpr=1&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame AA17
Redirect Chain

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=8980672802649688197
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=8980672802649688197&dcc=t

0
0

138ms
119ms

Image
text/html

209.54.178.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=8980672802649688197&dcc=t
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.54.178.82 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:07 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 97BJBB12XM5A9XF7DNG3
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=8980672802649688197&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame AA17
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1

37 B
139 B

18ms
18ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 01:34:08 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:08 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Content-Length: 95
Content-Type: text/html; charset=utf-8

GET
H/1.1 400
Request failed due to privacy signals setuid
ib.adnxs.com/prebid/ Frame AA17 0
0 153ms
31ms Image
text/html 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/prebid/setuid?bidder=triplelift_native&gdpr=1&gdpr_consent=&uid=8980672802649688197
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 400
Request failed due to privacy signals setuid
ib.adnxs.com/prebid/ Frame AA17 0
0 1096ms
30ms Image
text/html 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/prebid/setuid?bidder=triplelift&gdpr=1&gdpr_consent=&uid=8980672802649688197
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1

200
OK

bounce Show response
ib.adnxs.com/ Frame C7F1
Redirect Chain

https://ib.adnxs.com/async_usersync?cbfn=queuePixels
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

0
807 B

30ms
30ms

Script
text/html

185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:08 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 24a7cfdc-9e01-45a3-b32c-0feebab6cac4
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:08 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: cbdc9314-b312-4ee0-9add-a01b800c4f16
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 7F88 0
735 B 1087ms
30ms Script
text/html 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:08 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 9c99a44e-4361-49f2-83ca-aab33dfdeb74
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
secure.adnxs.com/ Frame 0E84 0
735 B 33ms
32ms Script
text/html 185.33.220.242
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/async_usersync?cbfn=AN_async_load

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.242 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:07 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 97df2983-c2ef-4923-9d7b-d8a4153c24a7
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
secure.adnxs.com/ Frame EA18 0
735 B 60ms
31ms Script
text/html 185.33.220.242
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/async_usersync?cbfn=AN_async_load

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.242 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:07 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: cdd49dca-4099-4866-8b34-b304240b9c11
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame C7F1 0
735 B 138ms
29ms Script
text/html 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:08 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 308880c7-b934-4609-85ed-2d70e1a14082
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 7F88 0
735 B 122ms
33ms Script
text/html 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jul 2021 01:34:08 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 1b4dbfbd-bf14-42eb-a84b-9be74fbffba0
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 dc_oe=ChMIv66LuNOJ8gIVX4WDBx3X4QemEAAYACD1tKBGQhMIusL1t9OJ8gIVssi7CB216QHQ;met=1;&timestamp=1627608848501;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=3;eid3=11;ecn3=1;etm3=0;eid5=12;ecn5=1;etm5=0;
ade.googlesyndication.com/ddm/activity/ Frame A7EC 42 B
254 B 91ms
88ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIv66LuNOJ8gIVX4WDBx3X4QemEAAYACD1tKBGQhMIusL1t9OJ8gIVssi7CB216QHQ;met=1;&timestamp=1627608848501;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=3;eid3=11;ecn3=1;etm3=0;eid5=12;ecn5=1;etm5=0;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95e7bd749df2d92ac77f09dee99613d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jul 2021 01:34:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIv66LuNOJ8gIVX4WDBx3X4QemEAAYACD1tKBGQhMIusL1t9OJ8gIVssi7CB216QHQ;met=1;&timestamp=1627608855242;eid1=2;ecn1=0;etm1=7;eid2=12;ecn2=0;etm2=6;eid4=14;ecn4=1;etm4=0;eid6=16;ecn6=1;etm6=0;eid8...
ade.googlesyndication.com/ddm/activity/ Frame A7EC 42 B
515 B 135ms
88ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIv66LuNOJ8gIVX4WDBx3X4QemEAAYACD1tKBGQhMIusL1t9OJ8gIVssi7CB216QHQ;met=1;&timestamp=1627608855242;eid1=2;ecn1=0;etm1=7;eid2=12;ecn2=0;etm2=6;eid4=14;ecn4=1;etm4=0;eid6=16;ecn6=1;etm6=0;eid8=960584;ecn8=1;etm8=0;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS