mobilesyrup.com Open in urlscan Pro
148.251.232.158 Public Scan

URL: https://www.facebook.com/MobileSyrup/

URL: https://www.youtube.com/mobilesyrup?sub_confirmation=1

URL: https://www.instagram.com/mobilesyrup/

URL: https://amzn.to/3dzVB22
Title: Big Deals

URL: https://amzn.to/346ASQn
Title: Latest Tech Deals

URL: https://www.mobilesyrup.planhub.ca/
Title: Rate Plans

URL: https://www.amazon.ca/?_encoding=UTF8&camp=15121&creative=330641&linkCode=ur2&tag=mobilescom06-20
Title: SyrupShop

URL: https://amzn.to/39QjHEw

URL: https://twitter.com/AiishaMalik1
Title: @AiishaMalik1

URL: https://arstechnica.com/gadgets/2021/07/google-boots-google-play-apps-for-stealing-users-facebook-passwords/
Title: told Ars Technica

URL: https://www.facebook.com/sharer/sharer.php?u=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Title: Facebook

URL: https://twitter.com/intent/tweet?text=Google+removes+nine+popular+apps+that+stole+users%27+Facebook+passwords&url=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Title: Twitter

URL: https://plus.google.com/share?url=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Title: Google+

URL: https://www.linkedin.com/shareArticle?url={https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/}&title={Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords}
Title: Linkedin

URL: https://reddit.com/submit?url={https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/}&title={Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords}
Title: Reddit

URL: https://www.reddit.com/domain/mobilesyrup.com/
Title: Reddit

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 57

https://sb.scorecardresearch.com/b?c1=2&c2=19290831&ns__t=1625510905148&ns_c=UTF-8&cv=3.5&c8=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&c7=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=19290831&ns__t=1625510905148&ns_c=UTF-8&cv=3.5&c8=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&c7=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&c9=

Request Chain 249

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/358847571/?random=1475344961&cv=9&fst=1625510905484&num=1&value=0&label=8EU5CPDDsbECENOojqsB&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg6u0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&tiba=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&auid=1253234708.1625510905&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=-VPjYIK5H4bl3wPBx4SgBg&sscte=1&crd=&eitems=ChAI8NuKhwYQvJWY7tius5pbEh0AtJj6CCfGxPlOr7ECbDEgl2cQOGcN8cC388_kSA HTTP 302
https://www.google.com/pagead/1p-conversion/358847571/?random=1475344961&cv=9&fst=1625510905484&num=1&value=0&label=8EU5CPDDsbECENOojqsB&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg6u0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&tiba=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&auid=1253234708.1625510905&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=-VPjYIK5H4bl3wPBx4SgBg&cid=CAQSKQCNIrLM2VNsQCKrSczLyc6VTsIuILBCHXToo2EtqvSFtY-cPR6yNNae&eitems=ChAI8NuKhwYQvJWY7tius5pbEh0AtJj6CC1Uin3WQUJZIK0JCzSZlKlHJa_iLYNa3w&random=1218614934&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-conversion/358847571/?random=1475344961&cv=9&fst=1625510905484&num=1&value=0&label=8EU5CPDDsbECENOojqsB&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg6u0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&tiba=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&auid=1253234708.1625510905&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=-VPjYIK5H4bl3wPBx4SgBg&cid=CAQSKQCNIrLM2VNsQCKrSczLyc6VTsIuILBCHXToo2EtqvSFtY-cPR6yNNae&eitems=ChAI8NuKhwYQvJWY7tius5pbEh0AtJj6CC1Uin3WQUJZIK0JCzSZlKlHJa_iLYNa3w&random=1218614934&resp=GooglemKTybQhCsO&ipr=y

Request Chain 258

https://r.skimresources.com/api/ HTTP 307
https://r.skimresources.com/api/?xguid=01F9W00200ZJFAM8TJBQA80G25&persistence=1&checksum=7d6a31522784e9fc938cdc76a53ddde058f1ac3e117c0f27c72302ad1a8565a0

Request Chain 277

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=123456&endpoint=us-west HTTP 301
https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west

Request Chain 278

https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fsa%3D%5Bsas_uid%5D HTTP 302
https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fsa%3D%5Bsas_uid%5D&cklb=1

Request Chain 279

https://scm.publishers.tremorhub.com/pubsync?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D HTTP 302
https://scm.publishers.tremorhub.com/pubsync/verify?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D

Request Chain 280

https://cs.admanmedia.com/sync/smaato?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fac%3D{$UID} HTTP 302
https://sb.freeskreen.com/um?ac={$UID}

Request Chain 310

https://pixel.adsafeprotected.com/rfw/st/741547/55522419/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd= HTTP 302
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=

Request Chain 318

https://optimized-by.rubiconproject.com/a/api/vast.xmlaccount_id=23502&site_id=374154&zone_id=%202049512&size_id=203&p_aso.video.minduration=5&p_aso.video.maxduration=300&p_aso.video.api=2&p_aso.video.mimes=application/javascript,video/mp4,video/webm&rp_secure=1&tg_c.language=en&width=603&height=338&rf=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&p_aso.video.protocols=2,3,5,6&rp_floor=5.0&p_aso.video.playbackmethod=2&p_pos=0&tg_i.= HTTP 307
https://vast.rubiconproject.com/a/api/vast.xmlaccount_id=23502&site_id=374154&zone_id=%202049512&size_id=203&p_aso.video.minduration=5&p_aso.video.maxduration=300&p_aso.video.api=2&p_aso.video.mimes=application/javascript,video/mp4,video/webm&rp_secure=1&tg_c.language=en&width=603&height=338&rf=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&p_aso.video.protocols=2,3,5,6&rp_floor=5.0&p_aso.video.playbackmethod=2&p_pos=0&tg_i.=?tk_vps=2

Request Chain 321

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENzGpaAseFr7sFwr7-BXlhc&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENzGpaAseFr7sFwr7-BXlhc&google_cver=1&C=1

Request Chain 322

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YONT.glzSMNNxuXTJnYyswAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAKvtW_Vr1Ercj4cV0T3YbU&google_cver=1&google_hm=2

Request Chain 323

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEAApv-H7UkvxmZ82f8psjV0&google_cver=1

Request Chain 324

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

Request Chain 326

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=smartadserver&endpoint=eu HTTP 301
https://eus.rubiconproject.com/usync.html?p=smartadserver&endpoint=eu

Request Chain 352

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=131961474&d_placement=306717470&d_campaign=26006000&d_bust=193138355&gdpr=&gdpr_consent= HTTP 302
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=131961474&d_placement=306717470&d_campaign=26006000&d_bust=193138355&gdpr=&gdpr_consent=

Request Chain 378

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEIB57-BL9wrDfhEDfT5qsjQ&google_cver=1&google_push=AYg5qPJYZnSv5pmsbjQWIjmUzrEdgGuR7pYlLzws6yUagtBkZBWpgyhgss6qSfExFljp_shT7RpdMoVxr4zO1I6WG1igJy26Hrnj HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEIB57-BL9wrDfhEDfT5qsjQ&google_push=AYg5qPJYZnSv5pmsbjQWIjmUzrEdgGuR7pYlLzws6yUagtBkZBWpgyhgss6qSfExFljp_shT7RpdMoVxr4zO1I6WG1igJy26Hrnj

Request Chain 379

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEDhqUs_mYPiDwJ-gD8oocrA&google_cver=1&google_push=AYg5qPJbFjISixLotht-lD7B5oGZA5f6Kxxa_9SK4F0lzF7gTu0vao5BAOEO5xXuSQBIi-zU0kk_TZPQ0Q2iltA1H0xf_kPPLdMT HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEDhqUs_mYPiDwJ-gD8oocrA&google_cver=1&google_push=AYg5qPJbFjISixLotht-lD7B5oGZA5f6Kxxa_9SK4F0lzF7gTu0vao5BAOEO5xXuSQBIi-zU0kk_TZPQ0Q2iltA1H0xf_kPPLdMT HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJbFjISixLotht-lD7B5oGZA5f6Kxxa_9SK4F0lzF7gTu0vao5BAOEO5xXuSQBIi-zU0kk_TZPQ0Q2iltA1H0xf_kPPLdMT&google_hm=N1lKI7BXQ0mWdDegNnVyBA==

Request Chain 380

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEG0I7kMBqHrJMnqtklmrZRs&google_cver=1&google_push=AYg5qPJ76e6znd9DYhRbbrz9eFNnSpUZBFtswNCwH-S_YK4AUYD5amLc_LzsFo08BJ-eeXyyBSHEqzYTqodIg49OX7idcsVl9Xrk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJ76e6znd9DYhRbbrz9eFNnSpUZBFtswNCwH-S_YK4AUYD5amLc_LzsFo08BJ-eeXyyBSHEqzYTqodIg49OX7idcsVl9Xrk&google_hm=MTk1OTMwMTg3MTYwMjI3NDI0NQ%3D%3D

Request Chain 381

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEDYjlHGvaZT-EzoL0xhB-2A&google_cver=1&google_push=AYg5qPJ7kBGMSLDYb6Ldu7amTkYZvS4bQKSSlwnSufWInT4kIu2XYIgyZd3PCzvVZvbdRJNSP-IfBsum7jWoMzT-h1EnhzInELk HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEDYjlHGvaZT-EzoL0xhB-2A&google_cver=1&google_push=AYg5qPJ7kBGMSLDYb6Ldu7amTkYZvS4bQKSSlwnSufWInT4kIu2XYIgyZd3PCzvVZvbdRJNSP-IfBsum7jWoMzT-h1EnhzInELk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzU3MTIzNjQzMjU0NDQ3OTIzMQ&google_push=AYg5qPJ7kBGMSLDYb6Ldu7amTkYZvS4bQKSSlwnSufWInT4kIu2XYIgyZd3PCzvVZvbdRJNSP-IfBsum7jWoMzT-h1EnhzInELk

Request Chain 382

https://rtb.openx.net/sync/dds?google_gid=CAESEOF9KaYPKFNOG4Wnwrcj-HE&google_cver=1&google_push=AYg5qPLIaAJwF0jKjvMipXsGQPvNdLOsbSlsy8D5Lz14Okng_Wo87_jkUzuK1QHtk817LnI1NzsEWTYxfqt8zpRvFcJY0XjUv_4 HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESEOF9KaYPKFNOG4Wnwrcj-HE&google_cver=1&google_push=AYg5qPLIaAJwF0jKjvMipXsGQPvNdLOsbSlsy8D5Lz14Okng_Wo87_jkUzuK1QHtk817LnI1NzsEWTYxfqt8zpRvFcJY0XjUv_4&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLIaAJwF0jKjvMipXsGQPvNdLOsbSlsy8D5Lz14Okng_Wo87_jkUzuK1QHtk817LnI1NzsEWTYxfqt8zpRvFcJY0XjUv_4&google_hm=SxVaEfrqwb0tZH_BgJv4Gg==

Request Chain 386

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAKvtW_Vr1Ercj4cV0T3YbU&google_cver=1

Request Chain 387

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YONT.uuebcUg9L1Ytyx5NQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAKvtW_Vr1Ercj4cV0T3YbU&google_cver=1&google_hm=2

Request Chain 388

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEHDB6eUGYQGj15tFabnRZOw&google_cver=1

Request Chain 389

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

Request Chain 430

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 434

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESELgc2vbVIctBpM7WxqbJ9y8&google_cver=1&google_push=AYg5qPJzV0NUHhvRK_8HxJVxUb60k92-ZDvuRZMaZnduqWbrwM2Zjk0HyqnXuSVjNVNHtxIDeqz4KB3KsW9VknZxectLbbfatZLVPg HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESELgc2vbVIctBpM7WxqbJ9y8&google_cver=1&google_push=AYg5qPJzV0NUHhvRK_8HxJVxUb60k92-ZDvuRZMaZnduqWbrwM2Zjk0HyqnXuSVjNVNHtxIDeqz4KB3KsW9VknZxectLbbfatZLVPg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SEVCVE85Q3IxTTB0RFI1&google_gid=CAESELgc2vbVIctBpM7WxqbJ9y8&google_cver=1&google_push=AYg5qPJzV0NUHhvRK_8HxJVxUb60k92-ZDvuRZMaZnduqWbrwM2Zjk0HyqnXuSVjNVNHtxIDeqz4KB3KsW9VknZxectLbbfatZLVPg

Request Chain 435

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEBvHNa8m1voNBqUy0BH1l1o&google_cver=1&google_push=AYg5qPLQfOhSZ9m6PfxID-4k0f3EX0v4N9A6p560EIzgC0_DZglrpZ0rQxufRmaZqXiZ9202RzhdvF--UB1eFdMe_VdjCVTUpfAIkQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WU9OVF93QUNjd2VyZWdBQw==&google_gid=CAESEBvHNa8m1voNBqUy0BH1l1o&google_cver=1&google_push=AYg5qPLQfOhSZ9m6PfxID-4k0f3EX0v4N9A6p560EIzgC0_DZglrpZ0rQxufRmaZqXiZ9202RzhdvF--UB1eFdMe_VdjCVTUpfAIkQ

Request Chain 437

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEIP5llkOX2lq21n1VJrV-Y8&google_cver=1&google_push=AYg5qPL5bo0PVXsPzGw4LVzoN7Edt3ue94IPfb485avQO80B8SgA3zzJRqcoI7P0fqE0QJPIf3N6i1ZU6cySQzieyYZ_hFR08Vu7Sw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPL5bo0PVXsPzGw4LVzoN7Edt3ue94IPfb485avQO80B8SgA3zzJRqcoI7P0fqE0QJPIf3N6i1ZU6cySQzieyYZ_hFR08Vu7Sw&google_hm=vXINS-3kRR2zOoVFKkt-b8s

Request Chain 438

https://rtb.openx.net/sync/dds?google_gid=CAESEP-TXmgqmm-9GoBmR3pIgvU&google_cver=1&google_push=AYg5qPKMs537-iVX8INGi9xF5IeExVfV7DMcLhAzpNbQB-qfQ1XCbQMDliVcpEYsks7IUsRMuUWp1kKGP5iWJ1nq7AD_P4PedQTEtQ HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESEP-TXmgqmm-9GoBmR3pIgvU&google_cver=1&google_push=AYg5qPKMs537-iVX8INGi9xF5IeExVfV7DMcLhAzpNbQB-qfQ1XCbQMDliVcpEYsks7IUsRMuUWp1kKGP5iWJ1nq7AD_P4PedQTEtQ&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKMs537-iVX8INGi9xF5IeExVfV7DMcLhAzpNbQB-qfQ1XCbQMDliVcpEYsks7IUsRMuUWp1kKGP5iWJ1nq7AD_P4PedQTEtQ&google_hm=SxVaEfrqwb0tZH_BgJv4Gg==

Request Chain 439

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHsTgJPINAtDpTbHF6lmZlc&google_cver=1&google_push=AYg5qPItj3_2KT07Sn3mSJPrncyIxQ-hsH-tB0CT21J79PQbcfXqIq3-64nohxHqTBfqkzWMVlEftENkr_TICURxaozUtM1Gv7iLcA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRWjgyWkYtOS04VTg0&google_push=AYg5qPItj3_2KT07Sn3mSJPrncyIxQ-hsH-tB0CT21J79PQbcfXqIq3-64nohxHqTBfqkzWMVlEftENkr_TICURxaozUtM1Gv7iLcA

Request Chain 457

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExPakPqnJGFEYuHdeFrGvo&google_cver=1

Request Chain 458

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YONT.uuebcUg9L1Ytyx5NQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExPakPqnJGFEYuHdeFrGvo&google_cver=1&google_hm=2

Request Chain 459

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEN1nnKFSqMCKliSWn_W5LKU&google_cver=1

Request Chain 460

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

Request Chain 471

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPL50CnSkCDICBxiYWsmQ6gPMigFWo_3kCYwtEHtBRhCoBtif6Nrl49nVtceWZ-7kMgiHKCOcanfeQ9M1HxpIioXvb95nFc&google_gid=CAESEA5X0JTKfV4Zp9aJ3rcxF4I&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU9OVF93QUNjd2VyZWdBQw&google_push=AYg5qPL50CnSkCDICBxiYWsmQ6gPMigFWo_3kCYwtEHtBRhCoBtif6Nrl49nVtceWZ-7kMgiHKCOcanfeQ9M1HxpIioXvb95nFc

Request Chain 472

https://a.tribalfusion.com/i.match?p=b6&u=CAESEMJ6bXfhOvQvdTpDNdOl0vg&google_cver=1&google_push=AYg5qPKjjkcb_vbECPlkw_bAu97gPnbkSGpN3fyqu5OfbyYvCNF-z8a9BjekgzW9rINFv7UxR1C-t5SqzIehbOK_-GZbBWOYa8NG&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKjjkcb_vbECPlkw_bAu97gPnbkSGpN3fyqu5OfbyYvCNF-z8a9BjekgzW9rINFv7UxR1C-t5SqzIehbOK_-GZbBWOYa8NG%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMJ6bXfhOvQvdTpDNdOl0vg&google_cver=1&google_push=AYg5qPKjjkcb_vbECPlkw_bAu97gPnbkSGpN3fyqu5OfbyYvCNF-z8a9BjekgzW9rINFv7UxR1C-t5SqzIehbOK_-GZbBWOYa8NG&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKjjkcb_vbECPlkw_bAu97gPnbkSGpN3fyqu5OfbyYvCNF-z8a9BjekgzW9rINFv7UxR1C-t5SqzIehbOK_-GZbBWOYa8NG%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 473

https://um.simpli.fi/gp_match?google_gid=CAESEIsRb6hBV16o9vgF7fSIYxc&google_cver=1&google_push=AYg5qPKQ-9pK2fRLPmMTWGeaQEidJEygBf2MpzkjchcDK9ygjad1ziUYQimPavhmNT4unF13XzQXEk-dNXNI_ibZ3rCC05h9wW8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=DF1F1FFB15B3482B9509E43C6B95C8A8&google_push=AYg5qPKQ-9pK2fRLPmMTWGeaQEidJEygBf2MpzkjchcDK9ygjad1ziUYQimPavhmNT4unF13XzQXEk-dNXNI_ibZ3rCC05h9wW8

Request Chain 476

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEGww_DzNzkDAscffLd6xtjk&google_cver=1&google_push=AYg5qPIdoAww3H-aTEVSmQs5pOSoy3pOuNT2wZ1WPkKUiXZamWerFrd9kzIK9RYoC5tO2hXF3qt9_OKrg3ChFbd2jmmeyp-8dSFY HTTP 302
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPIdoAww3H-aTEVSmQs5pOSoy3pOuNT2wZ1WPkKUiXZamWerFrd9kzIK9RYoC5tO2hXF3qt9_OKrg3ChFbd2jmmeyp-8dSFY&google_gid=CAESEGww_DzNzkDAscffLd6xtjk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzc1NTc0MDMwNTMwNTUwMjY0OQ%3D%3D&google_push=AYg5qPIdoAww3H-aTEVSmQs5pOSoy3pOuNT2wZ1WPkKUiXZamWerFrd9kzIK9RYoC5tO2hXF3qt9_OKrg3ChFbd2jmmeyp-8dSFY

Request Chain 501

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 521

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEObsvZ9A4rAYURkKfNO-OxY&google_cver=1

Request Chain 522

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YONT.uuebcUg9L1Ytyx5NQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEObsvZ9A4rAYURkKfNO-OxY&google_cver=1&google_hm=2

Request Chain 523

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEIkSlnISTKfTdUPnGUtG-4A&google_cver=1

Request Chain 524

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

Request Chain 535

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPIM_NWOkES8kMCXq_C_nHb7WHc6O_uApZlEMjY-qdRkV0wYv0tHEe88wTzDQMR_sAVm4qjCQAx2I7nTC7xKYVYR8YIu1cA&google_gid=CAESEMdKEHI1aFcOOu2XcvL0WFo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU9OVF93QUNjd2VyZWdBQw&google_push=AYg5qPIM_NWOkES8kMCXq_C_nHb7WHc6O_uApZlEMjY-qdRkV0wYv0tHEe88wTzDQMR_sAVm4qjCQAx2I7nTC7xKYVYR8YIu1cA

Request Chain 536

https://p.rfihub.com/cm?in=1&pub=445&google_gid=CAESEDmFRs9mg4rybufAoFktKsE&google_cver=1&google_push=AYg5qPJwVwsZG_-xdfEP1Y8BIg2tkq50a-whSMJy82DGbx7UKUNifCUkpluArSRuz26MK685bk-PnotdfyOQpToTcf0gICkIEcsi HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPJwVwsZG_-xdfEP1Y8BIg2tkq50a-whSMJy82DGbx7UKUNifCUkpluArSRuz26MK685bk-PnotdfyOQpToTcf0gICkIEcsi&google_hm=MTk2MTg1ODc5NjU1NDYyNzEwOQ== HTTP 302
https://a.rfihub.com/cm?pub=445&google_error=5

Request Chain 537

https://ads.travelaudience.com/google_pixel?google_gid=CAESEIRLD6X9Zgw5eoi5jSNWtW0&google_cver=1&google_push=AYg5qPJjr8Ro7A4KH3jTn4lRzvbnZQ3yzN7-xFq4uuG8HINsUgMMVRSuWbCF28oJkzTgPnH_my1OF6AC9U-g56TR9C5QmUR7rl3b HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=7KT3rRMeRT6FT9VGMX6MUg2&google_push=AYg5qPJjr8Ro7A4KH3jTn4lRzvbnZQ3yzN7-xFq4uuG8HINsUgMMVRSuWbCF28oJkzTgPnH_my1OF6AC9U-g56TR9C5QmUR7rl3b

Request Chain 539

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEPi1EsA-a5BR6Nm8EN4x3hg&google_cver=1&google_push=AYg5qPJRv3mO28iXadt_UjiYCP_6t6VUouhfnxIM3hhIQ6o41CwPS0BuJGQTSnVdoNTiUxawZzXWcSvN3TUwris4uw8EYUmK-Yd0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzU3MTIzNjQzMjU0NDQ3OTIzMQ&google_push=AYg5qPJRv3mO28iXadt_UjiYCP_6t6VUouhfnxIM3hhIQ6o41CwPS0BuJGQTSnVdoNTiUxawZzXWcSvN3TUwris4uw8EYUmK-Yd0

Request Chain 540

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESENh8PG-lNMZR9rQ2VdK5sGU&google_cver=1&google_push=AYg5qPLRnx9NNXpQxySGRTCgtfxQeyQd6_UWjzw3JizmtB1B84nSRJ_IJMYi8zwNpF36oTpEmZA8GDSdzqyOXKFfd58lT-Rip7hO HTTP 302
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPLRnx9NNXpQxySGRTCgtfxQeyQd6_UWjzw3JizmtB1B84nSRJ_IJMYi8zwNpF36oTpEmZA8GDSdzqyOXKFfd58lT-Rip7hO&google_gid=CAESENh8PG-lNMZR9rQ2VdK5sGU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzc1NTc0MDMwNTMwNTUwMjY0OQ%3D%3D&google_push=AYg5qPLRnx9NNXpQxySGRTCgtfxQeyQd6_UWjzw3JizmtB1B84nSRJ_IJMYi8zwNpF36oTpEmZA8GDSdzqyOXKFfd58lT-Rip7hO

Request Chain 562

https://track.adform.net/banners/scripts/rmb/Adform.DHTML.js HTTP 301
https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js

Request Chain 575

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJFhJCx6pkfmYLfdcq6ezxQ&google_cver=1

Request Chain 576

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YONT.uuebcUg9L1Ytyx5NQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJFhJCx6pkfmYLfdcq6ezxQ&google_cver=1&google_hm=2

Request Chain 577

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESECOwjJ8VW47rOfj7U3_kgN0&google_cver=1

Request Chain 578

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

Request Chain 585

https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=4e775e7643&subid=&uid=551be20ab2a21a60&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLh3__FPjYJL6IvyL7_UPkuWi2AO1zfmDV_zYuavlDPAuEAEgjpyOf2CV-vCBjAfIAQmpAoG0hkHc5rM-qAMBqgTTAU_QUNh_J-m_vjxf7ZyOtyfabjg67cTrDHyWOahhHKrZ1yLpg4uiFZcJxtgLpY7kntVZutrfAjWS9ivK7Co2FH3LodUKnoui4b5tvFruE9_chbef34U_u8YZ46i_UOFRi9FSeDHxVE54JZL3o7Td1ZmQGWiP6ihYdFnD9cttCJsyR357stGTJLkZMIRXDc0AcPbsCXfOGhshe3ZQthidiF-9xqYOy71RFNGio9vCWx-UJMJ1mg8QSkt34H5sqksVdsyiMHLz-6eVWgbJBXEGZETy3cDABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHYAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRoyQzlf-JIujcLcl26zhckBA%26sig%3DAOD64_0UwZrNx0qfTgRKJ01CrT2mkqyupg%26client%3Dca-pub-3056569219636903%26dbm_c%3DAKAmf-AYWhRAI5X5d23FWgkFrj7a9cF8pXio4Dp13v_832aqLNQzsgxHaowrnx1NTcmyfSK1nzYPcs2q7yfdxCjNOzyVN9325I3R6vlY8o5g002HiflGwVRQ1VCWmjnZL24sGbr2DfG4rlG2rWgQenrIBc66pRcZ6Q%26cry%3D1%26dbm_d%3DAKAmf-D2_MZFcrM_Q9CdpGa4mL0djSvs7Uzk5fJTqhF0Cx1lZH9qDFrnmcsIHVkhIJOs8Y57xgp6m1hTmFoGI5RZHV7FZJDGWTXcoqs8nJYZB9X4gQ_th47w7eCVCKzrFqd_21UtU2wsLeN48mzj-MhncgqmLvt2JGivUkQ_nHT0G_-djKeEhcXaTFFfdrN-RojUphaFrebBsjCMac06rLXxO5O-NgL4Yiqt65iVmAOn8l6Pj3j07vraIeIOJ6Ih5WEzuQugQHzf2FBa9sWpeFuqzcMXo21JfAx-ZvSJZx08YIINA6dahqci2ieKb7EetEoojmv3OxDTSABB6JfWOS7K46EI6WhB8rEMvLaADZXpveOCoCI7MebCFZmPn3NNWaiNgxwXNlhG2CRspPWEjuFcIQ1cXG6cApKmYSIH4SbGt9Mzr1w4Dgouh9ry8EwPY6RwurZ6uFaOnVH753ihzP16oF6vwgbMV29-IiznOT-AU4hXpEFyO5LZaQg1pprOUBRw2YM1KUJgrlk02OGKKIzavA02NHConpOASSuOfkasIdEyTOyMJP0%26adurl%3D&documentReferer=https%3A%2F%2Fmobilesyrup.com%2F&ancestorOrigins=https%3A%2F%2Fmobilesyrup.com&random=5818784217050&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=4e775e7643&subid=&uid=551be20ab2a21a60&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLh3__FPjYJL6IvyL7_UPkuWi2AO1zfmDV_zYuavlDPAuEAEgjpyOf2CV-vCBjAfIAQmpAoG0hkHc5rM-qAMBqgTTAU_QUNh_J-m_vjxf7ZyOtyfabjg67cTrDHyWOahhHKrZ1yLpg4uiFZcJxtgLpY7kntVZutrfAjWS9ivK7Co2FH3LodUKnoui4b5tvFruE9_chbef34U_u8YZ46i_UOFRi9FSeDHxVE54JZL3o7Td1ZmQGWiP6ihYdFnD9cttCJsyR357stGTJLkZMIRXDc0AcPbsCXfOGhshe3ZQthidiF-9xqYOy71RFNGio9vCWx-UJMJ1mg8QSkt34H5sqksVdsyiMHLz-6eVWgbJBXEGZETy3cDABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHYAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRoyQzlf-JIujcLcl26zhckBA%26sig%3DAOD64_0UwZrNx0qfTgRKJ01CrT2mkqyupg%26client%3Dca-pub-3056569219636903%26dbm_c%3DAKAmf-AYWhRAI5X5d23FWgkFrj7a9cF8pXio4Dp13v_832aqLNQzsgxHaowrnx1NTcmyfSK1nzYPcs2q7yfdxCjNOzyVN9325I3R6vlY8o5g002HiflGwVRQ1VCWmjnZL24sGbr2DfG4rlG2rWgQenrIBc66pRcZ6Q%26cry%3D1%26dbm_d%3DAKAmf-D2_MZFcrM_Q9CdpGa4mL0djSvs7Uzk5fJTqhF0Cx1lZH9qDFrnmcsIHVkhIJOs8Y57xgp6m1hTmFoGI5RZHV7FZJDGWTXcoqs8nJYZB9X4gQ_th47w7eCVCKzrFqd_21UtU2wsLeN48mzj-MhncgqmLvt2JGivUkQ_nHT0G_-djKeEhcXaTFFfdrN-RojUphaFrebBsjCMac06rLXxO5O-NgL4Yiqt65iVmAOn8l6Pj3j07vraIeIOJ6Ih5WEzuQugQHzf2FBa9sWpeFuqzcMXo21JfAx-ZvSJZx08YIINA6dahqci2ieKb7EetEoojmv3OxDTSABB6JfWOS7K46EI6WhB8rEMvLaADZXpveOCoCI7MebCFZmPn3NNWaiNgxwXNlhG2CRspPWEjuFcIQ1cXG6cApKmYSIH4SbGt9Mzr1w4Dgouh9ry8EwPY6RwurZ6uFaOnVH753ihzP16oF6vwgbMV29-IiznOT-AU4hXpEFyO5LZaQg1pprOUBRw2YM1KUJgrlk02OGKKIzavA02NHConpOASSuOfkasIdEyTOyMJP0%26adurl%3D&documentReferer=https%3A%2F%2Fmobilesyrup.com%2F&ancestorOrigins=https%3A%2F%2Fmobilesyrup.com&random=5818784217050&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 607

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGH55P7kiUAD1aS9u5thjS0&google_cver=1

Request Chain 608

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YONT.uuebcUg9L1Ytyx5NQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGH55P7kiUAD1aS9u5thjS0&google_cver=1&google_hm=2

Request Chain 609

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEPdvnfF-eVoaS6L10EPeLHY&google_cver=1

Request Chain 610

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

Request Chain 617

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=10083600184413200710612011646020 HTTP 302
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=739274653

Request Chain 619

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2365766942013.8716 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CLmz_YLMzPECFa4UBgAdIUAH5A;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2365766942013.8716

Request Chain 626

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEIMo2L53CbYnYVuXTYsbug0&google_cver=1&google_push=AYg5qPJsgvlYf6FF4gzvO00ND98wLOMrOogdN0Bj4OkIURKx9dweT_udzD9OizBXBSlCfbGmfd76bC03OhFuoEzuV1-XeJFQoCM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjQwMDYwMjE2NDc0Njg1Mjg5Nw== HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESED6GtT1LXoFDyjEZpCIzhxg&google_cver=1

Request Chain 629

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEF4KV6V0ztxgjBasaqoZWGQ&google_cver=1&google_push=AYg5qPLpmgcZPeeYWylDcp-7IfQ9x4iQokV-Iz9QJgFdnXhQIOdaMZsHX-7LHd_6kW9lJpqgbuZJtQzSreZvJdv8hlMRsyyCTNk HTTP 302
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=37594a23-b057-4349-9674-37a036757204 HTTP 302
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=37594a23-b057-4349-9674-37a036757204 HTTP 302
https://x.bidswitch.net/sync?dsp_id=4&user_id=e944c7aa-02d2-4d61-ac35-136b00b0cca2&ssp=google&expires=30&user_group=5&bsw_param=37594a23-b057-4349-9674-37a036757204 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPLpmgcZPeeYWylDcp-7IfQ9x4iQokV-Iz9QJgFdnXhQIOdaMZsHX-7LHd_6kW9lJpqgbuZJtQzSreZvJdv8hlMRsyyCTNk&google_hm=N1lKI7BXQ0mWdDegNnVyBA==

Request Chain 630

https://d5p.de17a.com/cookies/google?google_gid=CAESEGGeLEtZIcK8HSsaUMwXqMg&google_cver=1&google_push=AYg5qPILE7xw6FSaa5UlfkmXUwWt9hSztO6cqnoQw-XMu1VbTx85esR9Tu7Jw831YsouG0cP5LcqX2QJYWZqrvEylcioOpXLQA HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEGGeLEtZIcK8HSsaUMwXqMg&google_cver=1&google_push=AYg5qPILE7xw6FSaa5UlfkmXUwWt9hSztO6cqnoQw-XMu1VbTx85esR9Tu7Jw831YsouG0cP5LcqX2QJYWZqrvEylcioOpXLQA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPILE7xw6FSaa5UlfkmXUwWt9hSztO6cqnoQw-XMu1VbTx85esR9Tu7Jw831YsouG0cP5LcqX2QJYWZqrvEylcioOpXLQA

Request Chain 631

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_cver=1&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3IaeXwPt7_NcQJMicDFCSSRGttmp08i5ECv9-1Pk93FnUn7eLjUI&google_cver=1&google_tc=

Request Chain 632

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEBM0Lx34g27g8V5Zityf5Yk&google_cver=1&google_push=AYg5qPJY4UmjxZzq27uOiCSI88tUmKW5WevbWI6sfVo67IA3UALjqAiYJoyS9DFfLWVpjWJSphSQxbfvHdGGK7n45WxHK1_PW2yD HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1HTTNfeC5aRTJ1RmtTb0VwQ0RucUIyMFBnaXNTbkp5Wn5B&google_push=AYg5qPJY4UmjxZzq27uOiCSI88tUmKW5WevbWI6sfVo67IA3UALjqAiYJoyS9DFfLWVpjWJSphSQxbfvHdGGK7n45WxHK1_PW2yD HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1HTTNfeC5aRTJ1RmtTb0VwQ0RucUIyMFBnaXNTbkp5Wn5B&google_push=AYg5qPJY4UmjxZzq27uOiCSI88tUmKW5WevbWI6sfVo67IA3UALjqAiYJoyS9DFfLWVpjWJSphSQxbfvHdGGK7n45WxHK1_PW2yD&google_tc=

Request Chain 636

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEPTYBuwrokFqwhxBKwrURIY&google_cver=1&google_push=AYg5qPLdqfmxXkMKosxaBKj2O9fU8spXkDmHncHEGo5OC3OmMzNBsE1nOAwTYV9gtUzaFoZqSWELWUgETYgi1c833muBIN2evjM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk4MTUxNjIyNzgwNjI5NjIxNw%3D%3D&google_push=AYg5qPLdqfmxXkMKosxaBKj2O9fU8spXkDmHncHEGo5OC3OmMzNBsE1nOAwTYV9gtUzaFoZqSWELWUgETYgi1c833muBIN2evjM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk4MTUxNjIyNzgwNjI5NjIxNw%3D%3D&google_push=AYg5qPLdqfmxXkMKosxaBKj2O9fU8spXkDmHncHEGo5OC3OmMzNBsE1nOAwTYV9gtUzaFoZqSWELWUgETYgi1c833muBIN2evjM&google_tc=

Request Chain 637

https://d5p.de17a.com/cookies/google?google_gid=CAESED9wnwP-RHALrwUnyuQpLqo&google_cver=1&google_push=AYg5qPK_fa-NJ5C3XFqkQtO25abtr4XCSRIgnmNvVXM-VgQE_tLAP_PU3BvfhAEeqvwJt6CM0C79MMZtPgNXR3jwqVxPemRM9A HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESED9wnwP-RHALrwUnyuQpLqo&google_cver=1&google_push=AYg5qPK_fa-NJ5C3XFqkQtO25abtr4XCSRIgnmNvVXM-VgQE_tLAP_PU3BvfhAEeqvwJt6CM0C79MMZtPgNXR3jwqVxPemRM9A HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPK_fa-NJ5C3XFqkQtO25abtr4XCSRIgnmNvVXM-VgQE_tLAP_PU3BvfhAEeqvwJt6CM0C79MMZtPgNXR3jwqVxPemRM9A

Request Chain 638

https://rtb.openx.net/sync/dds?google_gid=CAESEOXk8cJGM1163edwyDSk6xk&google_cver=1&google_push=AYg5qPKWZSRz2PBtjOkjtqdCBjfwv9blRajqi31si-dd5kCW22NuVXo2yoH05i6aj1UvahUksSaL_n4xj5UebDnyFN8Y_LcxYdk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKWZSRz2PBtjOkjtqdCBjfwv9blRajqi31si-dd5kCW22NuVXo2yoH05i6aj1UvahUksSaL_n4xj5UebDnyFN8Y_LcxYdk&google_hm=SxVaEfrqwb0tZH_BgJv4Gg==

Request Chain 639

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEFra5rBHb6TOcwJKmfQ8QPg&google_cver=1&google_push=AYg5qPIIGEUSd_L3_dLGGdyWv-HN3NUcipwDt8SQpPjNAMawM7vu-xSOhs_Qg-d7lNGzS71RVjohZEz1s7YaYW8clSvYLOD1wEU HTTP 307
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEFra5rBHb6TOcwJKmfQ8QPg&google_cver=1&google_push=AYg5qPIIGEUSd_L3_dLGGdyWv-HN3NUcipwDt8SQpPjNAMawM7vu-xSOhs_Qg-d7lNGzS71RVjohZEz1s7YaYW8clSvYLOD1wEU&sovrn_retry=true HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIIGEUSd_L3_dLGGdyWv-HN3NUcipwDt8SQpPjNAMawM7vu-xSOhs_Qg-d7lNGzS71RVjohZEz1s7YaYW8clSvYLOD1wEU&google_hm=52192cf610b163185d99b45b

Request Chain 640

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEK_MI3pmJDuSOjJR82H4dqc&google_cver=1&google_push=AYg5qPJM8P1eGXMIEZzKKuLfHbcvkuSZ1XbKQ1coEBUcrvDV-L1cMIA6B5Gh9AyLGQOlK__rXwLRvfSw6ZMxxOx9DovMNXULz9g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzc1NTc0MDMwNTMwNTUwMjY0OQ%3D%3D&google_push=AYg5qPJM8P1eGXMIEZzKKuLfHbcvkuSZ1XbKQ1coEBUcrvDV-L1cMIA6B5Gh9AyLGQOlK__rXwLRvfSw6ZMxxOx9DovMNXULz9g

676 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/ 682 KB
87 KB 48ms
11ms Document
text/html 148.251.232.158
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 148.251.232.158 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.158.232.251.148.clients.your-server.de
Software: nginx /
Resource Hash: a9c21518e5a56a6f990777579b7eedb60974f413ee2c7a41ef3a064f5627411a

Request headers

:method: GET
:authority: mobilesyrup.com
:scheme: https
:path: /2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: nginx
date: Mon, 05 Jul 2021 18:48:24 GMT
content-type: text/html; charset=UTF-8
link: <https://mobilesyrup.com/wp-json/>; rel="https://api.w.org/" <https://mobilesyrup.com/wp-json/wp/v2/posts/818895>; rel="alternate"; type="application/json" <https://mobilesyrup.com/?p=818895>; rel=shortlink
vary: Accept-Encoding, Cookie
last-modified: Mon, 05 Jul 2021 18:43:19 GMT
x-presslabs-stats: HIT; 0.561s; 19 queries; desktop; ttl 1800s; refresh in 1494s
content-encoding: gzip
x-request-id: 585ca63243ce50e3a64d6a5c3737ee80

GET
H/1.1 200
OK 185231-236799431399759.js Show response
js-sec.indexww.com/ht/p/ 128 KB
36 KB 776ms
732ms Script
text/javascript 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/p/185231-236799431399759.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 31a0a791e0c89b78baa42e4f91c58411342f6007b86841a5d2cc88bbea8ddc70

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:25 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Jul 2021 18:46:05 GMT
Server: Apache
ETag: "76494e-20169-5c664b7c8e7f6"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 36808
Expires: Mon, 05 Jul 2021 19:48:25 GMT

GET
H2 200 merge.118887.js Show response
cdn.districtm.ca/merge/ 110 KB
25 KB 198ms
170ms Script
application/x-javascript 2606:4700::6812:623c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.ca/merge/merge.118887.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:623c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 443167659c10b6ea5578ba1c8e90ecbc4435fa3cede4db78602870c218b45736

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: br
cf-cache-status: HIT
age: 633
cf-polished: origSize=247985
last-modified: Fri, 29 Jan 2021 17:25:08 GMT
x-amz-request-id: EZPSB029GTERBP3A
x-amz-id-2: HrctztmWD45ZHkALdtHZqt7mi15yKGmmZCMsNpQgoXtTep9AkvpzwZP5+sMTXjOpVwBnc8e4viQ=
cf-bgj: minify
server: cloudflare
etag: W/"d6059f33be62b38cf7db96dd01b2b49f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=172800
x-amz-version-id: KlrNKKWRLuphhpsR5ptYXFgNMDBHn13M
cf-ray: 66a2c472aebc5364-FRA
expires: Wed, 07 Jul 2021 18:48:24 GMT

GET
H2 200 widget.js Show response
widgets.stackcommerce.com/js-deal-feed/0.1/ 7 KB
4 KB 78ms
16ms Script
application/javascript 13.224.193.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.stackcommerce.com/js-deal-feed/0.1/widget.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-5.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4cdd8915b932a7542577e40be604465a2362ab1db586216d1c5bf77b92f17a9e

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 17:35:43 GMT
content-encoding: gzip
last-modified: Mon, 27 Mar 2017 18:58:24 GMT
server: AmazonS3
age: 4430
etag: W/"a3fefcff117106b2ebe4c2729e7cf7b9"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
cache-control: max-age=7200
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: nNLm2XyHiNFFh3mTm1aF5xQOUnfXPgBiXLuxJ1h3GjRG9FCLWuBUYQ==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 91 KB
36 KB 24ms
19ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-3143766-2

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

eac16fa2cbee367b641d99beea4f0ccab7ccd7784d99c83594591f316ae626f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37017
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 05 Jul 2021 18:48:24 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 68 KB
24 KB 36ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c92507091d4ca75383b6af1979ce09e3b413d1ebfd8ab3754a688905f627b3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "922 / 776 of 1000 / last-modified: 1625264026"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24229
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:24 GMT

GET
H2 200 style.min.css
cdn.mobilesyrup.com/wp-includes/css/dist/block-library/ 53 KB
10 KB 58ms
11ms Stylesheet
text/css 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-includes/css/dist/block-library/style.min.css
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Thu, 27 Aug 2020 18:00:38 GMT
server: nginx
etag: W/"5f47f4c6-d293"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: text/css
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 6d5e22ec8b816a1bccd40cc2d44e23e4
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 styles.css
cdn.mobilesyrup.com/wp-content/plugins/contact-form-7/includes/css/ 2 KB
1 KB 61ms
14ms Stylesheet
text/css 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/plugins/contact-form-7/includes/css/styles.css
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: fbf8ab57db7f9981bd71d79c7daaa01a3c578ffa0aa8e9b4a9b2bfe2e9927427

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:00 GMT
server: nginx
etag: W/"60d2d1a0-780"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: text/css
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 6d5e22ec8b816a1bccd40cc2d44e23e4
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 ctf-styles.min.css
cdn.mobilesyrup.com/wp-content/plugins/custom-twitter-feeds/css/ 15 KB
4 KB 61ms
14ms Stylesheet
text/css 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/plugins/custom-twitter-feeds/css/ctf-styles.min.css
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 6a360fb959551957e70a7cd4da97893c04b98d9a8378fc548aee38adac30ac97

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:00 GMT
server: nginx
etag: W/"60d2d1a0-3a6f"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: text/css
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 6d5e22ec8b816a1bccd40cc2d44e23e4
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 survey-style.css
cdn.mobilesyrup.com/wp-content/plugins/survey//css/ 583 B
571 B 61ms
15ms Stylesheet
text/css 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/plugins/survey//css/survey-style.css
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: d4fdbafb5785c3ee59c2e243433484bf3f2feffca92b212b33831e2fc8ec7bd2

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-247"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: text/css
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 6d5e22ec8b816a1bccd40cc2d44e23e4
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cff-style.css
cdn.mobilesyrup.com/wp-content/plugins/custom-facebook-feed/assets/css/ 20 KB
5 KB 68ms
22ms Stylesheet
text/css 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/plugins/custom-facebook-feed/assets/css/cff-style.css
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 2eb9db281898ed67b0536a7da28db71652fc77ea9a705b47225a355eb558e5b4

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:00 GMT
server: nginx
etag: W/"60d2d1a0-5029"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: text/css
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 4a9ddb668d67e829c2e0b3165f53f94b
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 43ms
28ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 723, 617, 617
age: 9064260
cdn-cachedat: 2021-03-11 11:57:51
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 50f270cef956c80b14f61fa9ad96c573
cf-ray: 66a2c4728c3e3233-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 200 slick.css
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dev/scss/vendor/slick/ 2 KB
857 B 67ms
21ms Stylesheet
text/css 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dev/scss/vendor/slick/slick.css?v=1.8.07
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: f8f2f381ccb178875d40e22146436311efd56d6fe99dfc9c6ae5f6d64fa1fc8f

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-68a"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: text/css
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 4a9ddb668d67e829c2e0b3165f53f94b
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 slick-theme.css
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dev/scss/vendor/slick/ 3 KB
1 KB 67ms
22ms Stylesheet
text/css 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dev/scss/vendor/slick/slick-theme.css?v=1.8.07
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 769aeb1005a870e0f7826f6c4ac2747da3e7b30088839c33fd7e4edf6b0476c4

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-c9f"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: text/css
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 4a9ddb668d67e829c2e0b3165f53f94b
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.jscrollpane.css
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dev/scss/vendor/jscrollpane/ 1 KB
862 B 68ms
23ms Stylesheet
text/css 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dev/scss/vendor/jscrollpane/jquery.jscrollpane.css?v=1.8.07
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 4ac22fd8ef4140093daf567fda0e2447e470f48acd1e76f5b7a2fc59705fbfc6

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-563"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: text/css
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 0e207c77900319f0290d7b7c0fd2a8c5
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/ 191 KB
33 KB 61ms
16ms Stylesheet
text/css 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 87ea6c69197512fc264dbdd74e2349a2f559b51d7f52e5000cb98603a268888e

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-2fc91"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: text/css
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 6d5e22ec8b816a1bccd40cc2d44e23e4
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jetpack.css
cdn.mobilesyrup.com/wp-content/plugins/jetpack/css/ 75 KB
17 KB 67ms
23ms Stylesheet
text/css 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/plugins/jetpack/css/jetpack.css
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 50230a768774ba88bdeb31d5bf3cdcd95b90248334753ab4256aed572396d97b

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:00 GMT
server: nginx
etag: W/"60d2d1a0-12d1d"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: text/css
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 0e207c77900319f0290d7b7c0fd2a8c5
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.js Show response
cdn.mobilesyrup.com/wp-includes/js/jquery/ 95 KB
33 KB 68ms
24ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-includes/js/jquery/jquery.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Fri, 17 May 2019 04:25:54 GMT
server: nginx
etag: W/"5cde37d2-17a69"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 0e207c77900319f0290d7b7c0fd2a8c5
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 toplytics.js Show response
cdn.mobilesyrup.com/wp-content/plugins/toplytics/js/ 2 KB
983 B 72ms
28ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/plugins/toplytics/js/toplytics.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: b948095f5136061712b38aa9a45a68ab56353d3a46d8b2469d25ac885a5ea32f

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-6ff"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 0e207c77900319f0290d7b7c0fd2a8c5
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 tsg_new_window.js Show response
cdn.mobilesyrup.com/wp-content/plugins/podcasting/js/ 509 B
557 B 67ms
24ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/plugins/podcasting/js/tsg_new_window.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: ae39b13ea0e2c83b2fc4e5454875fa869e884b64c920a098dcc5d583bb5b33bc

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-1fd"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 0e207c77900319f0290d7b7c0fd2a8c5
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 ad_script.js Show response
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/ads/ 23 KB
2 KB 71ms
28ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/ads/ad_script.js?v=1.8.07
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 43721baa4ae355ea8d5d46a430cc1f92a395105936511a77966aad8e6851bc53

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-5c25"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 0e207c77900319f0290d7b7c0fd2a8c5
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 swfobject.js Show response
cdn.mobilesyrup.com/wp-includes/js/ 10 KB
4 KB 70ms
27ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-includes/js/swfobject.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 5fc71212d5f80194f946cc9239d030aae8b51879ec22bd6f9a793c49e543d1c0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Tue, 17 Apr 2012 23:09:29 GMT
server: nginx
etag: W/"4f8df829-27f7"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 0e207c77900319f0290d7b7c0fd2a8c5
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 audio-player-noswfobject.js Show response
cdn.mobilesyrup.com/wp-content/plugins/podcasting/player/ 974 B
843 B 70ms
28ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/plugins/podcasting/player/audio-player-noswfobject.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 5f50a11610a225d84da90e2821ada8bdf894f63fff54d7e5786e04bda3b3849e

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-3ce"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 0e207c77900319f0290d7b7c0fd2a8c5
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 204 index.html
cdn.districtm.io/ids/ Frame 4E6E 0
0 81ms
36ms Document
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: cdn.districtm.io
:scheme: https
:path: /ids/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mobilesyrup.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Origin
access-control-allow-methods: GET, HEAD, POST, OPTIONS
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 66a2c47418de6900-CDG

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 97 KB
37 KB 32ms
28ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TSKNMLG

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1d853cf9e2b41497c0ac712ca68a51570c06d77323d29aba802af80fd5d38fe6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38098
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 05 Jul 2021 18:48:24 GMT

GET
H2 200 beacon.js Show response
sb.scorecardresearch.com/ 1 KB
2 KB 49ms
13ms Script
application/javascript 13.225.87.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.89 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-89.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:25:52 GMT
via: 1.1 590590f04f79f692591f9db0e720a31d.cloudfront.net (CloudFront)
etag: "1827f116c73f319409b97f10b8a58ade"
last-modified: Fri, 26 Feb 2021 14:35:05 GMT
server: AmazonS3
age: 1353
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 1469
x-amz-cf-id: IcEixVNof2unVRGphfpc8GtTI608BZP8e5QAPrHkFKqj6HG3VNf31A==

GET
H2 200 wp-emoji-release.min.js Show response
cdn.mobilesyrup.com/wp-includes/js/ 14 KB
5 KB 15ms
11ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-includes/js/wp-emoji-release.min.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 8cb438bd4d1961f80ade4f1a295ca7de253630adcdd10473932908e638908c5e

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Mon, 15 Jun 2020 18:04:26 GMT
server: nginx
etag: W/"5ee7b82a-37a6"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: c2c6b472a1cae31cbbd98105e91e3477
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK embedder Show response
adserver.pressboard.ca/v3/ 351 B
789 B 462ms
96ms Script
application/x-javascript 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver.pressboard.ca/v3/embedder?media=100238
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e6cfd6e22027175b15f64895782240778af12c14ba5e426230bb1b53c0e148a9

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:24 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 351
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

GET
H2 200 RgPSN0siEWzj.js Show response
mobilesyrup.com/ 2 KB
1 KB 14ms
11ms Script
application/javascript 148.251.232.158
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mobilesyrup.com/RgPSN0siEWzj.js?ts=40225
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 148.251.232.158 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.158.232.251.148.clients.your-server.de
Software: nginx /
Resource Hash: 4cd455b279ff15af7777bba05e2fcc23be5a04a8b4a3b271023fcc05ff8bd6c2

Request headers

:path: /RgPSN0siEWzj.js?ts=40225
pragma: no-cache
cookie: dmxRegion=false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: mobilesyrup.com
referer: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Thu, 17 Jun 2021 11:05:19 GMT
server: nginx
etag: W/"60cb2c6f-962"
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache
x-presslabs-stats: desktop
x-request-id: 364cf1fd6c6272cf6158d1edbba02f9e
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 95 KB
25 KB 22ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f2a2056b7a1c989899886a9b194e93912b7d11767239e956de73d5c2ea237b32

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 24676
x-xss-protection: 0
pragma: public
x-fb-debug: EzdmcBO67sLh7trDB5CAY2SjZUP7A93g/aQBFwkHkKg5eQGrPbI17VVpogHU4oK4LxQCLA0OxeVDn4OcUJfBMA==
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 05 Jul 2021 18:48:24 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ping.js Show response
www.stack-sonar.com/ 6 KB
3 KB 60ms
14ms Script
application/javascript 99.86.4.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.stack-sonar.com/ping.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-5.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 30ffa03f71b651ba0851f8cb6bb6cb774bb1ca0efe27de779194dbc428f2ec34

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 17:56:49 GMT
content-encoding: gzip
last-modified: Wed, 06 Jan 2021 02:44:46 GMT
server: AmazonS3
age: 3097
etag: W/"5673f18958f259286166f3c33dafdd4b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 82e9051d8d41080bd3028731e0e8677f.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: Vfb5iZYDafC28lfdeBc_XKNhkLX-6Kw2GhDgx8BtanTcZuLVDnMevQ==

GET
H2 200 Nav-social-twitter.svg
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/ 1 KB
1017 B 13ms
11ms Image
image/svg+xml 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/Nav-social-twitter.svg
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 26fa17457aaa027d2e87bb31a1805a355ed9d517ad5dd1523e6aaaf0f65af5ff

Request headers

Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-4e0"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: c2fd59f239bc013c0d417d523fded674
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Nav-social-facebook.svg
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/ 764 B
786 B 14ms
11ms Image
image/svg+xml 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/Nav-social-facebook.svg
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 425659eaa6de853d56bd28b4823670312e5b6f81b9b368ec4ca0743c14fd945c

Request headers

Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-2fc"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: c2fd59f239bc013c0d417d523fded674
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Nav-social-youtube.svg
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/ 2 KB
1 KB 14ms
12ms Image
image/svg+xml 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/Nav-social-youtube.svg
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: eccfead73829625d72ed0179efea19bd81c8c61a7b093c2b49535924f26aef12

Request headers

Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-915"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: c2fd59f239bc013c0d417d523fded674
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Nav-social-instagram.svg
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/ 5 KB
2 KB 15ms
13ms Image
image/svg+xml 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/Nav-social-instagram.svg
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 0505ecec3856eb01341a2e50cc519c1c09a417dc26dacbf91f34cf0c4e565cf0

Request headers

Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-12f0"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: d6fb272ecdedb96890b915284d828077
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Nav-Large-logo.svg
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/ 15 KB
4 KB 16ms
13ms Image
image/svg+xml 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/Nav-Large-logo.svg
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: a80ef71b264052e2510ca9c91d7ab19ea4e8230f67b79712a20ed16804f7906e

Request headers

Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-3d1e"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: d6fb272ecdedb96890b915284d828077
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 main-search-icon.svg
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/ 944 B
853 B 16ms
14ms Image
image/svg+xml 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/main-search-icon.svg
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 198bd12812dc77286cd4ccddcea0434728a14cc75bbf4ced5494ac8adf1b4e2f

Request headers

Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:24 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-3b0"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: d6fb272ecdedb96890b915284d828077
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 RobotoSlab-Regular-webfont.woff
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/fonts/ 28 KB
29 KB 46ms
12ms Font
application/font-woff 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/fonts/RobotoSlab-Regular-webfont.woff
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 2c492e2b9c2a3f0df21c5f0155181cb651024f6865327e54111589d9452bea09

Request headers

Origin: https://mobilesyrup.com
Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-length: 29108
x-request-id: b7c817fad4bc9ed5f33b02f9b2278665
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: "60d2d1a1-71b4"
x-presslabs-cache: HIT
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,OPTIONS
content-type: application/font-woff
access-control-allow-origin: https://mobilesyrup.com
access-control-expose-headers: Content-Length,Content-Range,X-WP-Total,X-WP-TotalPages,Link
cache-control: max-age = 315360000
accept-ranges: bytes
x-cache-groups: assets
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-WP-Nonce
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 proxima-regular.woff
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/fonts/ 56 KB
57 KB 49ms
20ms Font
application/font-woff 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/fonts/proxima-regular.woff
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 5bab7b8bc534a7839e070986c3f80fd5ba3433abc3ff2eb81466221538b63433

Request headers

Origin: https://mobilesyrup.com
Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-length: 57649
x-request-id: b7c817fad4bc9ed5f33b02f9b2278665
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: "60d2d1a1-e131"
x-presslabs-cache: HIT
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,OPTIONS
content-type: application/font-woff
access-control-allow-origin: https://mobilesyrup.com
access-control-expose-headers: Content-Length,Content-Range,X-WP-Total,X-WP-TotalPages,Link
cache-control: max-age = 315360000
accept-ranges: bytes
x-cache-groups: assets
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-WP-Nonce
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 135 KB
48 KB 46ms
24ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

88d57c9feb352966376fbe15a592ede0c36fe69e9d015b1cabeac36d3cad3e76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48722
x-xss-protection: 0
server: cafe
etag: 10107962297800099237
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 05 Jul 2021 18:48:25 GMT

GET
H3-29 200 identity.js Show response
connect.facebook.net/signals/plugins/ 11 KB
5 KB 8ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/identity.js?v=2.9.43

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3bea34f20c813024f046166fb0ad98a8eb93d5ab93052ceb993eee238ece5b66

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 4673
x-xss-protection: 0
pragma: public
x-fb-debug: greO46mWzUis9NrMGnJNSQ5yRX49PjnPPtOFycSdKdOzQHYA9KgWiq35A9FXFwk2VWNSOe8kIAOUPIg/Dm5gPQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 05 Jul 2021 18:48:25 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29 200 132905745411807 Show response
connect.facebook.net/signals/config/ 260 KB
74 KB 9ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/132905745411807?v=2.9.43&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5978b43c55c9c4159059e85590ced0aaf0bfeb9baba5c72b0e1e327e6dc004be

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 75537
x-xss-protection: 0
pragma: public
x-fb-debug: bxTK1mZV07C/qKPUgENqE2dfXHksi5h7097gxd8KcS4ld81+NEq3wpIorkqpXMgyan8roYrk6p9TKeq251H7Mw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 05 Jul 2021 18:48:25 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 jquery.ThreeDots.min.js Show response
cdn.rawgit.com/theproductguy/ThreeDots/50f2b38b5dc3f92ff2095e5804e73baf66e5b2b5/js/ 4 KB
2 KB 98ms
32ms Script
application/javascript 185.59.220.198
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.rawgit.com/theproductguy/ThreeDots/50f2b38b5dc3f92ff2095e5804e73baf66e5b2b5/js/jquery.ThreeDots.min.js

Requested by

Host: widgets.stackcommerce.com
URL: https://widgets.stackcommerce.com/js-deal-feed/0.1/widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.59.220.198 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

edge-723.bunnyinfra.net

Software

BunnyCDN-DE1-723 /

Resource Hash

b3aea2998f99cfec50422dd591f08fb0151a3d6460f2b4b8d152118cebdeda56

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: br
x-content-type-options: nosniff
cdn-edgestorageid: 601, 617
access-control-allow-origin: *
cdn-cachedat: 2021-06-07 14:31:24
cdn-pullzone: 201235
rawgit-cache-status: HIT
link: <https://rawgit.com/>; rel="sunset"; title="RawGit will soon shut down. Please stop using it."
server: BunnyCDN-DE1-723
cdn-requestpullcode: 200
x-robots-tag: none
vary: Accept-Encoding
sunset: Tue, 01 Oct 2019 00:00:00 GMT
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=2592000
cdn-requestid: 9ef28308b6afebd10f347e8f1207d068
content-type: application/javascript;charset=utf-8
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 200 jquery.unveil.min.js Show response
cdnjs.cloudflare.com/ajax/libs/unveil/1.3.0/ 945 B
879 B 40ms
38ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/unveil/1.3.0/jquery.unveil.min.js

Requested by

Host: widgets.stackcommerce.com
URL: https://widgets.stackcommerce.com/js-deal-feed/0.1/widget.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f441839a30400536a7929981076ef3a81faf302fdfef53922dad563c13e8af8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3453636
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 429
cf-request-id: 0a4bbecfc4000064d33e839000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:26 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04016-3b1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=NKjiwb7WZuAcG5dYu7xaF8xk%2B3D1PIgXZ%2ByRmKCWpwymux9wFAq0pfxR%2FSD97%2BcHvJljXAEqOudNWk1XNPK1NZek8UAI7zbugfuUFgze1gtAVB04wuoHhz6WuTvntu9H6gcnr1yNUQwqbcGFxw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 66a2c47469991f1d-FRA
expires: Sat, 25 Jun 2022 18:48:25 GMT

GET
H2 200 jquery.waypoints.min.js Show response
cdnjs.cloudflare.com/ajax/libs/waypoints/4.0.1/ 9 KB
3 KB 44ms
43ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/waypoints/4.0.1/jquery.waypoints.min.js

Requested by

Host: widgets.stackcommerce.com
URL: https://widgets.stackcommerce.com/js-deal-feed/0.1/widget.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c39ce2883aad8a36c4194dc053127b29efa1677cc12db45e805760c5d9f14d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 270342
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 2417
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-2281"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=9zUuig74OXSGqYRvC6yJjpNQOXtvbjKodf%2F3zw%2BarJDMbjf0NU5nAKZ%2Bq7l3FDd3dIMyAGXN4X2h9DT%2BERyByn8whEOvgON%2FTGTFk360IvwNosa0Lbc6xcr9auKpsfVSeNynZeIevo2yhPXW1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 66a2c474699e1f1d-FRA
expires: Sat, 25 Jun 2022 18:48:25 GMT

GET
H2 200 widget.css
widgets.stackcommerce.com/js-deal-feed/0.1/ 6 KB
2 KB 15ms
14ms Stylesheet
text/css 13.224.193.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.stackcommerce.com/js-deal-feed/0.1/widget.css
Requested by: Host: widgets.stackcommerce.com
URL: https://widgets.stackcommerce.com/js-deal-feed/0.1/widget.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-5.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 18037177fb3b5b24b138a42afeee4cc8a8fa31950cb09161685c2a947e332e4c

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:14:02 GMT
content-encoding: gzip
last-modified: Tue, 14 Mar 2017 17:54:41 GMT
server: AmazonS3
age: 2077
etag: W/"6ce9ce01ae572250ecedb501e7895100"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
cache-control: max-age=7200
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: mIomGH0gYuasLl9O1B_zHEveGUQijE7VQrb6xgPpFUHdVIjXQUSnWQ==

GET
H2 200 Article-Comments-Icon.svg
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/ 760 B
781 B 12ms
11ms Image
image/svg+xml 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/Article-Comments-Icon.svg
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 80853ae5badb759ddeddee346aeb9a59965db1f255dba5e6769c3d4410a5a434

Request headers

Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-2f8"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 94a3698172fa46b3ccad8a5a54413f18
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 windopws-11-syrupcast-scaled.jpg
cdn.mobilesyrup.com/wp-content/uploads/2021/07/ 355 KB
355 KB 12ms
12ms Image
image/jpeg 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/uploads/2021/07/windopws-11-syrupcast-scaled.jpg
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 9d2a498b6ae1bc38f47664437724db0bab499d74d354117688d77de148e46a28

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
last-modified: Wed, 30 Jun 2021 18:17:35 GMT
server: nginx
etag: "60dcb53f-58a26"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age = 315360000
accept-ranges: bytes
content-length: 363046
x-request-id: 36b13dd95434f68db3f23208cf48183c
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 starlink-dish-mounted-toyota-prius-scaled.jpg
cdn.mobilesyrup.com/wp-content/uploads/2021/07/ 500 KB
501 KB 28ms
27ms Image
image/jpeg 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/uploads/2021/07/starlink-dish-mounted-toyota-prius-scaled.jpg
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: dc6e1ec204ec4803ab97f5755daab71eb51de4b1365465bdc176b17bb501d81c

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
last-modified: Sat, 03 Jul 2021 16:09:01 GMT
server: nginx
etag: "60e08b9d-7d16d"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age = 315360000
accept-ranges: bytes
content-length: 512365
x-request-id: 36b13dd95434f68db3f23208cf48183c
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 gta-v-scaled.jpg
cdn.mobilesyrup.com/wp-content/uploads/2021/07/ 423 KB
424 KB 28ms
27ms Image
image/jpeg 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/uploads/2021/07/gta-v-scaled.jpg
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 5680c2e313839913f301de4ff24dc773133750792f8dfcf950e695cdf1e1c143

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
last-modified: Mon, 05 Jul 2021 15:50:14 GMT
server: nginx
etag: "60e32a36-69b32"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age = 315360000
accept-ranges: bytes
content-length: 432946
x-request-id: 36b13dd95434f68db3f23208cf48183c
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 redbanner-white-logo.svg
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/ 8 KB
3 KB 28ms
27ms Image
image/svg+xml 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/redbanner-white-logo.svg
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: e34b9b89d2ad0a3a07a370f4700b6e6206a27ce052c7bbd0d3577b70774ce577

Request headers

Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-1f99"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 36b13dd95434f68db3f23208cf48183c
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 RobotoSlab-Light-webfont.woff
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/fonts/ 27 KB
28 KB 20ms
19ms Font
application/font-woff 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/fonts/RobotoSlab-Light-webfont.woff
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: f673d3c74f8af291a9b64306eb120f00a74d08c8209ad22af874bac0c751b895

Request headers

Origin: https://mobilesyrup.com
Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-length: 28032
x-request-id: ff1247b9738f686c538fc16bf8df1d89
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: "60d2d1a1-6d80"
x-presslabs-cache: HIT
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,OPTIONS
content-type: application/font-woff
access-control-allow-origin: https://mobilesyrup.com
access-control-expose-headers: Content-Length,Content-Range,X-WP-Total,X-WP-TotalPages,Link
cache-control: max-age = 315360000
accept-ranges: bytes
x-cache-groups: assets
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-WP-Nonce
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 opensans-regular.woff
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/fonts/ 62 KB
63 KB 21ms
20ms Font
application/font-woff 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/fonts/opensans-regular.woff
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b

Request headers

Origin: https://mobilesyrup.com
Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-length: 63712
x-request-id: ff1247b9738f686c538fc16bf8df1d89
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: "60d2d1a1-f8e0"
x-presslabs-cache: HIT
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,OPTIONS
content-type: application/font-woff
access-control-allow-origin: https://mobilesyrup.com
access-control-expose-headers: Content-Length,Content-Range,X-WP-Total,X-WP-TotalPages,Link
cache-control: max-age = 315360000
accept-ranges: bytes
x-cache-groups: assets
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-WP-Nonce
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 OpenSans-Bold.woff
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/fonts/ 62 KB
63 KB 26ms
25ms Font
application/font-woff 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/fonts/OpenSans-Bold.woff
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 7d7a1a8ec55f31a6674fd2e2c41bcc6421a9aeb5cf161c6e93363f31347160f9

Request headers

Origin: https://mobilesyrup.com
Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-length: 63564
x-request-id: ff1247b9738f686c538fc16bf8df1d89
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: "60d2d1a1-f84c"
x-presslabs-cache: HIT
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,OPTIONS
content-type: application/font-woff
access-control-allow-origin: https://mobilesyrup.com
access-control-expose-headers: Content-Length,Content-Range,X-WP-Total,X-WP-TotalPages,Link
cache-control: max-age = 315360000
accept-ranges: bytes
x-cache-groups: assets
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-WP-Nonce
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 20db642c8dce2ba32eaaf6b1da1c8811
secure.gravatar.com/avatar/ 2 KB
2 KB 21ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/20db642c8dce2ba32eaaf6b1da1c8811?s=52&d=mm
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 3a4ea3a48a4a48bb640df9b5ed006d22c3c07454e5adef2950922edebfbba92e

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Mon, 05 Jul 2021 18:48:25 GMT
last-modified: Tue, 07 Jan 2020 15:43:50 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="20db642c8dce2ba32eaaf6b1da1c8811.jpeg"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/20db642c8dce2ba32eaaf6b1da1c8811?s=52&d=mm>; rel="canonical"
content-length: 1834
expires: Mon, 05 Jul 2021 18:53:25 GMT

GET
H2 200 play-store-1-2048x1151.jpg
cdn.mobilesyrup.com/wp-content/uploads/2021/03/ 303 KB
303 KB 12ms
11ms Image
image/jpeg 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/uploads/2021/03/play-store-1-2048x1151.jpg
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 935b9b5133d2cddb598602dbd615b368a421845d3d4e0a761f74a8d5a786f748

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
last-modified: Tue, 16 Mar 2021 16:04:50 GMT
server: nginx
etag: "6050d722-4ba6f"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age = 315360000
accept-ranges: bytes
content-length: 309871
x-request-id: 1dc7d06674dcd7167c00d335c40aa854
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-3143766-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 3745
date: Mon, 05 Jul 2021 17:46:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Mon, 05 Jul 2021 19:46:00 GMT

GET
H2 200 pubads_impl_2021063001.js Show response
securepubads.g.doubleclick.net/gpt/ 329 KB
115 KB 37ms
15ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99e3d0a0f7b92b109c9c21035daef51486ff1ed73b5a3bdbe5b487e5619d8240

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 30 Jun 2021 08:36:57 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117131
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:25 GMT

GET
H2

200

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=19290831&ns__t=1625510905148&ns_c=UTF-8&cv=3.5&c8=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&c7=https%3A%2F...
https://sb.scorecardresearch.com/b2?c1=2&c2=19290831&ns__t=1625510905148&ns_c=UTF-8&cv=3.5&c8=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&c7=https%3A%2...

64 B
330 B

15ms
15ms

Image
image/gif

13.225.87.89
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=19290831&ns__t=1625510905148&ns_c=UTF-8&cv=3.5&c8=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&c7=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&c9=
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.89 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-89.fra2.r.cloudfront.net
Software: /
Resource Hash: 831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
via: 1.1 590590f04f79f692591f9db0e720a31d.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
etag: W/"40-jHLN3x5dWpBzaQm4lkBmDWvrjrg"
x-cache: Miss from cloudfront
content-type: image/gif; charset=utf-8
content-length: 64
x-amz-cf-id: xJ-TlRNXYvIer4VPn4b6d6M7GIsxFUrTpCo1yhQR1WKSpdKSMQSkvw==

Redirect headers

date: Mon, 05 Jul 2021 18:48:25 GMT
via: 1.1 590590f04f79f692591f9db0e720a31d.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: https://sb.scorecardresearch.com/b2?c1=2&c2=19290831&ns__t=1625510905148&ns_c=UTF-8&cv=3.5&c8=Google%20removes%20nine%20popular%20apps%20that%20stole%20users'%20Facebook%20passwords&c7=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&c9=
content-length: 331
x-amz-cf-id: 5_3LkfBjzu6hM2n77qm6O08BGJkW64hKSZ63NvMX1ZNG4VpZRFuNpQ==

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 36 KB
14 KB 38ms
17ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TSKNMLG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

92bd24374fb205c765a133d522acb2772693d2ccd486b7855e2447918de296a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14011
x-xss-protection: 0
server: cafe
etag: 1690124483490796579
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 05 Jul 2021 18:48:25 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
147 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=132905745411807&ev=PageView&dl=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&rl=&if=false&ts=1625510905198&sw=1600&sh=1200&v=2.9.43&r=stable&a=wordpress-5.5.3-3.0.5&ec=0&o=30&fbp=fb.1.1625510905197.1778296154&it=1625510905022&coo=false&rqm=GET

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 05 Jul 2021 18:48:25 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210630/r20190131/ Frame 45ED 10 KB
5 KB 8ms
7ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210630/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210630/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mobilesyrup.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 05 Jul 2021 04:01:27 GMT
expires: Mon, 19 Jul 2021 04:01:27 GMT
content-type: text/html; charset=UTF-8
etag: 15579341980913220427
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4579
x-xss-protection: 0
age: 53218
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 28ms
13ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=307982766&t=pageview&_s=1&dl=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&ul=en-us&de=UTF-8&dt=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1594363641&gjid=1711259985&cid=2025090827.1625510905&tid=UA-3143766-2&_gid=1040024553.1625510905&_r=1&gtm=2ou6u0&z=1501370540

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
77 B 33ms
32ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4763a166900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 163 B
1 KB 202ms
168ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=hRdzyunFfDtlejUGEZfYYne4epOEzT~450~div-gpt-ad-1429830557396-0&psa=0&zone=450&id=13205813&member_id=1908&size=320x50&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

d26b26009a3cc4b23dcbeb3548e946b0c1dab181e1dbd5795d84fcbfeaf85456

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 54e87bb5-d6bf-44aa-b1d1-5e71eade9a91
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 163
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 33ms
33ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4763a1d6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 163 B
1 KB 117ms
82ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=ZLgXXyG3GK2tSMpclYuOnvl2rgusBc~451~div-gpt-ad-1483719605404-9&psa=0&zone=451&id=13205814&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

8f85ee57c469beef29cf98b14aa8e3e6799377cf915a7ee9512fb97ec873f54c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 7d38788d-16c7-4002-bac1-3869ae971d1c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 163
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 54ms
54ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4763a216900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
648 B 49ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=QMurnrIbZj028UGgTDVKMrsX0GwIUZ~452~div-gpt-ad-1483719605404-10&psa=0&zone=452&id=13205815&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 2cadfb51-9527-4b4c-b1d9-d6c4c8296c85
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 27ms
27ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4763a246900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
648 B 79ms
45ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=6zUXZJuY4J2uaqazXAbvhrtL5NNGup~453~div-gpt-ad-1483719605404-0&psa=0&zone=453&id=13205816&member_id=1908&size=728x90&promo_sizes=970x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: ff18ce5e-bc01-47ba-b3e7-5c103038e401
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 38ms
38ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4763a296900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
648 B 49ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=FCr4nbbYsMfpyBMdPSFwa3Njk3EdBD~454~div-gpt-ad-1483719605404-1&psa=0&zone=454&id=13205817&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 3f2acd22-fb4f-4747-8f4c-9e2069a1790c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 38ms
37ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4763a2e6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
648 B 68ms
29ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=rVeEKFagkgdPWqr4GBbzoQjK4GzCEo~455~div-gpt-ad-1483719605404-2&psa=0&zone=455&id=13205818&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: abfa8fa5-9746-43be-a6b7-7cf9903b8cf5
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 37ms
37ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4764a336900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 163 B
1 KB 80ms
79ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=2Rrn0DSt1rUQ7e68pkQbsN0bEcJiMX~451~div-gpt-ad-1483719605404-3&psa=0&zone=451&id=13205814&member_id=1908&size=300x250&promo_sizes=300x600&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

b880a3535aec274fabd446a6d78a13a02e98012207d5ddeae2df61add42a3b87

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 121eca30-07f2-419d-833d-233bdf5d7a5b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 163
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 35ms
35ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4764a356900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
648 B 42ms
39ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=7jkh3AELMgfIQKBTgrEEbe9iohfRM7~452~div-gpt-ad-1483719605404-4&psa=0&zone=452&id=13205815&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 8a4c7c07-9d03-4d7a-aef1-daf71a39f9cf
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 34ms
34ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4764a366900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
648 B 20ms
19ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=ya004eoop21jF4NdyhWJyt2WPIxYQw~453~div-gpt-ad-1483719605404-5&psa=0&zone=453&id=13205816&member_id=1908&size=320x50&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 59b4b9bd-e477-4823-b5b2-009e47b7bfd3
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 26ms
25ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4764a386900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
648 B 61ms
60ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=R7zqZJhJFfRsoQmX87KgZAJvLwv8RH~454~div-gpt-ad-1483719605404-6&psa=0&zone=454&id=13205817&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: c0c24c33-a8ba-4aba-8e42-3493fa844f51
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 26ms
26ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4764a396900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
648 B 22ms
18ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=hEWBS3gtRE5dVPfozNbal7GTQyjssA~455~div-gpt-ad-1483719605404-7&psa=0&zone=455&id=13205818&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: fbe59071-afb2-49c3-96ed-924792459e8b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 29ms
29ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4764a3b6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 163 B
1 KB 82ms
81ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=b2QagzSFTGa7UTzrsA0dcBVpuXnLIn~451~div-gpt-ad-1483719605404-8&psa=0&zone=451&id=13205814&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

a5aea89f25c86bd889e3af63c682df669a399d7e0340247f9b81f72e3f563a00

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 6b68a67b-7ac5-4799-829d-36fae3612779
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 163
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 32ms
31ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4764a3c6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 22ms
21ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=SWc7M0Cnl7nbDTh8cjDmG4YPCG2fAC~452~div-gpt-ad-1482333704081-52&psa=0&zone=452&id=13205815&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 3aca912c-4555-4705-9d0d-367330cf893f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 40ms
40ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4765a3d6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 83ms
82ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=jNgJGDdLvKzQ20VEBKpH950GL4MagW~453~div-gpt-ad-1482333704081-62&psa=0&zone=453&id=13205816&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: bf681091-c9d8-469a-9c4c-608a79056eec
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 35ms
35ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4765a416900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
14ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=bvmXmyMhhsShWE7BEjFpRLoOXA2Rxb~454~div-gpt-ad-1482333704081-11&psa=0&zone=454&id=13205817&member_id=1908&size=970x250&promo_sizes=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 8d3e9a8c-8476-4302-8f61-a78682bacb6b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 35ms
35ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4765a426900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
14ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=nNySwhigFAWPcQ3CJBFMujmPA8x0j8~455~div-gpt-ad-1482333704081-15&psa=0&zone=455&id=13205818&member_id=1908&size=970x250&promo_sizes=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 14f738bb-77fa-41ec-bd36-bc483ebef146
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 25ms
25ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4765a456900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 164 B
1 KB 146ms
146ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=nkyFhn1BhUxep4oWhFtCG0lH0dkwQO~451~div-gpt-ad-1482333704081-63&psa=0&zone=451&id=13205814&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

75f2979472cb097884081a64fa3332ad1807af57dbc9187af191c310efa4c16a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: b4c71634-e0da-42c7-92ff-a03c9179e2e0
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 164
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 25ms
25ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4765a496900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 18ms
17ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=lkbBvQLVIPCtdkfGdhdb1GLR4EpEM4~452~div-gpt-ad-1482333704081-35&psa=0&zone=452&id=13205815&member_id=1908&size=970x250&promo_sizes=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: d081de52-56f1-44f9-ba9e-e72c598b3ae8
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 29ms
29ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4765a4a6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 45ms
44ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=jHIkxKBwqtylqEgMiePEBll76vbFNN~453~div-gpt-ad-1482333704081-59&psa=0&zone=453&id=13205816&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 0dbc1cad-afb8-4b96-a53f-40a0f502f1c9
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 26ms
25ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4765a4c6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 16ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=O4Uas2lH354l3OKtsXPZhii0fesYA6~454~div-gpt-ad-1482333704081-30&psa=0&zone=454&id=13205817&member_id=1908&size=970x250&promo_sizes=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: b0681be7-f196-4e6d-9caf-4d36657bef38
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 28ms
28ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4765a4e6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 17ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=Dy1MvTCppmqJk3DrsivZUNrklqrRiz~455~div-gpt-ad-1482333704081-53&psa=0&zone=455&id=13205818&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 40097bad-d992-48dc-96f2-668e574e1f1d
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 29ms
29ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4765a506900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 30ms
29ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=2Dj8EP64NWDxYPUj4mxvrruaLAOS0j~451~div-gpt-ad-1482333704081-25&psa=0&zone=451&id=13205814&member_id=1908&size=970x250&promo_sizes=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: eab921f6-1e3b-4969-9b1e-4a13b95a9e05
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 26ms
25ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4766a516900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 39ms
36ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=RXO6RC13MayUv14m8qvCCeoAzXFCer~452~div-gpt-ad-1482333704081-64&psa=0&zone=452&id=13205815&member_id=1908&size=320x50&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 62d76e41-b672-4446-8df0-4aab9008dbf7
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 31ms
24ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4766a566900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 18ms
17ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=5dLd8HoR1I51zALcKI5eZINtLdvlJA~453~div-gpt-ad-1482333704081-61&psa=0&zone=453&id=13205816&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: dcedfdc7-fe88-4ab0-84cf-098418e132a4
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 36ms
25ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4767a5d6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 16ms
16ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=5b7lTKbGhL0Jiuf0smiGjz9lRwn9xZ~454~div-gpt-ad-1482333704081-43&psa=0&zone=454&id=13205817&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 2bfdcb0e-2044-4a15-9c7b-22a20eaf755a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 41ms
30ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4767a5e6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 16ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=oHz15AXB9gOMMdeOeZkFg0Wvz89iVw~455~div-gpt-ad-1482333704081-42&psa=0&zone=455&id=13205818&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 65e3d477-98ca-4ff7-9a59-a735c6caa7cf
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 40ms
30ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4767a616900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 164 B
1 KB 93ms
93ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=nzt8pEGNfEbzRRxfw9woD1zp6pEsyx~451~div-gpt-ad-1482333704081-41&psa=0&zone=451&id=13205814&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

133aa793a0545147737616f0cb32dddd82d2036c09db2f6508ae57e405f59cfd

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 35b58d5e-7335-4a08-a7b4-5730e64c361c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 164
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 42ms
32ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4767a626900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=zp7OnGtfMQxulmCBXZ7qx0SrMJGC65~452~div-gpt-ad-1482333704081-40&psa=0&zone=452&id=13205815&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: c463df57-d986-4964-9efc-91b797703e5f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 38ms
29ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4767a636900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 26ms
26ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=ZduUJ3qNDW4v1Oa7LgdvHTZfG2i8EE~453~div-gpt-ad-1482333704081-39&psa=0&zone=453&id=13205816&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 8704fd2a-1fc8-4cce-9c5e-6dea5beef568
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 35ms
33ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4767a656900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 14ms
14ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=5jGKKANl8ZhumVb8NUXRk4zeyBTrDH~454~div-gpt-ad-1482333704081-38&psa=0&zone=454&id=13205817&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 1203bc89-ca91-4b88-9cef-6e11a3e6e24e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 34ms
32ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4768a666900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=HjBXJ3apcc71gL5xpcPP5dI2ckxOY6~455~div-gpt-ad-1482333704081-7&psa=0&zone=455&id=13205818&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 0552575d-9193-4421-adf5-64476dde498e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 35ms
32ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4768a6c6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=aOWsnHM3sOE0GJoeI3SPoOrvH6HSO1~451~div-gpt-ad-1482333704081-6&psa=0&zone=451&id=13205814&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: cee3f838-7b60-4964-8ce4-7eafb81a5947
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 43ms
41ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4768a6d6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 24ms
24ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=ZzzjCXi2sLFbXOC9THuVqh8air07CR~452~div-gpt-ad-1482333704081-5&psa=0&zone=452&id=13205815&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 90840522-ea1d-4900-8f56-c525630a5999
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 34ms
33ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4768a6e6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
14ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=exjcPB6ILF2nHdzGbPV53XzKqyZ9js~453~div-gpt-ad-1482333704081-4&psa=0&zone=453&id=13205816&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 45124ee3-fdef-46fb-82b8-d2b96ac3290d
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 34ms
32ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4768a706900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=8X3M33XZU96RxOPAkPwYfD3M8prdWp~454~div-gpt-ad-1482333704081-3&psa=0&zone=454&id=13205817&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 88a85be8-62a1-45eb-956e-1893d37cacb9
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 31ms
29ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4768a716900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 16ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=BNw2g2IjS8toupEW5cMKDthAOFPzoL~455~div-gpt-ad-1482333704081-2&psa=0&zone=455&id=13205818&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 3cb42c21-6533-4e28-8673-1e19a33f9e62
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 32ms
31ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4768a736900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 164 B
1 KB 81ms
80ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=RZzzL7AKAuTk0WtWE10WtOHndLYHam~451~div-gpt-ad-1482333704081-37&psa=0&zone=451&id=13205814&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

12c9a8acdb6819b2b2f5f1acec908d88b89fed659298a616c3d373c9f2a916ee

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 146cec38-262c-4ff2-9b92-6476e8b20966
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 164
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 41ms
41ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4768a756900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 19ms
18ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=nKrJ9Z2b6Qh7PQ56DYT36KrTcaqMNh~452~div-gpt-ad-1482333704081-36&psa=0&zone=452&id=13205815&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 5ffed51f-7358-4922-9048-6f9b64b473e0
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 39ms
39ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4768a766900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 16ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=vgNMiolhTJUUUhqBk7kP2sMdSJxpib~453~div-gpt-ad-1482333704081-1&psa=0&zone=453&id=13205816&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 647ad6e9-2aef-48ad-be04-f5ce0f39f505
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 40ms
37ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4769a786900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 33ms
33ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=GjTq0LTHY6VSw2xvwEd7eZcISRLG7X~454~div-gpt-ad-1482333704081-0&psa=0&zone=454&id=13205817&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 02613bb6-ab53-4daf-85d0-6a812a8eb4b1
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 38ms
36ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4769a796900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 16ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=iKjty57qrrrjLFMEALgCnyXx1M3PtE~455~div-gpt-ad-1482333704081-45&psa=0&zone=455&id=13205818&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: a1ce08a6-5d7b-4adc-b815-0ad80fdcbf5e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 37ms
36ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4769a7a6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 164 B
1 KB 81ms
81ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=8z1TChPc44cIshWyPR0qc075NnIbi5~451~div-gpt-ad-1482333704081-44&psa=0&zone=451&id=13205814&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

868656e1afa7d170fdb83b81b4abf8baef0eddca540c2dd6d17a7fd088897d5b

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 0b912bdf-04a4-47b7-a52b-0ee821651398
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 164
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 36ms
35ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4769a7b6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 18ms
16ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=nlfUieR9qK2Ke8VuUcBbWcUvnF4kOT~452~div-gpt-ad-1482333704081-10&psa=0&zone=452&id=13205815&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 5f6f3960-95c8-436a-92e6-fb03f37b0146
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 34ms
34ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4769a7c6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 22ms
22ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=lA5sDqlhL9w6uI7ikS3TCVtEaJE5As~453~div-gpt-ad-1482333704081-9&psa=0&zone=453&id=13205816&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 5389aa97-da2b-4477-83b5-a1f7bb5cf8ab
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 34ms
34ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4769a806900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 19ms
19ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=juikG3E9yvLb99W3Yau2S0Zffj2UFa~454~div-gpt-ad-1482333704081-8&psa=0&zone=454&id=13205817&member_id=1908&size=300x600&promo_sizes=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 1c977eb6-16e0-4b51-9713-b9a1ef21d984
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 31ms
31ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4769a816900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 20ms
19ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=pfz9uN3zcpStzQQ6NYQggtPWyKDgX9~455~div-gpt-ad-1482333704081-46&psa=0&zone=455&id=13205818&member_id=1908&size=320x50&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 68c1d8dc-cf4d-44db-9be4-427d4fc7a76e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 30ms
30ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4769a836900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 164 B
1 KB 84ms
84ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=3j1kACyCax3uhyvYRWHsquiJVz3pMj~451~div-gpt-ad-1482333704081-48&psa=0&zone=451&id=13205814&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

ab46d8f331ac7bbb99add443719e9e46b8b93cdfabab040589d8c00c27fc5bb2

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: f0c41da0-748b-4d3f-a5bc-bdb289ba1c53
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 164
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 32ms
32ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4769a846900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 17ms
16ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=9LlEovL3VLrVumUawAyrYgi3QMUCMJ~452~div-gpt-ad-1482333704081-49&psa=0&zone=452&id=13205815&member_id=1908&size=320x50&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 00b326de-8175-405a-98bb-6f8f523f8d62
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 36ms
36ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c4769a856900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 16ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=FYIFIlHTMayXfSJFwQ7HppFY7XNTAD~453~div-gpt-ad-1482333704081-12&psa=0&zone=453&id=13205816&member_id=1908&size=300x600&promo_sizes=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 32130699-a639-42b2-a7f2-59bbdcf9f734
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 77ms
76ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476aa8b6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 19ms
19ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=qq0l738GPUFgEwk3hcV1DPPQJJO1ez~454~div-gpt-ad-1482333704081-47&psa=0&zone=454&id=13205817&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 9b4588cb-fd9e-468f-8397-d6c26831b1c1
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 30ms
30ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476aa8c6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 17ms
16ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=FphwMWGJ35KIrOr9ZGirqMpEl4CbDO~455~div-gpt-ad-1482333704081-14&psa=0&zone=455&id=13205818&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 85266745-4813-4b54-bb78-18f2c93de62d
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 31ms
31ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476aa8d6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 24ms
23ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=dSspN1OGz5HXhxeEXEBJ3rbHlxcHLF~451~div-gpt-ad-1482333704081-13&psa=0&zone=451&id=13205814&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 3029bd20-f1c3-416e-bb5f-cea3d0345706
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 31ms
31ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476aa8e6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 14ms
14ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=4fA6IPshNGaew0Ao8HUWKzsSmgugO7~452~div-gpt-ad-1482333704081-32&psa=0&zone=452&id=13205815&member_id=1908&size=300x600&promo_sizes=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: c00b9f6a-9130-4d20-a2fc-c6772e5f8b19
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 31ms
31ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476aa8f6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 18ms
18ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=D5RGJyhsz2G2e1UBvN0RU5FmQGZdwa~453~div-gpt-ad-1482333704081-34&psa=0&zone=453&id=13205816&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 66800a11-248d-4bb9-b5ff-9e552fc7e796
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 26ms
26ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476aa936900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 17ms
16ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=JUevJidwmRJInMbrd4GKO0GlfB4ZK6~454~div-gpt-ad-1482333704081-31&psa=0&zone=454&id=13205817&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 4a757901-62e2-4b02-94cd-3f9dacd111f4
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 27ms
27ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476aa956900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 30ms
30ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=I20Xtb23M6UQc5K5oF2LYUhMpvn5nP~455~div-gpt-ad-1482333704081-33&psa=0&zone=455&id=13205818&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 4f4fecaf-dd2a-46cf-aeb7-dd6073b695c1
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 26ms
25ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476ba966900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
14ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=E70Ia45aGKoxoSqi95afK2KoRpHfTb~451~div-gpt-ad-1482333704081-27&psa=0&zone=451&id=13205814&member_id=1908&size=300x600&promo_sizes=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 3c8e3f0c-3a8f-49b7-871e-baf7fd48efd7
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 28ms
28ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476ba986900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=pPjHb0yF4vHNK9qmbRtJ8glOh1kFPG~452~div-gpt-ad-1482333704081-58&psa=0&zone=452&id=13205815&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 8b220875-ea59-40f5-815c-4d74a4b3d0c6
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
235 B 36ms
34ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476ba9d6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
14ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=1ggrTR6FokF3GnFDGjMWkvRpNiBQka~453~div-gpt-ad-1482333704081-29&psa=0&zone=453&id=13205816&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 39e82f6d-fe50-4f6f-b2d2-9aeafa24c3e4
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
38 B 27ms
26ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476baa06900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 16ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=jxlzyrcHq3HKvlsur7L93f5uKlD2G2~454~div-gpt-ad-1482333704081-26&psa=0&zone=454&id=13205817&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 937fbfb6-0809-4bee-bcfd-7a8ef8d53ca4
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
77 B 34ms
32ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476baa16900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 16ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=aJOEW8zl4NflyjPbJmst1XZjcjetv4~455~div-gpt-ad-1482333704081-28&psa=0&zone=455&id=13205818&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: a37ca389-6b9b-4a89-a023-62851581d6fe
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
37 B 26ms
24ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476baa26900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 164 B
1 KB 79ms
79ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=BXpbBjVFvP9i6G1lb5SaEKywMGztxc~451~div-gpt-ad-1482333704081-54&psa=0&zone=451&id=13205814&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

c81502b697e6e2e67de9d8903319e841e6653fda3e8538876f0648fd89533adc

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 0bac2833-7d43-4db1-98a0-8e211d26cc11
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 164
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
39 B 31ms
30ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476baa36900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 18ms
17ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=X79IFjkJ8W1QzsRFzgZ2Tu4jQZEM9M~452~div-gpt-ad-1482333704081-56&psa=0&zone=452&id=13205815&member_id=1908&size=320x50&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 3c498fad-e69a-45d9-8987-862b9f97504f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 32ms
32ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476baa56900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 17ms
16ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=qEXf5ZXIInDrlJeCdkdmFXyBxNLvuo~453~div-gpt-ad-1482333704081-22&psa=0&zone=453&id=13205816&member_id=1908&size=300x600&promo_sizes=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 043322f4-f057-4310-b567-ae4203122c88
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 32ms
32ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476baa66900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 19ms
19ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=EtV1KRZEOPUUyfJkTSGb0gWX6afRRo~454~div-gpt-ad-1482333704081-55&psa=0&zone=454&id=13205817&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 0a07765e-712f-4488-ad6e-be8d2ca1a134
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 31ms
31ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476baa76900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
14ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=FVFSGlhpOGbOcntsloVsDNc4ABIkkD~455~div-gpt-ad-1482333704081-24&psa=0&zone=455&id=13205818&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 21b54047-68ca-4eff-90a2-9ebd3a226877
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 30ms
30ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476baa96900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 164 B
1 KB 93ms
93ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=l1jDUGsLmrXT8f6Y3oW3wlScb9UFzZ~451~div-gpt-ad-1482333704081-21&psa=0&zone=451&id=13205814&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

ac292acaee68ae6dfd298d3c1392ea4dc534f0fe745a337ffca6bf5e0e9d1ed4

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 710daec1-8b8c-46a2-9f0c-215c5c5ceb60
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 164
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 30ms
30ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476baab6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 20ms
19ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=NLh3E6tADUI9v6nnSOwXjJlxtKEfcE~452~div-gpt-ad-1482333704081-20&psa=0&zone=452&id=13205815&member_id=1908&size=970x250&promo_sizes=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 6c719738-5aa0-4b89-af12-a4f292f5bec4
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 29ms
29ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476caad6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=W8LWjEQZUQnrI9jL0i54Gw1uZEx1sY~453~div-gpt-ad-1482333704081-16&psa=0&zone=453&id=13205816&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: c928f933-e9af-451b-ba86-26242c6beb7b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 34ms
29ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476daba6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 16ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=Hh7XZ914qLjv2wMYfKNikq0aeUkwho~454~div-gpt-ad-1482333704081-17&psa=0&zone=454&id=13205817&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 37bbd25d-87f3-4d6a-9184-3b8b8b49a199
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 30ms
25ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476dabc6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=3IE7pMPNTHoPoxrZVYkSPX2Esbqjff~455~div-gpt-ad-1482333704081-18&psa=0&zone=455&id=13205818&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: e939ff02-d2a0-483c-a665-4d8728d9b07a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 39ms
34ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476dabd6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 20ms
20ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=W0MPgKtNe3v4mve0UUNpvW5d2Ee5RT~451~div-gpt-ad-1482333704081-19&psa=0&zone=451&id=13205814&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: ef1c3573-fd06-4a44-a97a-6b52c69644f6
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 29ms
24ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476dabe6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
15ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=8Ha79PwhytTVGBEAuR0cBhjWQRaK3i~452~div-gpt-ad-1482333704081-50&psa=0&zone=452&id=13205815&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: a7c5569b-c593-4a1e-9e52-854d663d1f02
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 28ms
25ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476dabf6900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 20ms
20ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=FVf5pOTeZIY1Fr6m7S0AJf5fUMpITR~453~div-gpt-ad-1482333704081-51&psa=0&zone=453&id=13205816&member_id=1908&size=300x250&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: e261a732-e0b0-42cf-9cb6-e24cd05be87f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
36 B 29ms
26ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cf-ray: 66a2c476dac06900-CDG
access-control-allow-headers: Content-Type, Origin

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
803 B 15ms
14ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=On3TTlhTKQnSb9yc41xLtH5s0qnZnm~454~div-gpt-ad-1482333704081-23&psa=0&zone=454&id=13205817&member_id=1908&size=728x90&referrer=https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.118887.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: d8c0fcae-3b8c-417a-91ac-c7eb77886244
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 35ms
15ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=mobilesyrup.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 34ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=mobilesyrup.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 458 B
276 B 47ms
47ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=21824895126241&correlator=2003999698058997&output=ldjh&impl=fif&eid=31061750%2C31061421&vrg=2021063001&ptt=17&sc=1&sfv=1-0-38&ecs=20210705&iu_parts=1043318%2CMobileSyrup_DistrictM_1x1&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&prev_scp=adunit%3Ddm_custom&eri=2&cust_params=pageID%3D818895&cookie_enabled=1&bc=31&abxe=1&lmt=1625510599&dt=1625510905443&dlt=1625510904705&idt=587&frm=20&biw=1600&bih=1200&oid=3&adxs=230&adys=1807&adks=1729051018&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1140x1499&msz=1140x0&ga_vid=2025090827.1625510905&ga_sid=1625510905&ga_hid=307982766&ga_fc=false&fws=0&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef055b38d22ee02edb12ab90729b7da49198d46c303b2a0515c0a094f31ef018

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7945 6 KB
3 KB 48ms
14ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mobilesyrup.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 05 Jul 2021 18:48:25 GMT
expires: Tue, 05 Jul 2022 18:48:25 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Section-Icon-RelatedArticles.svg
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/ 1 KB
920 B 12ms
11ms Image
image/svg+xml 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/Section-Icon-RelatedArticles.svg
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 2827534cdd55e7d968e5fa42fee89e5bbeb1ff5e0668b33d0be0d8af1edbbf42

Request headers

Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-4f0"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: b7230cc5cf8c86a2ce050f707be44113
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 spotify-wear-os-app-scaled.jpg
cdn.mobilesyrup.com/wp-content/uploads/2021/05/ 161 KB
161 KB 12ms
11ms Image
image/jpeg 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/uploads/2021/05/spotify-wear-os-app-scaled.jpg
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 80c16bcfb19891c8e2304b1ff270046ed519c733cc264fdb6ef4cb4587bc3d3d

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
last-modified: Wed, 19 May 2021 18:20:17 GMT
server: nginx
etag: "60a556e1-283dc"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age = 315360000
accept-ranges: bytes
content-length: 164828
x-request-id: b7230cc5cf8c86a2ce050f707be44113
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 google-header-07032021-scaled.jpg
cdn.mobilesyrup.com/wp-content/uploads/2021/07/ 208 KB
209 KB 14ms
13ms Image
image/jpeg 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/uploads/2021/07/google-header-07032021-scaled.jpg
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 0747425e12ae4e6e1050cac4fdee604f6603da870b15c304ad9a5b991405a568

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
last-modified: Sat, 03 Jul 2021 17:55:10 GMT
server: nginx
etag: "60e0a47e-34011"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age = 315360000
accept-ranges: bytes
content-length: 213009
x-request-id: b7230cc5cf8c86a2ce050f707be44113
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Chromebook-header-chrome-os-scaled.jpg
cdn.mobilesyrup.com/wp-content/uploads/2020/04/ 532 KB
533 KB 18ms
18ms Image
image/jpeg 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/uploads/2020/04/Chromebook-header-chrome-os-scaled.jpg
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 3eff06f3d2c5c3aac1d138d534b3edfcf52c6fb02bbc369cca5f2a7359f0f214

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
last-modified: Tue, 28 Apr 2020 20:27:39 GMT
server: nginx
etag: "5ea891bb-84f9c"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age = 315360000
accept-ranges: bytes
content-length: 544668
x-request-id: b7230cc5cf8c86a2ce050f707be44113
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
87 B 16ms
16ms XHR
text/plain 2a00:1450:400c:c04::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-3143766-2&cid=2025090827.1625510905&jid=1594363641&gjid=1711259985&_gid=1040024553.1625510905&_u=YEBAAUAAAAAAAC~&z=668908602

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 05 Jul 2021 18:48:25 GMT
content-type: text/plain
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 / Show response
www.googleadservices.com/pagead/conversion/358847571/ 2 KB
1 KB 35ms
17ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/358847571/?random=1625510905484&cv=9&fst=1625510905484&num=1&value=0&label=8EU5CPDDsbECENOojqsB&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg6u0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&tiba=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&auid=1253234708.1625510905&capi=1&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

1db2c3633ea48dac70a5a3c4bea5bae508009fbd63cfcb7f8968294dd69da41e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1284
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/privacysandbox/conversion/358847571/ 0
0 16ms
15ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/pagead/privacysandbox/conversion/358847571/?random=1625510905484&cv=9&fst=1625510905484&num=1&fmt=3&value=0&label=8EU5CPDDsbECENOojqsB&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg6u0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&tiba=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&auid=1253234708.1625510905&capi=1&hn=www.googleadservices.com&bttype=purchase&async=1
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 Footer-logo.svg
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/ 8 KB
4 KB 12ms
11ms Image
image/svg+xml 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/assets/img/Footer-logo.svg
Requested by: Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 43c508431e619d27367bfb50a8a5c11f9b364b6f3862d91d19f2e03cbc136af1

Request headers

Referer: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/styles/style.css?v=1.8.07
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-1fd9"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: b499046ec55f46bd808f79649b021bab
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 11 KB
7 KB 637ms
636ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=21824895126241&correlator=2003999698058997&output=ldjh&impl=fif&eid=31061750%2C31061421&vrg=2021063001&ptt=17&sc=1&sfv=1-0-38&ecs=20210705&iu_parts=1043318%2CMobileSyrup_Desktop_News_970x250_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x250%7C728x90&cust_params=pageID%3D818895&cookie_enabled=1&bc=31&abxe=1&lmt=1625510599&dt=1625510905532&dlt=1625510904705&idt=587&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=145&adks=2406243525&ucis=2&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x90&msz=1600x0&ga_vid=2025090827.1625510905&ga_sid=1625510905&ga_hid=307982766&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e4aa5f416692df8e9b9930158d51ba37229a5c613806365f221cb119e0da5382

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6935
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
9 KB 1152ms
1152ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=21824895126241&correlator=2003999698058997&output=ldjh&impl=fif&eid=31061750%2C31061421&vrg=2021063001&ptt=17&sc=1&sfv=1-0-38&ecs=20210705&iu_parts=1043318%2CMobileSyrup_Desktop_News_300x250_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&cust_params=pageID%3D818895&cookie_enabled=1&bc=31&abxe=1&lmt=1625510599&dt=1625510905552&dlt=1625510904705&idt=587&frm=20&biw=1600&bih=1200&oid=3&adxs=1055&adys=646&adks=2899332225&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x250&msz=300x-1&ga_vid=2025090827.1625510905&ga_sid=1625510905&ga_hid=307982766&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7112a4dbadb32d5903cf0cebf34ed4cae2572f1c21f99cd58327bc6e793e1fd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9142
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 42 KB
10 KB 1518ms
1517ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=21824895126241&correlator=2003999698058997&output=ldjh&impl=fif&eid=31061750%2C31061421&vrg=2021063001&ptt=17&sc=1&sfv=1-0-38&ecs=20210705&iu_parts=1043318%2CMobileSyrup_Desktop_General_300x250_2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600%7C300x250&cust_params=pageID%3D818895&cookie_enabled=1&bc=31&abxe=1&lmt=1625510599&dt=1625510905559&dlt=1625510904705&idt=587&frm=20&biw=1600&bih=1200&oid=3&adxs=1055&adys=1349&adks=2128220160&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x0&msz=300x0&ga_vid=2025090827.1625510905&ga_sid=1625510905&ga_hid=307982766&ga_fc=false&fws=0&ohw=0&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86640f0eeaf95bdea8dd0e49fb70af26694ae9743c57347005a09d3f031c83b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10540
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mobilesyrup.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
9 KB 1917ms
1916ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=21824895126241&correlator=2003999698058997&output=ldjh&impl=fif&eid=31061750%2C31061421&vrg=2021063001&ptt=17&sc=1&sfv=1-0-38&ecs=20210705&iu_parts=1043318%2CMobileSyrup_Mobile_News_300x250_4&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&cust_params=pageID%3D818895&cookie_enabled=1&bc=31&abxe=1&lmt=1625510599&dt=1625510905570&dlt=1625510904705&idt=587&frm=20&biw=1600&bih=1200&oid=3&adxs=-12245933&adys=-12245933&adks=1448529534&ucis=5&ifi=5&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=0x-1&ga_vid=2025090827.1625510905&ga_sid=1625510905&ga_hid=307982766&ga_fc=false&fws=128&ohw=0&btvi=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0fd56679fa70908437dac57711e798f0335acc842bdda4ca125db43b8b79f503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8847
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 65 KB
23 KB 2401ms
2400ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=21824895126241&correlator=2003999698058997&output=ldjh&impl=fif&eid=31061750%2C31061421&vrg=2021063001&ptt=17&sc=1&sfv=1-0-38&ecs=20210705&iu_parts=1043318%2CMobileSyrup_Desktop_News_728x90_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&cust_params=pageID%3D818895&cookie_enabled=1&bc=31&abxe=1&lmt=1625510599&dt=1625510905577&dlt=1625510904705&idt=587&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1879&adks=3863739770&ucis=6&ifi=6&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x90&msz=728x-1&ga_vid=2025090827.1625510905&ga_sid=1625510905&ga_hid=307982766&ga_fc=false&fws=0&ohw=0&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

850ba0f50b5baddcb54c7690269b5c9ad4626ae9ef60f0be595e04c173657d1a

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPn-34HMzPECFS3Huwgdq_oHdg&gqi=&layout=/sadbundle/%24csp%253Der3%24/17626451119355985920/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPn-34HMzPECFS3Huwgdq_oHdg&gqi=&layout=/sadbundle/%24csp%253Der3%24/17626451119355985920/index.html
content-encoding: br
x-content-type-options: nosniff
google-creative-id: -1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23198
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
date: Mon, 05 Jul 2021 18:48:27 GMT
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 scripts.js Show response
cdn.mobilesyrup.com/wp-content/plugins/contact-form-7/includes/js/ 14 KB
4 KB 16ms
11ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/plugins/contact-form-7/includes/js/scripts.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 125ec330f66081e7dc9f2814e9ec18f4e2d0baa1936d497375eedfda7ac12e5c

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:00 GMT
server: nginx
etag: W/"60d2d1a0-37c8"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 9948d4cc47d6b30a2e04142cefc16c6f
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 comment_count.js Show response
cdn.mobilesyrup.com/wp-content/plugins/disqus-comment-system/public/js/ 889 B
728 B 17ms
12ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:00 GMT
server: nginx
etag: W/"60d2d1a0-379"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 9948d4cc47d6b30a2e04142cefc16c6f
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 comment_embed.js Show response
cdn.mobilesyrup.com/wp-content/plugins/disqus-comment-system/public/js/ 1 KB
793 B 17ms
13ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:00 GMT
server: nginx
etag: W/"60d2d1a0-47e"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: 9948d4cc47d6b30a2e04142cefc16c6f
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 api.js Show response
www.google.com/recaptcha/ 884 B
609 B 35ms
29ms Script
text/javascript 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6LcOhIsUAAAAAPPDNNulR3Pg0ZljBaD3ylvNqUgp

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

08ca9ae1b7dea61f1c12bc60729f801e4d2aab29d9acde4ad0dac2bb226c254b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 588
x-xss-protection: 1; mode=block
expires: Mon, 05 Jul 2021 18:48:25 GMT

GET
H2 200 script.js Show response
cdn.mobilesyrup.com/wp-content/plugins/contact-form-7/modules/recaptcha/ 1 KB
751 B 18ms
14ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/plugins/contact-form-7/modules/recaptcha/script.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: aef711d1643073ab593de1d958ee854d6f63339cb216eda43666fb9dfcebffd0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:00 GMT
server: nginx
etag: W/"60d2d1a0-4f3"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: a13151f21520eff36027064a63dc0706
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 analytics.js Show response
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/wp-dist/ 570 B
647 B 18ms
14ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/wp-dist/analytics.js?v=1.1.0
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 3036a1e24c8914e0568f9a43b79d3482dcc8b2e71ac1c79cb5b79383ac9f1b88

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-23a"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: a13151f21520eff36027064a63dc0706
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cff-scripts.js Show response
cdn.mobilesyrup.com/wp-content/plugins/custom-facebook-feed/assets/js/ 50 KB
15 KB 19ms
15ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/plugins/custom-facebook-feed/assets/js/cff-scripts.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: df963b4b149bc3495ccd59925eefe1cf7565cfd25b0e584f42bd4d85ea17743a

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:00 GMT
server: nginx
etag: W/"60d2d1a0-c8b2"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: a13151f21520eff36027064a63dc0706
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bundle.js Show response
cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/js/ 574 KB
157 KB 20ms
17ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-content/themes/mobile-syrup-2016/dist/js/bundle.js?v=1.8.07
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: e1c5adf7efe39005c3e91e1afaf6bdf0b0c82a7f5574ac0e5d2acd6bd0cf5338

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
last-modified: Wed, 23 Jun 2021 06:16:01 GMT
server: nginx
etag: W/"60d2d1a1-8f79e"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: a13151f21520eff36027064a63dc0706
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wp-embed.min.js Show response
cdn.mobilesyrup.com/wp-includes/js/ 1 KB
1 KB 24ms
21ms Script
application/javascript 136.243.171.217
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mobilesyrup.com/wp-includes/js/wp-embed.min.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.243.171.217 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.217.171.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
last-modified: Sat, 26 Oct 2019 00:17:07 GMT
server: nginx
etag: W/"5db39083-59a"
x-presslabs-cache: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000
x-cache-groups: assets
x-request-id: a13151f21520eff36027064a63dc0706
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 e-202127.js Show response
stats.wp.com/ 9 KB
3 KB 30ms
12ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202127.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT hhn
date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
server: nginx
etag: W/"5c6340e3-350a"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Mon, 27 Jun 2022 03:06:32 GMT

GET
H/1.1 200
OK freeskreen.min.js Show response
static.freeskreen.com/ba/27/ 4 KB
2 KB 58ms
15ms Script
text/javascript 13.225.87.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.freeskreen.com/ba/27/freeskreen.min.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-63.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5e69ce6a9ffba725a2e4fc97f96b11efa8b3d1ac157f8c953cdf161343e94a07

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: hFWp10Z_RlsyXJle5TkcJrygGLfl6LsB
Content-Encoding: gzip
Last-Modified: Tue, 20 Apr 2021 16:27:58 GMT
Server: AmazonS3
Age: 74177
ETag: "bfb19ecaa19926298f4e76b51167a30b"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
Connection: keep-alive
Date: Mon, 05 Jul 2021 01:43:15 GMT
X-Amz-Cf-Pop: FRA2-C2
Accept-Ranges: bytes
Content-Length: 1644
X-Amz-Cf-Id: -WHi6y25DcIi0L5AFkuZdnGQQl38OA4X2B3Yrv25CkTiBlgvZ7psDg==

GET
H2 200 124649X1585574.skimlinks.js Show response
s.skimresources.com/js/ 56 KB
21 KB 31ms
9ms Script
application/octet-stream 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://s.skimresources.com/js/124649X1585574.skimlinks.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b9e0792dde6d095efe669225381e59d1c30f05872aeb4f967931ffa6b8668b0d

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
last-modified: Wed, 17 Mar 2021 12:07:10 GMT
server: AmazonS3
x-amz-request-id: 9QD3QZZ26TMBJX5Y
etag: "0919208a3827ca3868b36ca58e302e7d"
x-hw: 1625510905.cds130.fr8.hn,1625510905.cds225.fr8.c
content-type: application/octet-stream
cache-control: max-age=3600
accept-ranges: bytes
content-length: 20739
x-amz-id-2: zL5S1MfmRMsJdn10IizBKCgHG+mFTyYH4iCaKPYGMSeNZuCn+dmo1FrNk3z8DuxrLnj4h0Gc2uc=

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 14 KB
8 KB 2981ms
2981ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=21824895126241&correlator=2003999698058997&output=ldjh&impl=fif&eid=31061750%2C31061421&vrg=2021063001&ptt=17&sc=1&sfv=1-0-38&ecs=20210705&iu_parts=1043318%2CMobileSyrup_Mobile_News_300x250_3&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&cust_params=pageID%3D818895&cookie=ID%3D6300beb5d6441e30-22915ddf73c80003%3AT%3D1625510905%3AS%3DALNI_MaR3ixaP8c3VaJ8Nij8a5i0puIFig&bc=31&abxe=1&lmt=1625510599&dt=1625510905602&dlt=1625510904705&idt=587&frm=20&biw=1600&bih=1200&oid=3&adxs=1055&adys=2597&adks=1450561805&ucis=7&ifi=7&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x250&msz=300x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2025090827.1625510905&ga_sid=1625510905&ga_hid=307982766&ga_fc=false&fws=0&ohw=0&btvi=4&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

350c21deaeb67122b71ec0e854f2f3a3d6326fe09c36c6dde855fb6ffe6fe249

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:28 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8602
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
9 KB 3446ms
3445ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=21824895126241&correlator=2003999698058997&output=ldjh&impl=fif&eid=31061750%2C31061421&vrg=2021063001&ptt=17&sc=1&sfv=1-0-38&ecs=20210705&iu_parts=1043318%2CMobileSyrup_Desktop_News_728x90_2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&cust_params=pageID%3D818895&cookie=ID%3D6300beb5d6441e30-22915ddf73c80003%3AT%3D1625510905%3AS%3DALNI_MaR3ixaP8c3VaJ8Nij8a5i0puIFig&bc=31&abxe=1&lmt=1625510599&dt=1625510905607&dlt=1625510904705&idt=587&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=3553&adks=3168827104&ucis=8&ifi=8&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x90&msz=728x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2025090827.1625510905&ga_sid=1625510905&ga_hid=307982766&ga_fc=false&fws=0&ohw=0&btvi=5&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

75682444b04d70c20833dc026ff69289a453cc2ad4444dd3b2f7fc031745d707

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9667
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
9 KB 3887ms
3886ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=21824895126241&correlator=2003999698058997&output=ldjh&impl=fif&eid=31061750%2C31061421&vrg=2021063001&ptt=17&sc=1&sfv=1-0-38&ecs=20210705&iu_parts=1043318%2CMobileSyrup_Mobile_News_300x250_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&cust_params=pageID%3D818895&cookie=ID%3D6300beb5d6441e30-22915ddf73c80003%3AT%3D1625510905%3AS%3DALNI_MaR3ixaP8c3VaJ8Nij8a5i0puIFig&bc=31&abxe=1&lmt=1625510599&dt=1625510905617&dlt=1625510904705&idt=587&frm=20&biw=1600&bih=1200&oid=3&adxs=-12245933&adys=-12245933&adks=3091930406&ucis=9&ifi=9&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x250&msz=0x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2025090827.1625510905&ga_sid=1625510905&ga_hid=307982766&ga_fc=false&fws=128&ohw=0&btvi=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

55.133.120.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

9347e7b41b36949e2ba2236f7b54cb09f74eaf4390464e8b5380dfbe2f8be908

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8963
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK services Show response
sr.studiostack.com/v3/ 23 KB
23 KB 423ms
102ms Script
application/x-javascript 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/v3/services
Requested by: Host: adserver.pressboard.ca
URL: https://adserver.pressboard.ca/v3/embedder?media=100238
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 77e8dc9daa2a1994bea56c60a6c7c1f0d24864c4e765981ff9e225c6503b9ac5

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 23182
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
544 B 104ms
34ms XHR
application/json 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=185231
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/185231-236799431399759.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 2e88761f091cce555c59273874bc97538b34942c12209c6986f9c859e6dc103b

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://mobilesyrup.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Wed, 04 Aug 2021 18:48:25 GMT

GET
H2 451 identity Show response
api.rlcdn.com/api/ 44 B
328 B 33ms
14ms XHR
text/plain 34.120.133.55
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.rlcdn.com/api/identity?pid=2&rt=envelope

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/185231-236799431399759.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.133.55 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
via: 1.1 google
x-content-type-options: nosniff
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
access-control-allow-methods: GET, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
alt-svc: clear
content-length: 44

GET
H/1.1 200
OK count.js Show response
mobilesyrup.disqus.com/ 1 KB
1 KB 46ms
14ms Script
application/javascript 151.101.12.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://mobilesyrup.disqus.com/count.js

Requested by

Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:25 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 31
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Thu, 01 Jul 2021 20:11:30 GMT
Server: nginx
ETag: "60de2172-367"
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
X-Amz-Cf-Pop: DFW3-C1
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id: 5uLebIxe6oQoZ8oVMTXnQTJ7Lus7UNjXqqTC5cGkTw9YwBkHb_PNKQ==

GET
H/1.1 200
OK embed.js Show response
mobilesyrup.disqus.com/ 75 KB
25 KB 47ms
15ms Script
application/javascript 151.101.12.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://mobilesyrup.disqus.com/embed.js

Requested by

Host: cdn.mobilesyrup.com
URL: https://cdn.mobilesyrup.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

7213609874f94569552b08c8e95d2fb35bf2183e926265b837c6f2cf6489ee23

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:25 GMT
Content-Encoding: gzip
Server: openresty
Age: 58
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 24721

GET
H2

200

/
www.google.de/pagead/1p-conversion/358847571/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/358847571/?random=1475344961&cv=9&fst=1625510905484&num=1&value=0&label=8EU5CPDDsbECENOojqsB&guid=ON&resp=GooglemKTybQhCsO&eid=25050...
https://www.google.com/pagead/1p-conversion/358847571/?random=1475344961&cv=9&fst=1625510905484&num=1&value=0&label=8EU5CPDDsbECENOojqsB&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=16...
https://www.google.de/pagead/1p-conversion/358847571/?random=1475344961&cv=9&fst=1625510905484&num=1&value=0&label=8EU5CPDDsbECENOojqsB&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=160...

42 B
108 B

22ms
21ms

Image
image/gif

2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/358847571/?random=1475344961&cv=9&fst=1625510905484&num=1&value=0&label=8EU5CPDDsbECENOojqsB&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg6u0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&tiba=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&auid=1253234708.1625510905&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=-VPjYIK5H4bl3wPBx4SgBg&cid=CAQSKQCNIrLM2VNsQCKrSczLyc6VTsIuILBCHXToo2EtqvSFtY-cPR6yNNae&eitems=ChAI8NuKhwYQvJWY7tius5pbEh0AtJj6CC1Uin3WQUJZIK0JCzSZlKlHJa_iLYNa3w&random=1218614934&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:25 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-conversion/358847571/?random=1475344961&cv=9&fst=1625510905484&num=1&value=0&label=8EU5CPDDsbECENOojqsB&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg6u0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&tiba=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&auid=1253234708.1625510905&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=-VPjYIK5H4bl3wPBx4SgBg&cid=CAQSKQCNIrLM2VNsQCKrSczLyc6VTsIuILBCHXToo2EtqvSFtY-cPR6yNNae&eitems=ChAI8NuKhwYQvJWY7tius5pbEh0AtJj6CC1Uin3WQUJZIK0JCzSZlKlHJa_iLYNa3w&random=1218614934&resp=GooglemKTybQhCsO&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 31ms
15ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=mobilesyrup.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 29ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=mobilesyrup.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 425 B
247 B 4162ms
4162ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=21824895126241&correlator=2003999698058997&output=ldjh&impl=fif&eid=31061750%2C31061421&vrg=2021063001&ptt=17&sc=1&sfv=1-0-38&ecs=20210705&iu_parts=1043318%2C320x50&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50&cust_params=pageID%3D818895&cookie=ID%3D6300beb5d6441e30-22915ddf73c80003%3AT%3D1625510905%3AS%3DALNI_MaR3ixaP8c3VaJ8Nij8a5i0puIFig&bc=31&abxe=1&lmt=1625510599&dt=1625510905665&dlt=1625510904705&idt=587&frm=20&biw=1600&bih=1200&oid=3&adxs=-12245933&adys=-12245933&adks=2631875331&ucis=a&ifi=10&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x4069&msz=320x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=2025090827.1625510905&ga_sid=1625510905&ga_hid=307982766&ga_fc=false&fws=640&ohw=0&btvi=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e83b6d50551d721d9657daafc49a40b2fb81d4316e4a0c722f7c08319100512c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 216
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/ 341 KB
133 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LcOhIsUAAAAAPPDNNulR3Pg0ZljBaD3ylvNqUgp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

839392b626a00e09ce3ec77706959d551de27cca63c559fcd4a6415aef3e722a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://mobilesyrup.com
Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:37:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 654
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135961
x-xss-protection: 0
last-modified: Mon, 28 Jun 2021 04:05:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 18:37:31 GMT

POST
H3-29 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
22 B 29ms
14ms XHR
text/plain 2a00:1450:400c:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-3143766-2&cid=2025090827.1625510905&jid=1411523886&gjid=1970830386&_gid=1040024553.1625510905&_u=aGDAgUABAAAAAG~&z=1615586945

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c08::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 05 Jul 2021 18:48:25 GMT
content-type: text/plain
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
6ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j91&a=307982766&t=pageview&_s=1&dl=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&ul=en-us&de=UTF-8&dt=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgUABAAAAAC~&jid=1411523886&gjid=1970830386&cid=2025090827.1625510905&tid=UA-3143766-2&_gid=1040024553.1625510905&cd1=Aisha%20Malik&cd2=2021-07-05%2009%3A17%3A43&cd3=news-apps&z=1759666430

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 17:50:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 3452
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3-29 200 /
www.facebook.com/tr/ 0
15 B 14ms
6ms Ping
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryogeeJVciORmlLdfX

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Mon, 05 Jul 2021 18:48:25 GMT
content-type: text/plain
access-control-allow-origin: https://mobilesyrup.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-length: 0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i

GET
H2 200 script.js Show response
sb.freeskreen.com/publisher/ 74 KB
22 KB 230ms
184ms Script
text/html 13.225.87.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.freeskreen.com/publisher/script.js?bai=27&ut=&uts=&flc=&slc=&windowlocation=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&usp=&gdpr=-1&cs=-1
Requested by: Host: static.freeskreen.com
URL: https://static.freeskreen.com/ba/27/freeskreen.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-95.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 2634dfb4274762aaa05ec065360dcccdb8d604c7bffb8625c6ac0c5b3aca9d97

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
content-encoding: gzip
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA2-C2
vary: Accept-Encoding
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
via: 1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
content-type: text/html;charset=UTF-8
content-length: 21814
x-amz-cf-id: G50AZGNMF8DIQJA6GwtJaN5F8lqO5zlDyKJKEZ2IexWQKs1fVLdScA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2

200

/ Show response
r.skimresources.com/api/
Redirect Chain

https://r.skimresources.com/api/
https://r.skimresources.com/api/?xguid=01F9W00200ZJFAM8TJBQA80G25&persistence=1&checksum=7d6a31522784e9fc938cdc76a53ddde058f1ac3e117c0f27c72302ad1a8565a0

240 B
520 B

19ms
19ms

XHR
application/json

35.190.59.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/?xguid=01F9W00200ZJFAM8TJBQA80G25&persistence=1&checksum=7d6a31522784e9fc938cdc76a53ddde058f1ac3e117c0f27c72302ad1a8565a0

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.59.101 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

openresty/1.11.2.5 /

Resource Hash

d50a93f6588e9e041a2ac91cff48d15b1dd31c2bf886030602ed869af59bcde2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: openresty/1.11.2.5
strict-transport-security: max-age=31536000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://mobilesyrup.com
vary: Accept-Encoding
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
via: 1.1 google

Redirect headers

date: Mon, 05 Jul 2021 18:48:25 GMT
via: 1.1 google
server: openresty/1.11.2.5
access-control-allow-origin: https://mobilesyrup.com
strict-transport-security: max-age=31536000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
location: https://r.skimresources.com/api/?xguid=01F9W00200ZJFAM8TJBQA80G25&persistence=1&checksum=7d6a31522784e9fc938cdc76a53ddde058f1ac3e117c0f27c72302ad1a8565a0
access-control-allow-credentials: true
content-type: text/html
alt-svc: clear
content-length: 193

GET
H2 206 robots.txt
t.skimresources.com/api/v2/ Frame 4E2B 0
102 B 36ms
21ms Image
text/plain 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.7500590528964652
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
via: 1.1 google
server: Python/3.7 aiohttp/3.5.4
alt-svc: clear
content-length: 0
content-type: text/plain charset=UTF-8

GET
H2 200 px.gif
p.skimresources.com/ 43 B
244 B 48ms
15ms Image
image/gif 35.190.91.160
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=1&rn=1.5483729393440853
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
alt-svc: clear
content-length: 43
content-type: image/gif

GET
H2 200 px.gif
p.skimresources.com/ 43 B
102 B 50ms
17ms Image
image/gif 35.190.91.160
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=2&rn=1.5483729393440853
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
alt-svc: clear
content-length: 43
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
92 B 7ms
6ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A9.3.3&blog=193906384&post=818895&tz=-4&srv=mobilesyrup.com&host=mobilesyrup.com&ref=&fcp=347&rand=0.6169847569346032
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 13ms
13ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=307982766&t=pageview&_s=1&dl=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&ul=en-us&de=UTF-8&dt=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%27%20Facebook%20passwords&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAUABAAAAAG~&jid=1999921152&gjid=1436979766&cid=2025090827.1625510905&tid=UA-21555618-14&_gid=1040024553.1625510905&_r=1&_slc=1&z=1808485886

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 event
api.stack-sonar.com/v1/ 0
101 B 308ms
99ms Image
text/plain 18.209.130.101
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://api.stack-sonar.com/v1/event?ts=1625510904961&_v=1.1.7&_c=stack-connect-wp&_a=3D7c2ofBEuFjA9byhtASZw&_f=0&_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&_r=&_x=0&_l=&_p=0&_z=1625510905864.1045251675&_y=1625510905864.160572214&_t=1625510906&_s=send&_e=session-start
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.209.130.101 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-209-130-101.compute-1.amazonaws.com
Software: nginx/1.14.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
cache-control: no-cache, no-store, must-revalidate
server: nginx/1.14.1
vary: Origin

POST
H3-29 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 17ms
17ms XHR
text/plain 2a00:1450:400c:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-21555618-14&cid=2025090827.1625510905&jid=1999921152&gjid=1436979766&_gid=1040024553.1625510905&_u=aGDAAUABAAAAAG~&z=598031874

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c08::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 05 Jul 2021 18:48:25 GMT
content-type: text/plain
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lounge.567531e1abfac5c88f2ef94b952d12ba.css
c.disquscdn.com/next/embed/styles/ 0
26 KB 27ms
8ms Other
text/css 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.567531e1abfac5c88f2ef94b952d12ba.css

Requested by

Host: mobilesyrup.disqus.com
URL: https://mobilesyrup.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:30:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2420290
x-cache: Hit from cloudfront
content-length: 25570
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 07 Jun 2021 17:13:02 GMT
server: nginx
etag: "60be539e-63e2"
content-type: text/css; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Tue, 07 Jun 2022 18:30:16 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: NSNzC5auIJo9kfeIKlFC0u47ASZrcPTWmulG6CM28jMMshEByzXj2Q==
x-cache-hits: 0

GET
H2 200 common.bundle.e51fe378e0cd63a2764bfb6c7ca542a8.js
c.disquscdn.com/next/embed/ 0
93 KB 27ms
8ms Other
application/javascript 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.e51fe378e0cd63a2764bfb6c7ca542a8.js

Requested by

Host: mobilesyrup.disqus.com
URL: https://mobilesyrup.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:30:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2420290
x-cache: Hit from cloudfront
content-length: 94800
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 07 Jun 2021 17:13:02 GMT
server: nginx
etag: "60be539e-17250"
content-type: application/javascript; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Tue, 07 Jun 2022 18:30:16 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: PqLbyc3HCAAtwNdymGQjqWwTz4Qjm-n0d6nf7UiMKUNrBQB8Qerc4Q==
x-cache-hits: 0

GET
H2 200 lounge.bundle.152a1430e3267673ea556dc28bb34a79.js
c.disquscdn.com/next/embed/ 0
118 KB 27ms
8ms Other
application/javascript 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.152a1430e3267673ea556dc28bb34a79.js

Requested by

Host: mobilesyrup.disqus.com
URL: https://mobilesyrup.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 18:34:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 432830
x-cache: Hit from cloudfront
content-length: 120424
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 30 Jun 2021 17:42:54 GMT
server: nginx
etag: "60dcad1e-1d668"
content-type: application/javascript; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Thu, 30 Jun 2022 18:34:35 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: 8ABbV40aSYaoAJ7PPkA8qxkgZGmfVmtydsrphYtmhxXGI0-ROB9-CQ==
x-cache-hits: 0

GET
H/1.1 200
OK config.js
disqus.com/next/ 0
12 KB 68ms
20ms Other
application/javascript 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: mobilesyrup.disqus.com
URL: https://mobilesyrup.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:26 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 28
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 12153
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK recommendations.js Show response
mobilesyrup.disqus.com/ 62 KB
21 KB 131ms
131ms Script
application/javascript 151.101.12.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://mobilesyrup.disqus.com/recommendations.js

Requested by

Host: mobilesyrup.disqus.com
URL: https://mobilesyrup.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

1c473af6229a31c626a4736e2c709f6305fc42990564baf9bbe50a186ac0c04e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:26 GMT
Content-Encoding: gzip
Server: openresty
Age: 0
Vary: Accept-Encoding, Accept, Accept-Encoding, X-Forwarded-Proto, X-Disqus-Shortname, X-Disqus-Device, X-Disqus-Experiment, X-Disqus-Is-Private, X-Disqus-Development-Base
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Cache-Control: stale-while-revalidate=60, public, stale-if-error=86400, max-age=60
X-Service: router
Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 20832

GET
H3-29 200 anchor Show response
www.google.com/recaptcha/api2/ Frame A4EA 38 KB
19 KB 31ms
31ms Document
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcOhIsUAAAAAPPDNNulR3Pg0ZljBaD3ylvNqUgp&co=aHR0cHM6Ly9tb2JpbGVzeXJ1cC5jb206NDQz&hl=en&v=TbD3vPFlUWKZD-9L4ZxB0HJI&size=invisible&cb=1dot3gfi19ne

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/recaptcha__en.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

98512d3b83bb12e4814a5053be92cebc7b42b81e6e7fe8e72de066469ac09c46

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-dPB+jzMr86cksNpu5xSwsg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LcOhIsUAAAAAPPDNNulR3Pg0ZljBaD3ylvNqUgp&co=aHR0cHM6Ly9tb2JpbGVzeXJ1cC5jb206NDQz&hl=en&v=TbD3vPFlUWKZD-9L4ZxB0HJI&size=invisible&cb=1dot3gfi19ne
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mobilesyrup.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 05 Jul 2021 18:48:26 GMT
content-security-policy: script-src 'report-sample' 'nonce-dPB+jzMr86cksNpu5xSwsg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 19764
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ga-audiences
www.google.com/ads/ 42 B
63 B 30ms
29ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-21555618-14&cid=2025090827.1625510905&jid=1999921152&_u=aGDAAUABAAAAAG~&z=546008237

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ga-audiences
www.google.de/ads/ 42 B
63 B 39ms
37ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-21555618-14&cid=2025090827.1625510905&jid=1999921152&_u=aGDAAUABAAAAAG~&z=546008237

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/ Frame A4EA 52 KB
25 KB 17ms
16ms Stylesheet
text/css 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcOhIsUAAAAAPPDNNulR3Pg0ZljBaD3ylvNqUgp&co=aHR0cHM6Ly9tb2JpbGVzeXJ1cC5jb206NDQz&hl=en&v=TbD3vPFlUWKZD-9L4ZxB0HJI&size=invisible&cb=1dot3gfi19ne

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 16:14:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9241
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Mon, 28 Jun 2021 04:05:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 16:14:25 GMT

GET
H3-29 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/ Frame A4EA 341 KB
133 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/recaptcha__en.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

839392b626a00e09ce3ec77706959d551de27cca63c559fcd4a6415aef3e722a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:37:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 655
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135961
x-xss-protection: 0
last-modified: Mon, 28 Jun 2021 04:05:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 18:37:31 GMT

GET
H/1.1 200
OK ac Show response
ww1772.smartadserver.com/ 2 KB
1 KB 415ms
364ms Script
application/javascript 185.86.137.17
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ww1772.smartadserver.com/ac?pgid=662773&insid=7974420&tmstp=6832248567&out=js
Requested by: Host: sb.freeskreen.com
URL: https://sb.freeskreen.com/publisher/script.js?bai=27&ut=&uts=&flc=&slc=&windowlocation=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&usp=&gdpr=-1&cs=-1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.17 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 49e90e0b934d3a353cf9c68e5971594386388d23a99d19726af18f4f60cd29a0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
content-encoding: br
vary: Accept-Encoding
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
x-smrt-i: 7974420
cache-control: no-cache,no-store
transfer-encoding: chunked
content-type: application/javascript; charset=UTF-8

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame D45A
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=123456&endpoint=us-west
https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west

281 B
554 B

33ms
9ms

Document
text/html

104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Requested by: Host: sb.freeskreen.com
URL: https://sb.freeskreen.com/publisher/script.js?bai=27&ut=&uts=&flc=&slc=&windowlocation=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&usp=&gdpr=-1&cs=-1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://mobilesyrup.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 23 Feb 2021 20:47:52 GMT
ETag: "402b0-119-5bc0708346e00"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 05 Jul 2021 18:48:26 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Date: Mon, 05 Jul 2021 18:48:26 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H/1.1

200
OK

getuid
sync.smartadserver.com/
Redirect Chain

https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fsa%3D%5Bsas_uid%5D
https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fsa%3D%5Bsas_uid%5D&cklb=1

0
75 B

28ms
27ms

Image
text/plain

185.86.138.143
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fsa%3D%5Bsas_uid%5D&cklb=1
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.143 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:25 GMT
content-length: 0

Redirect headers

location: https://sync.smartadserver.com:443/getuid?url=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fsa%3D%5Bsas_uid%5D&cklb=1
pragma: no-cache
date: Mon, 05 Jul 2021 18:48:25 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H2

200

verify
scm.publishers.tremorhub.com/pubsync/
Redirect Chain

https://scm.publishers.tremorhub.com/pubsync?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D
https://scm.publishers.tremorhub.com/pubsync/verify?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D

43 B
182 B

96ms
95ms

Image
image/gif

2600:1f18:612b:4200:4d87:fd70:3155:9022
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scm.publishers.tremorhub.com/pubsync/verify?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4200:4d87:fd70:3155:9022 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

Redirect headers

location: pubsync/verify?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D
date: Mon, 05 Jul 2021 18:48:26 GMT
server: Apache-Coyote/1.1
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'

GET
H2

200

um
sb.freeskreen.com/
Redirect Chain

https://cs.admanmedia.com/sync/smaato?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fac%3D{$UID}
https://sb.freeskreen.com/um?ac={$UID}

43 B
581 B

66ms
66ms

Image
image/gif

13.225.87.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/um?ac={$UID}
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-95.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
via: 1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: Rn2AQ-KkUCeVtkROmCufbV4hDXeE0zMvMp5bT5Y0OFTle2TG3tjevw==
expires: -1

Redirect headers

Location: https://sb.freeskreen.com/um?ac={$UID}
Date: Mon, 05 Jul 2021 18:48:26 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked

GET
H2 204 /
loadeu.exelator.com/load/ 0
324 B 89ms
27ms Image
text/plain 54.78.254.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadeu.exelator.com/load/?p=204&g=1300&j=0
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.78.254.47 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.9.1/ Frame EF8E 90 KB
32 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:30:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1099
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33018
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Jul 2022 18:30:07 GMT

GET
H/1.1 200
OK fsk.css
static.freeskreen.com/css/20210107205009/default/ Frame EF8E 50 KB
29 KB 18ms
17ms Stylesheet
text/css 13.225.87.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.freeskreen.com/css/20210107205009/default/fsk.css
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-63.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31ace63fa339896dc045f21da77b1ffdc57160e2db5690b132766b0086d6f58e

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 04 Jul 2021 19:46:57 GMT
Content-Encoding: gzip
Age: 82890
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 28958
Last-Modified: Thu, 07 Jan 2021 20:54:53 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1610052891/ctime:1610052892/gid:497/gname:jenkins/md5:ba07184144408ada0c1691c69221a457/mode:33188/mtime:1610052892/uid:498/uname:jenkins
ETag: "ba07184144408ada0c1691c69221a457"
x-amz-version-id: 5DtU9pV9aPv90d5PMlXs6Og9O1cWT0Fu
Via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA2-C2
Accept-Ranges: bytes
Content-Type: text/css
X-Amz-Cf-Id: xnRGPXZ7_rW2F2HFRzp3IG0g4n2K6UtGxQHmMevVDHpQzE_7oYbl2Q==

POST
H2 200 page Show response
t.skimresources.com/api/v2/ 22 B
88 B 38ms
37ms XHR
application/javascript 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/page

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/124649X1585574.skimlinks.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 22

POST
H2 200 link Show response
t.skimresources.com/api/v2/ 22 B
366 B 22ms
21ms XHR
application/javascript 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/link

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/124649X1585574.skimlinks.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
warning: 299 - "Deprecated API"
alt-svc: clear
content-length: 22

GET
H/1.1 200
OK / Show response
disqus.com/embed/comments/ Frame 2FDB 11 KB
5 KB 105ms
105ms Document
text/html 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default

Requested by

Host: mobilesyrup.disqus.com
URL: https://mobilesyrup.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

147a7507471d8ee5ad7dd3f1d7764999441f2a54d9f0ce6655c95f5b5219ac78

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://mobilesyrup.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

Connection: keep-alive
Content-Length: 3855
Server: nginx
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Type: text/html; charset=utf-8
Last-Modified: Mon, 05 Jul 2021 16:17:31 GMT
ETag: W/"lounge:view:8631453439.1aa98f733aa5ba33c42a0aff3fa91b18.2"
Referrer-Policy: no-referrer-when-downgrade
Content-Encoding: gzip
Date: Mon, 05 Jul 2021 18:48:26 GMT
Age: 0
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

POST
H2 200 api Show response
ls.skimresources.com/ 2 B
346 B 36ms
21ms XHR
application/json 34.120.117.212
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ls.skimresources.com/api

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/124649X1585574.skimlinks.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.117.212 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Python/3.8 aiohttp/3.6.3 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: application/json

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.8 aiohttp/3.6.3
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 2

OPTIONS
H2 206 api
ls.skimresources.com/ Frame 0
0 45ms
15ms Preflight
text/plain 34.120.117.212
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ls.skimresources.com/api
Protocol: H2
Server: 34.120.117.212 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Python/3.8 aiohttp/3.6.3 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://mobilesyrup.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://mobilesyrup.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-credentials: true
access-control-max-age: 1728000
content-type: text/plain charset=UTF-8
content-length: 0
date: Mon, 05 Jul 2021 18:48:26 GMT
server: Python/3.8 aiohttp/3.6.3
via: 1.1 google
alt-svc: clear

GET
H3-29 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame A4EA 2 KB
2 KB 6ms
6ms Image
image/png 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/styles__ltr.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 29 Jun 2021 23:32:38 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 501348
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
expires: Tue, 06 Jul 2021 23:32:38 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame A4EA 15 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.google.com
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 08:09:57 GMT
x-content-type-options: nosniff
age: 470309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 08:09:57 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame A4EA 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.google.com
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 29 Jun 2021 13:46:33 GMT
x-content-type-options: nosniff
age: 536513
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jun 2022 13:46:33 GMT

OPTIONS
H/1.1 200
OK attention-event
sr.studiostack.com/track/ Frame 0
0 375ms
96ms Preflight
text/html 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Protocol: HTTP/1.1
Server: 20.49.104.19 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://mobilesyrup.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Allow: POST
Content-Length: 4
Content-Type: text/html; charset=utf-8
Expires: 0
ETag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Date: Mon, 05 Jul 2021 18:48:25 GMT

POST
H/1.1 200
OK attention-event Show response
sr.studiostack.com/track/ 0
396 B 120ms
119ms XHR
text/plain 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Requested by: Host: sr.studiostack.com
URL: https://sr.studiostack.com/v3/services
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:26 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Access-Control-Allow-Origin: *
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 0
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

GET
H2 200 recommendations.eff219b98b7c4167b4b289065f36f391.css
c.disquscdn.com/next/recommendations/styles/ 0
4 KB 16ms
16ms Other
text/css 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/styles/recommendations.eff219b98b7c4167b4b289065f36f391.css

Requested by

Host: mobilesyrup.disqus.com
URL: https://mobilesyrup.disqus.com/recommendations.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 10:11:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5215031
x-cache: Hit from cloudfront
content-length: 3748
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 28 Apr 2021 21:48:08 GMT
server: nginx
etag: "6089d818-ea4"
content-type: text/css; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Fri, 06 May 2022 10:11:15 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: 0EblsxyxodYIaKoxbOQKABB1yoCNEg4pyU1k_IU28xgwFuvu6K9Pbg==
x-cache-hits: 0

GET
H2 200 common.bundle.3c0a438a5a4962a39ee30fd041fd5ca9.js
c.disquscdn.com/next/recommendations/ 0
87 KB 17ms
17ms Other
application/javascript 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/common.bundle.3c0a438a5a4962a39ee30fd041fd5ca9.js

Requested by

Host: mobilesyrup.disqus.com
URL: https://mobilesyrup.disqus.com/recommendations.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:30:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2420297
x-cache: Hit from cloudfront
content-length: 88889
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 07 Jun 2021 17:13:02 GMT
server: nginx
etag: "60be539e-15b39"
content-type: application/javascript; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Tue, 07 Jun 2022 18:30:09 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: VhMzasl_62nSCoWOMYyQBjaZcN7fL-FZmw5BOC3sueBI6XYs4qHhjw==
x-cache-hits: 0

GET
H2 200 recommendations.bundle.37a289e2ed6acdf6cbf01e83d4fb3ce6.js
c.disquscdn.com/next/recommendations/ 0
20 KB 17ms
17ms Other
application/javascript 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/recommendations.bundle.37a289e2ed6acdf6cbf01e83d4fb3ce6.js

Requested by

Host: mobilesyrup.disqus.com
URL: https://mobilesyrup.disqus.com/recommendations.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 18:34:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 432835
x-cache: Hit from cloudfront
content-length: 20103
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 30 Jun 2021 17:42:54 GMT
server: nginx
etag: "60dcad1e-4e87"
content-type: application/javascript; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Thu, 30 Jun 2022 18:34:31 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: BOSdURD4eSyWVHrmZBGJqAHYHSZc9hsM-SGUh2xkk_AKpIYxZHz0dQ==
x-cache-hits: 0

GET
H/1.1 200
OK player-hb.js Show response
static.freeskreen.com/scm/player/20210119a/ Frame EF8E 265 KB
68 KB 19ms
18ms Script
text/javascript 13.225.87.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.freeskreen.com/scm/player/20210119a/player-hb.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-63.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: eb8b1b4a5fe4e1a1e7ee49bcd6cb07b6e56241a8d2718c1dc9928b3e5b727359

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: YDT3w.3tTghYPiJN2Xp7Eh4mZtOYFe5I
Content-Encoding: gzip
ETag: "c60d74c8a8cea6a2ea292e3e380da599"
Age: 71823
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 69007
Last-Modified: Tue, 19 Jan 2021 09:08:10 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1611047278/ctime:1611047286/gid:20/gname:staff/md5:c60d74c8a8cea6a2ea292e3e380da599/mode:33188/mtime:1611047278/uid:501/uname:mickael
Date: Sun, 04 Jul 2021 22:51:24 GMT
Content-Type: text/javascript
Via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA2-C2
Accept-Ranges: bytes
X-Amz-Cf-Id: Mjii4Uls3Bj28G2ihKtwv2bG_Sa0RkvczGdjTTLR0RsIKyEwE3yesw==

GET
H3-29 200 container.html Show response
8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9D65 6 KB
3 KB 20ms
7ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mobilesyrup.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 05 Jul 2021 18:48:25 GMT
expires: Tue, 05 Jul 2022 18:48:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4a89afd48453d83067f4f59988766d5bded647ac8e316bbb5fe7572bbce06c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225358082386"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27725
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:26 GMT

GET
H3-29 200 webworker.js
www.google.com/recaptcha/api2/ Frame A4EA 102 B
132 B 16ms
15ms Other
text/javascript 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=TbD3vPFlUWKZD-9L4ZxB0HJI

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

5dfdffa77335a103ec942c9384df984b5d38a267d619ee0ac3a045b766bbf2d5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcOhIsUAAAAAPPDNNulR3Pg0ZljBaD3ylvNqUgp&co=aHR0cHM6Ly9tb2JpbGVzeXJ1cC5jb206NDQz&hl=en&v=TbD3vPFlUWKZD-9L4ZxB0HJI&size=invisible&cb=1dot3gfi19ne
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Mon, 05 Jul 2021 18:48:26 GMT

GET
H/1.1 200
OK attention-data Show response
sr.studiostack.com/track/ 191 B
678 B 412ms
131ms XHR
application/json 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-data?media=100238&ref=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F
Requested by: Host: sr.studiostack.com
URL: https://sr.studiostack.com/v3/services
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 24de7b44436d25ff3df591e6de91f282e80e701c10b231e535bc707676f0ce92

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:25 GMT
ETag: W/"bf-3EIBe9oNYAkKTe0q0Cm2xxJLen0"
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 191
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame D45A 31 KB
9 KB 14ms
14ms Script
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 9ddda23179d75bf5090b03b5ca00786004a82b54dd9346599aa9eece613c9ed5

Request headers

Referer: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:26 GMT
Content-Encoding: gzip
Last-Modified: Mon, 14 Jun 2021 16:13:39 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=73685
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9276
Expires: Tue, 06 Jul 2021 15:16:31 GMT

GET
H/1.1 200
OK / Show response
disqus.com/recommendations/ Frame 3BC7 5 KB
3 KB 122ms
122ms Document
text/html 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/recommendations/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords

Requested by

Host: mobilesyrup.disqus.com
URL: https://mobilesyrup.disqus.com/recommendations.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

0f5c93fd34113f645653261b57ff2e9845ffe88efc36757e4b7d748cb3538729

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://mobilesyrup.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

Connection: keep-alive
Content-Length: 2362
Server: nginx
Content-Type: text/html; charset=utf-8
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Last-Modified: Thu, 10 Jun 2021 03:28:48 GMT
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-while-revalidate=30, no-cache, must-revalidate, stale-if-error=3600, public
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Encoding: gzip
Date: Mon, 05 Jul 2021 18:48:26 GMT
Age: 0
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

GET
H/1.1 200
OK F44630BFF8F3C6CE4CE115B339AF014D.cache.js Show response
static.freeskreen.com/gwt/20210107205009/advertisement/freeskreen_splitbox_client/ Frame EF8E 98 KB
34 KB 17ms
16ms Script
application/javascript 13.225.87.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.freeskreen.com/gwt/20210107205009/advertisement/freeskreen_splitbox_client/F44630BFF8F3C6CE4CE115B339AF014D.cache.js
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-63.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 19ac7f7f03270e923c602d544845da674a088cbb610a4c76a6445f0d075b7d0f

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: jP3BhKySKcISIxarwq4cPXWHxkq.8vAk
Content-Encoding: gzip
ETag: "ffc2c23e98e50d5acfafe8ccfc4dc585"
Age: 43383
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 34110
Last-Modified: Thu, 07 Jan 2021 20:54:06 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1610052721/ctime:1610052845/gid:497/gname:jenkins/md5:ffc2c23e98e50d5acfafe8ccfc4dc585/mode:33188/mtime:1610052721/uid:498/uname:jenkins
Date: Mon, 05 Jul 2021 06:45:54 GMT
Content-Type: application/javascript
Via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA2-C2
Accept-Ranges: bytes
X-Amz-Cf-Id: pS-fYhhRokXrUOA2YDvpe-h5UF92jLEhJK6XYXS17n3sTMZY7LheNg==

GET
H2 200 t.gif
sb.freeskreen.com/ Frame EF8E 43 B
411 B 55ms
54ms Image
image/gif 13.225.87.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1625510906&p=4444&c=5824&s=undefined&d=&v=&t=6d275153-e725-4d26-87db-c22ec2ec5713&co=DE&pr=BE&ci=Berlin&dm=null&flc=&slc=&ttm=1625510905996&gdpr=1&gdpr_consent=-1&e=AdOpened&m=2&x=null
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-95.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
via: 1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: QcZNjPe-TSPz19r_x4wck-nrpgFHNRahgFRquo4aNlAMOocAp8JyiA==
expires: -1

GET
H2 200 lounge.load.e34a397b02545d73e126b1219e8f0e66.js Show response
c.disquscdn.com/next/embed/ Frame 2FDB 1 KB
1 KB 38ms
8ms Script
application/javascript 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.load.e34a397b02545d73e126b1219e8f0e66.js

Requested by

Host: disqus.com
URL: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

2a5db92958908a603c87c0cbd7b153ed3e3bab026021791f60ac4b59151b66a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://disqus.com
Referer: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 18:34:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 432830
x-cache: Hit from cloudfront
content-length: 534
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 30 Jun 2021 17:42:54 GMT
server: nginx
etag: "60dcad1e-216"
content-type: application/javascript; charset=utf-8
via: 1.1 7158aa4ac648947d564b98d9769b5b2b.cloudfront.net (CloudFront)
expires: Thu, 30 Jun 2022 18:34:36 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: 5ZoNq0Xs6Tn4X-wDgfkHBts1vS4h3m7msd1IwzAopxSe6HeSbWyCcw==
x-cache-hits: 0

POST
H3-29 200 reload Show response
www.google.com/recaptcha/api2/ Frame A4EA 29 KB
16 KB 54ms
54ms XHR
application/json 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6LcOhIsUAAAAAPPDNNulR3Pg0ZljBaD3ylvNqUgp

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/recaptcha__en.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f3bbb4aef0a334a7e2d691c563ef1e6e214a189fe528c6e4b4c07e5060d80b0d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcOhIsUAAAAAPPDNNulR3Pg0ZljBaD3ylvNqUgp&co=aHR0cHM6Ly9tb2JpbGVzeXJ1cC5jb206NDQz&hl=en&v=TbD3vPFlUWKZD-9L4ZxB0HJI&size=invisible&cb=1dot3gfi19ne
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16201
x-xss-protection: 1; mode=block
expires: Mon, 05 Jul 2021 18:48:26 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C6D6 624 B
297 B 17ms
16ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJHu6K0BMAE&v=APEucNWFQOIv0pFe7MMWo7R2bmAjqT3DtA4ObUayMZnpWmD6XZ1spvfpq5F62Gzaw7188p-vDIm271tkNV4fVSaF10RPvp0egUnhCeADDD3h8vJofLR7AAU6OnOLqoEGdzjWck1x0MGuFIJtqbhRGSfBgopAVEA_CU2cFN2T3ZRWBrpa42B73y4

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=COWiHhDhjN4CGJHu6K0BMAE&v=APEucNWFQOIv0pFe7MMWo7R2bmAjqT3DtA4ObUayMZnpWmD6XZ1spvfpq5F62Gzaw7188p-vDIm271tkNV4fVSaF10RPvp0egUnhCeADDD3h8vJofLR7AAU6OnOLqoEGdzjWck1x0MGuFIJtqbhRGSfBgopAVEA_CU2cFN2T3ZRWBrpa42B73y4
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUk2tpGRdJlNUTUFPWRXhti_fx-KjeI8uUvEgmklzqchXD6VXTacDhheHq1JQbQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 05 Jul 2021 18:48:26 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 get_page_signal_url_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/ Frame 9D65 4 KB
2 KB 30ms
8ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/get_page_signal_url_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

858361d285ad5b0369469afc26ff28e975019a3b3a25ad4748e95178eae88192

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:28:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1223
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2074
x-xss-protection: 0
server: cafe
etag: 10027585619949027602
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:28:03 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame 9D65
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/741547/55522419/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=

43 B
259 B

342ms
31ms

Image
image/gif

52.49.37.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.49.37.161 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-49-37-161.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: nginx/1.16.1
age: 12583867
etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-cache-status: HIT
content-type: image/gif
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 43

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
x-server-name: app30.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 9D65 3 KB
2 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:46:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 102
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:46:44 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9D65 123 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225346277716"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:26 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 9D65 14 KB
6 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:48:16 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9D65 42 B
63 B 48ms
46ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DUXK9cJBVWYa52PW0EtKCqjJfLNft8Q5_Tr58xU6VynYRWIYkZBKEoKh_TWojNA2BpztTLs57Kbsj7GiDa373MZ7ztJQ8k2zl8gh2VOJrAJeGVVxc

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame D45A 284 B
536 B 96ms
23ms Image
image/jpg 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Content-Type: image/jpg

GET
H2 200 common.bundle.e51fe378e0cd63a2764bfb6c7ca542a8.js Show response
c.disquscdn.com/next/embed/ Frame 2FDB 282 KB
93 KB 7ms
7ms Script
application/javascript 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.e51fe378e0cd63a2764bfb6c7ca542a8.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.e34a397b02545d73e126b1219e8f0e66.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

2025b295509745f39f42f941f1f806395a81e23e146febbff2e85e00df651b93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:30:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2420290
x-cache: Hit from cloudfront
content-length: 94800
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 07 Jun 2021 17:13:02 GMT
server: nginx
etag: "60be539e-17250"
content-type: application/javascript; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Tue, 07 Jun 2022 18:30:16 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: BgEMbH-3V16AFuOPF3bIKr0X8zSzHZnkLp0LHaUXVnYDCju_GhIY4Q==
x-cache-hits: 0

GET
H2 200 ads-beacon.js Show response
mobilesyrup.com/ 79 B
297 B 14ms
11ms Script
application/javascript 148.251.232.158
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mobilesyrup.com/ads-beacon.js?ts=34563
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/RgPSN0siEWzj.js?ts=40225
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 148.251.232.158 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.158.232.251.148.clients.your-server.de
Software: nginx /
Resource Hash: fab8b9c7025d4460c1eeedac6bbf8fdc61d0b0e38fd359a3dccba86ce92edbbb

Request headers

:path: /ads-beacon.js?ts=34563
pragma: no-cache
cookie: dmxRegion=false; _gcl_au=1.1.1253234708.1625510905; _fbp=fb.1.1625510905197.1778296154; _ga=GA1.2.2025090827.1625510905; _gid=GA1.2.1040024553.1625510905; _gat_gtag_UA_3143766_2=1; _gat=1; _gat_scDealFeedWidgetGA=1; _scp=1625510905864.1045251675; _scs=1625510905864.160572214; __psid=1625510906203; __gads=ID=50c2ed67a9a5421e:T=1625510905:S=ALNI_MaDYM6w74HcU2ecFIfU1awBY20peQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: mobilesyrup.com
referer: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache
x-presslabs-stats: desktop
x-request-id: 9408825044e5bc35270e8010f1d86b12
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1

200
OK

webm&rp_secure=1&tg_c.language=en&width=603&height=338&rf=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&p_aso.video.protoc... Show response
vast.rubiconproject.com/a/api/vast.xmlaccount_id=23502&site_id=374154&zone_id=%202049512&size_id=203&p_aso.video.minduration=5&p_aso.video.maxduration=300&p_aso.video.api=2&p_aso.video.mimes=applic... Frame EF8E
Redirect Chain

https://optimized-by.rubiconproject.com/a/api/vast.xmlaccount_id=23502&site_id=374154&zone_id=%202049512&size_id=203&p_aso.video.minduration=5&p_aso.video.maxduration=300&p_aso.video.api=2&p_aso.vi...
https://vast.rubiconproject.com/a/api/vast.xmlaccount_id=23502&site_id=374154&zone_id=%202049512&size_id=203&p_aso.video.minduration=5&p_aso.video.maxduration=300&p_aso.video.api=2&p_aso.video.mime...

28 B
1 KB

339ms
25ms

XHR
application/xml

69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://vast.rubiconproject.com/a/api/vast.xmlaccount_id=23502&site_id=374154&zone_id=%202049512&size_id=203&p_aso.video.minduration=5&p_aso.video.maxduration=300&p_aso.video.api=2&p_aso.video.mimes=application/javascript,video/mp4,video/webm&rp_secure=1&tg_c.language=en&width=603&height=338&rf=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&p_aso.video.protocols=2,3,5,6&rp_floor=5.0&p_aso.video.playbackmethod=2&p_pos=0&tg_i.=?tk_vps=2
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: a8fb181a797b4e48bb5d239ab5030f33ed65ebf339e38a5131ce966331226cef

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:26 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: null
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/xml
Keep-Alive: timeout=5
Content-Length: 28
Expires: Wed, 17 Sep 1975 21:32:10 GMT

Redirect headers

sec-fetch-mode: cors
date: Mon, 05 Jul 2021 18:48:26 GMT
origin: https://mobilesyrup.com
accept-encoding: gzip, deflate, br
accept-language: en-US
x-forwarded-for: 89.249.64.203
sec-fetch-dest: empty
x-forwarded-proto: https
content-length: 0
pragma: no-cache
access-control-allow-origin: https://mobilesyrup.com
host: optimized-by.rubiconproject.com
x-amzn-trace-id: Root=1-60e353fa-06510b8a7a732c7232741fad
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
location: https://vast.rubiconproject.com/a/api/vast.xmlaccount_id=23502&site_id=374154&zone_id=%202049512&size_id=203&p_aso.video.minduration=5&p_aso.video.maxduration=300&p_aso.video.api=2&p_aso.video.mimes=application/javascript,video/mp4,video/webm&rp_secure=1&tg_c.language=en&width=603&height=338&rf=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&p_aso.video.protocols=2,3,5,6&rp_floor=5.0&p_aso.video.playbackmethod=2&p_pos=0&tg_i.=?tk_vps=2
accept: application/xml, text/xml, */*; q=0.01
cache-control: no-cache
access-control-allow-credentials: true
referer: https://mobilesyrup.com/
sec-fetch-site: cross-site
x-forwarded-port: 443

GET
H2 200 tag Show response
pc027-5uv1f.ads.tremorhub.com/ad/ Frame EF8E 55 B
501 B 440ms
227ms XHR
application/json 2600:1f18:612b:4232:747e:f74d:61b4:6f60
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pc027-5uv1f.ads.tremorhub.com/ad/tag?adCode=pc027-afz2p&playerWidth=603&playerHeight=338&playerPosition=3&srcPageUrl=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&gdpr=1&gdpr_consent=&custom=5824&c2=en-ca&floor=USD:5&us_privacy=&fmt=json
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4232:747e:f74d:61b4:6f60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: fcf32fc8905a8c29ef08924a24b56758022bf2f3b76993ed21194f33158fbdd4

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
content-encoding: gzip
server: Apache-Coyote/1.1
vary: accept-encoding
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-tremorvideo-status: NO_AD
content-type: application/json;charset=UTF-8

GET
H2 204 bid Show response
ads.freeskreen.com/ Frame EF8E 0
197 B 662ms
452ms XHR
text/plain 35.173.5.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.freeskreen.com/bid?pid=4444&tid=6d275153-e725-4d26-87db-c22ec2ec5713&w=603&h=338&u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&ip=89.249.64.203&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&g_co=DE&g_p=BE&g_ci=Berlin&g_d=null&s_1=&s_2=&cid=5824&sid=undefined&vid=298&did=1234605&pf=500&ttm=1625510905996&eu_c=-1&eu_g=1&eu_ggl=0
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.5.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/xml, text/xml, */*; q=0.01
Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: Apache-Coyote/1.1
access-control-allow-methods: GET
access-control-allow-origin: https://mobilesyrup.com
cache-control: no-cache, no-store
access-control-allow-credentials: true
expires: -1

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C6D6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENzGpaAseFr7sFwr7-BXlhc&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENzGpaAseFr7sFwr7-BXlhc&google_cver=1&C=1

43 B
1014 B

31ms
31ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENzGpaAseFr7sFwr7-BXlhc&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJHu6K0BMAE&v=APEucNWFQOIv0pFe7MMWo7R2bmAjqT3DtA4ObUayMZnpWmD6XZ1spvfpq5F62Gzaw7188p-vDIm271tkNV4fVSaF10RPvp0egUnhCeADDD3h8vJofLR7AAU6OnOLqoEGdzjWck1x0MGuFIJtqbhRGSfBgopAVEA_CU2cFN2T3ZRWBrpa42B73y4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:26 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 05 Jul 2021 18:48:26 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:26 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENzGpaAseFr7sFwr7-BXlhc&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Mon, 05 Jul 2021 18:48:26 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C6D6
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YONT.glzSMNNxuXTJnYyswAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAKvtW_Vr1Ercj4cV0T3YbU&google_cver=1&google_hm=2

43 B
894 B

81ms
81ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAKvtW_Vr1Ercj4cV0T3YbU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJHu6K0BMAE&v=APEucNWFQOIv0pFe7MMWo7R2bmAjqT3DtA4ObUayMZnpWmD6XZ1spvfpq5F62Gzaw7188p-vDIm271tkNV4fVSaF10RPvp0egUnhCeADDD3h8vJofLR7AAU6OnOLqoEGdzjWck1x0MGuFIJtqbhRGSfBgopAVEA_CU2cFN2T3ZRWBrpa42B73y4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:26 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 05 Jul 2021 18:48:26 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAKvtW_Vr1Ercj4cV0T3YbU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame C6D6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEAApv-H7UkvxmZ82f8psjV0&google_cver=1

43 B
1004 B

46ms
18ms

Image
image/gif

37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEAApv-H7UkvxmZ82f8psjV0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJHu6K0BMAE&v=APEucNWFQOIv0pFe7MMWo7R2bmAjqT3DtA4ObUayMZnpWmD6XZ1spvfpq5F62Gzaw7188p-vDIm271tkNV4fVSaF10RPvp0egUnhCeADDD3h8vJofLR7AAU6OnOLqoEGdzjWck1x0MGuFIJtqbhRGSfBgopAVEA_CU2cFN2T3ZRWBrpa42B73y4

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:26 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 1606ced8-909f-40f8-8eab-5b1ced329988
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEAApv-H7UkvxmZ82f8psjV0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C6D6
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

170 B
188 B

37ms
19ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:26 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 5102a4f4-cac0-42bc-a912-42e7a5a3a1a8
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9D65 63 KB
24 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Al5cTgM3ss1evB0KOPajRK73mEzTCNvm0SmWYWUPmzARM5sE98H-7_VTwO0KzHVAkZ5S8wLa6AqFHhYdiOctlhrxCD3vR-ymYGL_JCZkBByRqpD9x7krIgPW4Bq3N6OVDTU2SEgC1KNMxuu2a_zd_raYd_Ew&dbm_d=AKAmf-CHFQd5P58DnTFQpLuYTfDxaW4TZ-F91m6urtpmYjqYjim0zARZLvE5_AQUw0zCWrEpevOSmdXV14QcUsnwdHR4H4TK1iB9fHnfUuGKmSJiyBO_SOXzFRxuiCZI28825scVfgEP_dnYiSlhslxQt8IWDK3fsStBcLPD0Heb1tr6_AxDY5D9kkro6pQ4R2m4F39YlNGhWOL8Zf_cIOFEb2erkCZnEx8IsbE9GMIeFBsP7Fn6c7KKvMCkZv8VKfDF48saiNQAPbhp8VYP95kIb3Gwld6CElkBpIErr5ZSqH3W4vkY__xevEXxaj-B2d8M1fgvkmHK8aqjZeW9Kbb7w94SXwTJCxI3RgcoIRFMrz4BP4f2jyHt9OdsO0499bEvPk7WwBNrpRmtDPEhm3GmHvX_FxzXjz0oVaf9wM3-kSm2Bk9NHsqVuJu3VXialVQ1h2jyDvjmeg8AGraax4Og6lFYK5A5u56nG_YSmiEmJW8gSH4FaJ_Vc4aQCsvlEx5Go_0G1LxVdPMJa1zOKzxcb6Jm8SgyQfyOP0721ZfR2pM51bFA7aYr-YM1Wq317KaEjVhizOfSvVYwiyrIsTy-zcF-FIpP611NuhbFyhqz-qQ_1x1WKa5YNv0kgn9t2NO21iiYPiRyqhUcmNdRMMUsIoGoFgzA7wJHEsQExALsqc_9bPYdcYka7GnihYUo0B9Y2IZxVN437dzbY57vvYSSk4CYv5Ock7RjNM29V_lMTu0h_PTA4h708iv75GFjw5vzcEbzLy3Zft3QjiWUW1DD-8UsCoSz9asy0UbbVJ4i-2vgce_bGEKGJZlU2Jxy0khKdafeIQ5VZxTuGqjd9qEMiTH0NRDfH2qU16pVc2VqarJw0jtCjPLVMgcgNMNSjq1yva8cOhi3cMMNGP-qb5cZwJCOwU8yHU6YykyLFmntWRUT5hntV2mwSrFjwqxW8nasopCwildYcBGfAO3O0F9F0MqpvVw4mJeHBkS1n6lcz4pt2b70A9HcIDcRsIAr9CbYoUz93MWXejCoHpcbzzBWciH2FhEWToEWkh8nvQr9A8Xo_zRkoVW7Vt2ijUys7N5Xrec4WbbVo2bvaGZjQxveO_pLx2AA4hlw348bGusU3up-w_LojYjU2cYuDB-7z8E10Kw72wmNqQ0nz5fKQL2zEuV80o8uUdadbO_sfYKgNYQccgT2qShlU0AC9FLtD7Vi58Y37AR6xU3EPL8TrWUKKyepRgzIg98CcEMwUleVFRl-WfDxPxoVeX2KJcX-GqXoKkOcNXsWcm-hsCtb5TXY_DapgkCAOl0JUk2aPN3BOTHOeKCtMzRFi54Rahw_o5HNi5jpgUocGiPZ0k63EatqN1DKqyQy1gwudR02arnh9BTg7w8jcC1RGr1njn5uHcJ8gVrxZTZ_2-_PVgL5Dwv55hpNhIcIsHyi2S49UuXzJ8urr7gJ0z3HMcCt1yDvQiE4SaHz7ehqbB5H4MszsR-id70qaW7pH6P_MCyEaYVMowAxuGlmt9gUEjcrOuraTgcg_dk3y-ln6pUn5RH-pGlCy3ZZDaWzGJ9iSv7UBKHvuT2w9Jad5YlxztpXfSAFgn74JpnG_muqpdrQMLYIMKVIjogBkplJh64VpYfP_1MxSji1idz5q-ByWT0Qf7uyNqL0Q5J7k_Sy8qCiysodr7eS_dgSAC0cqEumzUQfiKndeN7BALd3rp2KmARMRLRd6j7ev2mvKYjuwu2-fPhJO4XPNSaPFh-YjWJkiXGpSsyX5taGGnwKH3EO9lfFLJwR_yMUJKYTipmRoFu920RkNPob-zD4VQ6AB9m6Y3EB5MVrH4GdoOeF9fk83BtCkG4kPF3a8dLKsrYnAapRQo1V6aevVrd1GcEu-b8upl5B88i3i7goq2dCz8Aj7dRVQkR9YaayueD3jNizu55KDZIdaxdbu0MAHL73YFcsvvrG5XHypu0zNF7Y806xuBOMk-z_oE3opGo9C5-IL0VikRMHN40ZKlCaq3bxMpjeziUffUPcJ_RtZyR2Nzv_k81SLap2RQAdps_af-KiVwEaLv4LTr1fFfXKiYdtCljvza9RE5f-Inv6M_7bWWcHW9KWdVM1L2kgi_52A3-kt-rvLUvnOhQYoyywN6sIKbUT1aUn4Pcaa4UievGN4sTAGvsRU9x4HEhesuY3nsSgdWab4keibJjGPHqRsOoTKcj26gRdsEqkCNl70SSP5Xoj1YVUeaOy4k1qZ1slRFLlhQmMptbEmMM3LpmgsHydqrTavoCkbn8Bt7letLlUwe8tFvQaBJHtJnFkZAMbyTwszDCoXRHkmqMA-NJEcb8c8Jd2frnDJ7Kpf1VnOzw79rgu2XxrexhY2jUBfOFniDGNZEtDVUUs7T8d4SYTOs4o1-yamCIbIYuZvuxQe1CtWwWhIKxU5nq1AOwG4RK2i823tPuT8bNgG0-v19K5dNBIRWV_i_aViS2JUHxmp7LEcXybeNRmVIjTu2OtjrlnOy8XE4qSZBoPbLvFf4ZrZYXKF26Ifsb4GKKmvG9mFpqi2CP5MYwv4elYMGiHELJkvXOim3_EiWcDytUWzm0w5WVnzJd23iDBp5d6q1ZK5aV4kaItX7TGqi51QXU2tT2_ZWKrIRGwnZd2W5tTJd0EmUws64dimVTZef8FvpEH9V0efe66xb38GntGjVccQ36bwZkNguAv7i8hIFvNeRe3kR23lmcKAyeQUWqYKptQPixPmCjqrIMFG9v0Km9wRhmCuFJ91vZfK7oPzdiVHVptSQnWKLt9JnzRB_eUK2dXmAAOjYF-Ms-DLX654jm_EKbdFV1RTTRhfNZB4jvc8NrzSQE9Gf4N7cmNZIyKU-SSQRVfTJW7OEe6tZIr1D2Is0hGeUlzzOIgfVqzV7WpPba8vuV8whrSl3lZUmWIjQPDzWxNM7-bsv9dUcNyWqdgyzsFrRaWRHv0or_EfAg0wGfjs3FAe4nRZbWBeqRuU1-I4zWz7jF0wtZBsnK8TZ19SE3K07HG9o5mSCP4RFLNpNoh5xMMEsvxJRB-C5IN13rfkcCwWxMo43YMCZebgBWgZnkyF6srO8QdTZUaiETnrmTqBrMbPw&cid=CAASEuRopq5yF5G0L09V3gAxAPg7cw&rfl=1%2Chttps%253A%252F%252Fmobilesyrup.com%252F%240

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

10d71372c4a2488e70575ed547aaee40f2cb7d96c4c4a1221195473b2cf59529

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24976
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame F210
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=smartadserver&endpoint=eu
https://eus.rubiconproject.com/usync.html?p=smartadserver&endpoint=eu

281 B
554 B

12ms
12ms

Document
text/html

104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=smartadserver&endpoint=eu
Requested by: Host: ww1772.smartadserver.com
URL: https://ww1772.smartadserver.com/ac?pgid=662773&insid=7974420&tmstp=6832248567&out=js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://mobilesyrup.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 23 Feb 2021 20:47:52 GMT
ETag: "402b0-119-5bc0708346e00"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 05 Jul 2021 18:48:26 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=smartadserver&endpoint=eu
Date: Mon, 05 Jul 2021 18:48:26 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H2 200 recommendations.load.d21c88f023def29b898231ae9d2cafb8.js Show response
c.disquscdn.com/next/recommendations/ Frame 3BC7 923 B
1019 B 12ms
11ms Script
application/javascript 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/recommendations.load.d21c88f023def29b898231ae9d2cafb8.js

Requested by

Host: disqus.com
URL: https://disqus.com/recommendations/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

8560d2f34792426340aa3375a67eec4d07388433aec166c0c860a68e1096d4e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://disqus.com
Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 18:34:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 432834
x-cache: Hit from cloudfront
content-length: 447
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 30 Jun 2021 17:42:54 GMT
server: nginx
etag: "60dcad1e-1bf"
content-type: application/javascript; charset=utf-8
via: 1.1 7158aa4ac648947d564b98d9769b5b2b.cloudfront.net (CloudFront)
expires: Thu, 30 Jun 2022 18:34:32 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: X7XfmhmLUPxJuMVAfMfwT1wdJFio6VV1hqqZVSV7aU00czT21RnWDQ==
x-cache-hits: 0

GET
H2 200 lounge.567531e1abfac5c88f2ef94b952d12ba.css
c.disquscdn.com/next/embed/styles/ Frame 2FDB 158 KB
26 KB 10ms
9ms Stylesheet
text/css 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.567531e1abfac5c88f2ef94b952d12ba.css

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.e51fe378e0cd63a2764bfb6c7ca542a8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

58e8635e959ce8b5383dcbf9dd50fda2f6a0aeef426760854dfdb2548a3b77fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:30:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2420290
x-cache: Hit from cloudfront
content-length: 25570
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 07 Jun 2021 17:13:02 GMT
server: nginx
etag: "60be539e-63e2"
content-type: text/css; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Tue, 07 Jun 2022 18:30:16 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: NYoXbRRFh0zUF3WgKIhJaOwsiOOuzTAoXKpplCams3IfPECZf25VDg==
x-cache-hits: 0

GET
H2 200 common.bundle.3c0a438a5a4962a39ee30fd041fd5ca9.js Show response
c.disquscdn.com/next/recommendations/ Frame 3BC7 262 KB
87 KB 12ms
11ms Script
application/javascript 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/common.bundle.3c0a438a5a4962a39ee30fd041fd5ca9.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/recommendations.load.d21c88f023def29b898231ae9d2cafb8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

1e73bd64edcf6b9b779802e3124b7c484db59493c8252fff3c2af5f8a0375434

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:30:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2420297
x-cache: Hit from cloudfront
content-length: 88889
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 07 Jun 2021 17:13:02 GMT
server: nginx
etag: "60be539e-15b39"
content-type: application/javascript; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Tue, 07 Jun 2022 18:30:09 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: xC6jZ62s0LzIwLqxp5m7_qX5Wx4Cunk2jzDn_2BhetwITzxMBVaIdg==
x-cache-hits: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame F210 31 KB
9 KB 10ms
10ms Script
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=smartadserver&endpoint=eu
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 9ddda23179d75bf5090b03b5ca00786004a82b54dd9346599aa9eece613c9ed5

Request headers

Referer: https://eus.rubiconproject.com/usync.html?p=smartadserver&endpoint=eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:26 GMT
Content-Encoding: gzip
Last-Modified: Mon, 14 Jun 2021 16:13:39 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=73685
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9276
Expires: Tue, 06 Jul 2021 15:16:31 GMT

GET
H2 200 lounge.bundle.152a1430e3267673ea556dc28bb34a79.js Show response
c.disquscdn.com/next/embed/ Frame 2FDB 467 KB
118 KB 13ms
13ms Script
application/javascript 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.152a1430e3267673ea556dc28bb34a79.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.e51fe378e0cd63a2764bfb6c7ca542a8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

68c7b10b9e138d7566b7dca1e763b39ac59731e790101a34b74e14f556175d6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 18:34:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 432830
x-cache: Hit from cloudfront
content-length: 120424
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 30 Jun 2021 17:42:54 GMT
server: nginx
etag: "60dcad1e-1d668"
content-type: application/javascript; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Thu, 30 Jun 2022 18:34:35 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: kiUNB99YXYriUkYKD2hhfAwgoqGpj-9LtpmY50fLcjeSiT9nKu9frg==
x-cache-hits: 0

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ Frame 2FDB 12 KB
12 KB 21ms
21ms Script
application/javascript 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.e51fe378e0cd63a2764bfb6c7ca542a8.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

992caeeef5c8ce8d12cd5bfa0aef3922f4013d082f147e886d847ac071991a9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:26 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 29
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 12153
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame F210 284 B
536 B 28ms
28ms Image
image/jpg 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Content-Type: image/jpg

GET
H2 200 html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 9D65 176 KB
61 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2f126a8957c32db99e94d1bf7c9ed09fcd38ba99bd632ebd048f01f9c5f9c9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 16:18:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9000
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62241
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:47 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jul 2021 16:18:26 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/ Frame 9D65 8 KB
3 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Al5cTgM3ss1evB0KOPajRK73mEzTCNvm0SmWYWUPmzARM5sE98H-7_VTwO0KzHVAkZ5S8wLa6AqFHhYdiOctlhrxCD3vR-ymYGL_JCZkBByRqpD9x7krIgPW4Bq3N6OVDTU2SEgC1KNMxuu2a_zd_raYd_Ew&dbm_d=AKAmf-CHFQd5P58DnTFQpLuYTfDxaW4TZ-F91m6urtpmYjqYjim0zARZLvE5_AQUw0zCWrEpevOSmdXV14QcUsnwdHR4H4TK1iB9fHnfUuGKmSJiyBO_SOXzFRxuiCZI28825scVfgEP_dnYiSlhslxQt8IWDK3fsStBcLPD0Heb1tr6_AxDY5D9kkro6pQ4R2m4F39YlNGhWOL8Zf_cIOFEb2erkCZnEx8IsbE9GMIeFBsP7Fn6c7KKvMCkZv8VKfDF48saiNQAPbhp8VYP95kIb3Gwld6CElkBpIErr5ZSqH3W4vkY__xevEXxaj-B2d8M1fgvkmHK8aqjZeW9Kbb7w94SXwTJCxI3RgcoIRFMrz4BP4f2jyHt9OdsO0499bEvPk7WwBNrpRmtDPEhm3GmHvX_FxzXjz0oVaf9wM3-kSm2Bk9NHsqVuJu3VXialVQ1h2jyDvjmeg8AGraax4Og6lFYK5A5u56nG_YSmiEmJW8gSH4FaJ_Vc4aQCsvlEx5Go_0G1LxVdPMJa1zOKzxcb6Jm8SgyQfyOP0721ZfR2pM51bFA7aYr-YM1Wq317KaEjVhizOfSvVYwiyrIsTy-zcF-FIpP611NuhbFyhqz-qQ_1x1WKa5YNv0kgn9t2NO21iiYPiRyqhUcmNdRMMUsIoGoFgzA7wJHEsQExALsqc_9bPYdcYka7GnihYUo0B9Y2IZxVN437dzbY57vvYSSk4CYv5Ock7RjNM29V_lMTu0h_PTA4h708iv75GFjw5vzcEbzLy3Zft3QjiWUW1DD-8UsCoSz9asy0UbbVJ4i-2vgce_bGEKGJZlU2Jxy0khKdafeIQ5VZxTuGqjd9qEMiTH0NRDfH2qU16pVc2VqarJw0jtCjPLVMgcgNMNSjq1yva8cOhi3cMMNGP-qb5cZwJCOwU8yHU6YykyLFmntWRUT5hntV2mwSrFjwqxW8nasopCwildYcBGfAO3O0F9F0MqpvVw4mJeHBkS1n6lcz4pt2b70A9HcIDcRsIAr9CbYoUz93MWXejCoHpcbzzBWciH2FhEWToEWkh8nvQr9A8Xo_zRkoVW7Vt2ijUys7N5Xrec4WbbVo2bvaGZjQxveO_pLx2AA4hlw348bGusU3up-w_LojYjU2cYuDB-7z8E10Kw72wmNqQ0nz5fKQL2zEuV80o8uUdadbO_sfYKgNYQccgT2qShlU0AC9FLtD7Vi58Y37AR6xU3EPL8TrWUKKyepRgzIg98CcEMwUleVFRl-WfDxPxoVeX2KJcX-GqXoKkOcNXsWcm-hsCtb5TXY_DapgkCAOl0JUk2aPN3BOTHOeKCtMzRFi54Rahw_o5HNi5jpgUocGiPZ0k63EatqN1DKqyQy1gwudR02arnh9BTg7w8jcC1RGr1njn5uHcJ8gVrxZTZ_2-_PVgL5Dwv55hpNhIcIsHyi2S49UuXzJ8urr7gJ0z3HMcCt1yDvQiE4SaHz7ehqbB5H4MszsR-id70qaW7pH6P_MCyEaYVMowAxuGlmt9gUEjcrOuraTgcg_dk3y-ln6pUn5RH-pGlCy3ZZDaWzGJ9iSv7UBKHvuT2w9Jad5YlxztpXfSAFgn74JpnG_muqpdrQMLYIMKVIjogBkplJh64VpYfP_1MxSji1idz5q-ByWT0Qf7uyNqL0Q5J7k_Sy8qCiysodr7eS_dgSAC0cqEumzUQfiKndeN7BALd3rp2KmARMRLRd6j7ev2mvKYjuwu2-fPhJO4XPNSaPFh-YjWJkiXGpSsyX5taGGnwKH3EO9lfFLJwR_yMUJKYTipmRoFu920RkNPob-zD4VQ6AB9m6Y3EB5MVrH4GdoOeF9fk83BtCkG4kPF3a8dLKsrYnAapRQo1V6aevVrd1GcEu-b8upl5B88i3i7goq2dCz8Aj7dRVQkR9YaayueD3jNizu55KDZIdaxdbu0MAHL73YFcsvvrG5XHypu0zNF7Y806xuBOMk-z_oE3opGo9C5-IL0VikRMHN40ZKlCaq3bxMpjeziUffUPcJ_RtZyR2Nzv_k81SLap2RQAdps_af-KiVwEaLv4LTr1fFfXKiYdtCljvza9RE5f-Inv6M_7bWWcHW9KWdVM1L2kgi_52A3-kt-rvLUvnOhQYoyywN6sIKbUT1aUn4Pcaa4UievGN4sTAGvsRU9x4HEhesuY3nsSgdWab4keibJjGPHqRsOoTKcj26gRdsEqkCNl70SSP5Xoj1YVUeaOy4k1qZ1slRFLlhQmMptbEmMM3LpmgsHydqrTavoCkbn8Bt7letLlUwe8tFvQaBJHtJnFkZAMbyTwszDCoXRHkmqMA-NJEcb8c8Jd2frnDJ7Kpf1VnOzw79rgu2XxrexhY2jUBfOFniDGNZEtDVUUs7T8d4SYTOs4o1-yamCIbIYuZvuxQe1CtWwWhIKxU5nq1AOwG4RK2i823tPuT8bNgG0-v19K5dNBIRWV_i_aViS2JUHxmp7LEcXybeNRmVIjTu2OtjrlnOy8XE4qSZBoPbLvFf4ZrZYXKF26Ifsb4GKKmvG9mFpqi2CP5MYwv4elYMGiHELJkvXOim3_EiWcDytUWzm0w5WVnzJd23iDBp5d6q1ZK5aV4kaItX7TGqi51QXU2tT2_ZWKrIRGwnZd2W5tTJd0EmUws64dimVTZef8FvpEH9V0efe66xb38GntGjVccQ36bwZkNguAv7i8hIFvNeRe3kR23lmcKAyeQUWqYKptQPixPmCjqrIMFG9v0Km9wRhmCuFJ91vZfK7oPzdiVHVptSQnWKLt9JnzRB_eUK2dXmAAOjYF-Ms-DLX654jm_EKbdFV1RTTRhfNZB4jvc8NrzSQE9Gf4N7cmNZIyKU-SSQRVfTJW7OEe6tZIr1D2Is0hGeUlzzOIgfVqzV7WpPba8vuV8whrSl3lZUmWIjQPDzWxNM7-bsv9dUcNyWqdgyzsFrRaWRHv0or_EfAg0wGfjs3FAe4nRZbWBeqRuU1-I4zWz7jF0wtZBsnK8TZ19SE3K07HG9o5mSCP4RFLNpNoh5xMMEsvxJRB-C5IN13rfkcCwWxMo43YMCZebgBWgZnkyF6srO8QdTZUaiETnrmTqBrMbPw&cid=CAASEuRopq5yF5G0L09V3gAxAPg7cw&rfl=1%2Chttps%253A%252F%252Fmobilesyrup.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:46:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:46:55 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 9D65 22 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

598a6c545ec2b27cf7388041cb424a0f4ecc1884dc06e37781b927fbd3cd58fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 310
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8676
x-xss-protection: 0
server: cafe
etag: 11618055936852703379
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:43:16 GMT

GET
H/1.1 200
OK details Show response
disqus.com/api/3.0/forums/ Frame 2FDB 3 KB
3 KB 119ms
118ms XHR
application/json 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/forums/details?forum=mobilesyrup&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.e51fe378e0cd63a2764bfb6c7ca542a8.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

7d94c10a41311249fc3a8add709362ea480d79954c767793ccc8c80bc07174a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:26 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Content-Type: application/json
Vary: Origin, Cookie
Content-Length: 3131
X-XSS-Protection: 1; mode=block

GET
H2 200 recommendations.eff219b98b7c4167b4b289065f36f391.css
c.disquscdn.com/next/recommendations/styles/ Frame 3BC7 17 KB
4 KB 9ms
9ms Stylesheet
text/css 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/styles/recommendations.eff219b98b7c4167b4b289065f36f391.css

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.3c0a438a5a4962a39ee30fd041fd5ca9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

7964d033f829ae2809f61810c4efa9adf6aff915ded111a9c346bca2b1302b62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 10:11:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5215031
x-cache: Hit from cloudfront
content-length: 3748
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 28 Apr 2021 21:48:08 GMT
server: nginx
etag: "6089d818-ea4"
content-type: text/css; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Fri, 06 May 2022 10:11:15 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: m-3ZZgSwwKeljqbh5nna0A1XlyEc0gp_QDl5GDYyWqR-FCoxz5Xwhg==
x-cache-hits: 0

GET
H2 200 recommendations.bundle.37a289e2ed6acdf6cbf01e83d4fb3ce6.js Show response
c.disquscdn.com/next/recommendations/ Frame 3BC7 65 KB
20 KB 9ms
8ms Script
application/javascript 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/recommendations.bundle.37a289e2ed6acdf6cbf01e83d4fb3ce6.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.3c0a438a5a4962a39ee30fd041fd5ca9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

922f390e4a57640ef5eef814166ea4b04eef303a2d2cf71f8c98d5f5be494e76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 18:34:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 432835
x-cache: Hit from cloudfront
content-length: 20103
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 30 Jun 2021 17:42:54 GMT
server: nginx
etag: "60dcad1e-4e87"
content-type: application/javascript; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Thu, 30 Jun 2022 18:34:31 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: bsqWLjG2XrtW3uMWRvmqU6qZOG9fuFck-UJSHdeGtdZlMGdZMDcp9w==
x-cache-hits: 0

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ Frame 3BC7 12 KB
12 KB 25ms
7ms Script
application/javascript 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.3c0a438a5a4962a39ee30fd041fd5ca9.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

992caeeef5c8ce8d12cd5bfa0aef3922f4013d082f147e886d847ac071991a9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/recommendations/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:26 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 30
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 12153
X-XSS-Protection: 1; mode=block

GET
H2 200 noavatar92.png
a.disquscdn.com/1624570071/images/ Frame 2FDB 2 KB
2 KB 277ms
8ms Image
image/png 151.101.114.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.disquscdn.com/1624570071/images/noavatar92.png

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
x-content-type-options: nosniff
last-modified: Thu, 24 Jun 2021 18:53:57 GMT
server: nginx
age: 601437
etag: "60d4d4c5-66c"
strict-transport-security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-xss-protection: 1; mode=block
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
content-type: image/png
content-length: 1644
x-amz-cf-id: 6tstZudMz1Mgb5HvxZYYB9aU1vfHMCB1lcqMcUSEuSzn3tDKQQxhdA==
expires: Wed, 28 Jul 2021 19:44:30 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9D65 41 KB
15 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 09:09:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34709
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Jul 2022 09:09:57 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame AA24 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 05 Jul 2021 08:59:18 GMT
expires: Tue, 06 Jul 2021 08:59:18 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 35348
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 9D65 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9a0bd5549c9d2fceac2703004deb449b2a661b2652204d5ed318be09b690f818

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame 2FDB 13 KB
13 KB 7ms
7ms Image
image/svg+xml 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.567531e1abfac5c88f2ef94b952d12ba.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.567531e1abfac5c88f2ef94b952d12ba.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 28 Apr 2021 14:37:41 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 5890245
x-cache: Hit from cloudfront
content-length: 13079
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 27 Apr 2021 21:01:56 GMT
server: nginx
etag: "60887bc4-3317"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
expires: Thu, 28 Apr 2022 14:37:41 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: l7XCg0pdO1Qo3B8w08qOpULIawPINH-YGezxJcnDMbKQKA9znHibQw==
x-cache-hits: 0

GET
H2 200 loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame 2FDB 3 KB
3 KB 8ms
7ms Image
image/gif 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.567531e1abfac5c88f2ef94b952d12ba.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.567531e1abfac5c88f2ef94b952d12ba.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 04:58:07 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 13182619
x-cache: Hit from cloudfront
content-length: 2971
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 27 Jan 2021 17:23:07 GMT
server: nginx
etag: "6011a17b-b9b"
content-type: image/gif
access-control-allow-origin: *
expires: Thu, 03 Feb 2022 04:58:07 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: wiWkSTk-KFgXB2e22uVDWgLWzDu4gWyBvWl_RL-3xhQ6uBdLYvFaqA==
x-cache-hits: 0

GET
H2 200 sprite.654110a9206fd22f08cca0798e34a65e.png
c.disquscdn.com/next/embed/assets/img/ Frame 2FDB 2 KB
2 KB 7ms
7ms Image
image/png 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/sprite.654110a9206fd22f08cca0798e34a65e.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.567531e1abfac5c88f2ef94b952d12ba.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.567531e1abfac5c88f2ef94b952d12ba.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 10:47:19 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 2102467
x-cache: Hit from cloudfront
content-length: 1862
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Thu, 10 Jun 2021 21:33:44 GMT
server: nginx
etag: "60c28538-746"
content-type: image/png
access-control-allow-origin: *
expires: Sat, 11 Jun 2022 10:47:19 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: oUzXljs5XQr3KfA8glA6WEW6vMCeMqe7xk6UptCUZTnrzCUGUQijDg==
x-cache-hits: 0

GET
H2 200 icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
c.disquscdn.com/next/embed/assets/font/ Frame 2FDB 8 KB
8 KB 20ms
19ms Font
application/octet-stream 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/assets/font/icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.567531e1abfac5c88f2ef94b952d12ba.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://disqus.com
Referer: https://c.disquscdn.com/next/embed/styles/lounge.567531e1abfac5c88f2ef94b952d12ba.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 04 May 2021 09:01:33 GMT
via: 1.1 7158aa4ac648947d564b98d9769b5b2b.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 5392012
x-cache: Hit from cloudfront
content-length: 7900
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 28 Apr 2021 21:48:08 GMT
server: nginx
etag: "6089d818-1edc"
content-type: application/octet-stream
access-control-allow-origin: *
expires: Wed, 04 May 2022 09:01:33 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: v9nOy2daW2cIihjq6T7jfZjRNZyXPV5plr01cteAt60OZMSrIhmWQw==
x-cache-hits: 0

GET
H3-29 200 container.html Show response
8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4ECD 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mobilesyrup.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 05 Jul 2021 18:48:25 GMT
expires: Tue, 05 Jul 2022 18:48:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/ Frame 012B 36 KB
6 KB 28ms
14ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=CVdNyZTxRE&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e2718b4b437edd86140d80891cf912e88267f780c14656e84f27a38b10f48b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=CVdNyZTxRE&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 5641
date: Mon, 05 Jul 2021 18:48:26 GMT
expires: Tue, 06 Jul 2021 18:48:26 GMT
cache-control: public, max-age=86400
last-modified: Fri, 11 Sep 2020 17:03:37 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9D65 0
107 B 272ms
49ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvj-d-TvgsSgg-2T2wpvClXad9qDnIIxaeF8VPUuvAnuorONBPTjYS6NiYBAfodJpCdE3rSZ1FAKzzva6ytOdD48F3vqgz8K3Wgr9p-rBYxHkaIO6Yb3HQ88UbaJrLHIYuZ5ocOJTxlz87w5Mqpt-0yvgWoiEcp5FQg07oNzN_xbK4GLJYwe3ixRgBj9Ql6ozU-EbxXJkQLEYHyfLNs8KtcvoTdWQlaPhC_EeLFpWvEIjmvTcG7cM_AmmcZW09BtOWe23g5O6-8Jy5676w-FU7l78HgMNU8SlS4DvnB-rGOocR36P-rbQmGO9r3bIKfMaknlKYSKjDv_NZQ8z5-0nLlkPL08UqFyRExwXnX0Lo_FG39ikN4Xi-Ptev_b4GzJAOYzfGQ7XfGLvWcqysgykrsh2Q8O1LzPPf_64JHsRabQOuqcm8lzjHhnPgY38aG50qK_tlL7CYRA6HGoEfFahadyQiMqa0LgyGim_PnysDitXC3lcXJkgz_PYyaVp36eN3JO3NKWpws4eWOgndJLO8uMsHa4lMETkykGh9rL5Z8FxF9VPXGRE8C2uOCkvM8qs4EfWBkRdzoxr7VJuU86UyTMEDwIyUPl3_tZvsql1LzgSueX49_MABFVsmFLT4CQi5-ZXL1mrFW__wTTB_510Nohh-SZfv1m_CsOeDowHOEZavq5Bqp7GAB8yWYelAptytRKgaV_ZcuzHQWHE8bTlvoSyw5FaV7ld0eT0L66ItDwR1MZlDH6bgTMwUTyOwm8g52LLidzxVkdnSKIvvad3292umTwANcNd0YHiu2aQ7H34jZ7VWiTG2CHv55qYDRXKXqSaDY6OinIYDZ8tdlFi4sOjkgK6iadcA7cAZbLm_AX79NtOJsl3xfW8hiAWHdnOnf0nG35-BdgXuNJiPhWeylv9mSwCmkJXTiNgjQQuSxLeNajsY6Z17bsOFvqV0Va0AAy1Sa493-mVanyDjUMM4z3qac0AYsZ6VwUcn_kiLCsodKGUEW5wVMB-Aj3Hffbl9lSXNbdGcn3ozPCLPZdOr2GLy-XgG8XIJOxDRT7_zmfsz-Q5L0SSlbdXRhKdnWt6Mh0O_83taxk4EukLhiLTAHgz_dwY00_eMhMQD2Ov52W9PXBs5ct6X6sCNlGh_KLniz08Lq04iHWFLycYFUEcore3AUWrR4HMeyXK1fkzXDbP44kWTmKA&sai=AMfl-YSbEAs3HGBmvsTXU2NH6HRlSv_CGnz_RGtjAHo1ALvYI1mXDBfb4zMyoIJMmZcwhgNoru7ItrsogiNqunrMBd_fEmTyPikaF_opqMd_U8JJzuzWD5JKHoWFcu7Gjbokfc_s45lYLZCiG0WKYUBeuB6pULZkkw&sig=Cg0ArKJSzH23hxYjb9XqEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=280&cbvp=1&cstd=275&cisv=r20210624.94122&adurl=

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 05 Jul 2021 18:48:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

firstevent
skydeutschland.demdex.net/ Frame 9D65
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=131961474&d_placement=306717470&d_campaign=26006000&d_bust=193138355&gdpr=&gdpr_cons...
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=131961474&d_placement=306717470&d_campaign=26006000&d_bust=193138355&gdpr=&gdpr...

42 B
978 B

37ms
37ms

Image
image/gif

52.17.73.77
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=131961474&d_placement=306717470&d_campaign=26006000&d_bust=193138355&gdpr=&gdpr_consent=

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.17.73.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v012-0ad2b0665.edge-irl1.demdex.com 6.3.1.20210623115127
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: Xy74VYuLT6s=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v012-0ade9229d.edge-irl1.demdex.com 6.3.1.20210623115127
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: LeLW38sHQOc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=131961474&d_placement=306717470&d_campaign=26006000&d_bust=193138355&gdpr=&gdpr_consent=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 9D65 43 B
1 KB 1063ms
17ms Image
image/gif 85.14.248.72
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvApi=sky-dv360&extProvId=300&extPu=sky-dv360&extLi=21213705&extPm=364525329&extCr=53131067&gdpr=&gdpr_consent=&rnd=193138355

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

85.14.248.72 Bruggen, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: Mo, 05 Jul 2021 06:48:27 GMT
Server: Microsoft-IIS/8.5
Date: Mon, 05 Jul 2021 18:48:26 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 923
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK ratingsSummary.json Show response
disqus.com/api/3.0/threads/ Frame 2FDB 89 B
480 B 139ms
138ms XHR
application/json 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/threads/ratingsSummary.json?thread=8631453439&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.e51fe378e0cd63a2764bfb6c7ca542a8.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

36fbd3487203ec6ee01e6b5e653cd171ae8d01f5bfd8e6d68c6e9f342eaf031c

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:27 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Content-Type: application/json
Vary: Origin, Cookie
Content-Length: 89
X-XSS-Protection: 1; mode=block

GET
H2 200 realtime.af77184dec69e96e69aff958ae2bb738.css
c.disquscdn.com/next/embed/styles/ Frame 4EC7 337 B
805 B 6ms
6ms Stylesheet
text/css 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css

Requested by

Host: mobilesyrup.disqus.com
URL: https://mobilesyrup.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 05 May 2021 03:13:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5326492
x-cache: Hit from cloudfront
content-length: 244
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 28 Apr 2021 21:48:08 GMT
server: nginx
etag: "6089d818-f4"
content-type: text/css; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Thu, 05 May 2022 03:13:34 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: A2gQhYhTSPd0yvFBdUh4ho0gLrX956-j3YM1mlPFoUDpPmOHp3vPhg==
x-cache-hits: 0

GET
H2 200 realtime.af77184dec69e96e69aff958ae2bb738.css
c.disquscdn.com/next/embed/styles/ Frame 6FFD 337 B
804 B 10ms
10ms Stylesheet
text/css 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css

Requested by

Host: mobilesyrup.disqus.com
URL: https://mobilesyrup.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 05 May 2021 03:13:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5326492
x-cache: Hit from cloudfront
content-length: 244
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 28 Apr 2021 21:48:08 GMT
server: nginx
etag: "6089d818-f4"
content-type: text/css; charset=utf-8
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
expires: Thu, 05 May 2022 03:13:34 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
timing-allow-origin: *
x-amz-cf-id: pzBdgqNi_0ohni4eOoGfUzp28hE3docLTjnACgDDFvRpLjeBVRUW5Q==
x-cache-hits: 0

GET
H3-29 200 sdk.js Show response
connect.facebook.net/en_US/ Frame 2FDB 3 KB
2 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.e51fe378e0cd63a2764bfb6c7ca542a8.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

37a02e1693900f3af4ea8a3f9f6101965a49d5f7a8b10d8e376e609a2f9d4ed2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: kN9E/+ayxx+W3gYZTLWCjA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1685
x-fb-rlafr: 0
x-fb-debug: eCQRCSUqSisr3HCBP08bOTyZej3Q40T8L2tFz/MN/naBnnUFXA5yvrt9LAkb0El/iD+FWvm6AvP+b+6olRf+5w==
x-fb-content-md5: 3529796dd0e4260c24f2a562917845b3
x-frame-options: DENY
date: Mon, 05 Jul 2021 18:48:26 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "f260ff5b38ae35e7434155b265216b17"
timing-allow-origin: *
priority: u=3,i
expires: Mon, 05 Jul 2021 18:50:10 GMT

GET
H2 403 api.js
apis.google.com/js/ Frame 2FDB 0
0 470ms
451ms Script
text/html 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://apis.google.com/js/api.js
Requested by: Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.e51fe378e0cd63a2764bfb6c7ca542a8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame 2FDB 13 KB
13 KB 16ms
16ms Image
image/svg+xml 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.567531e1abfac5c88f2ef94b952d12ba.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.567531e1abfac5c88f2ef94b952d12ba.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 28 Apr 2021 14:37:41 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 5890245
x-cache: Hit from cloudfront
content-length: 13079
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 27 Apr 2021 21:01:56 GMT
server: nginx
etag: "60887bc4-3317"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
expires: Thu, 28 Apr 2022 14:37:41 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: RPnFU2a26G5ge2n83AhBHdYvdEiBQEzBmTFqbBpa-CVInR-XOcdLUA==
x-cache-hits: 0

GET
H2 200 t.gif
sb.freeskreen.com/ Frame EF8E 43 B
414 B 72ms
71ms Image
image/gif 13.225.87.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1625510906&p=4444&c=5824&s=undefined&d=1430806&v=26116&t=6d275153-e725-4d26-87db-c22ec2ec5713&co=DE&pr=BE&ci=Berlin&dm=null&flc=&slc=&ttm=1625510905996&gdpr=1&gdpr_consent=-1&e=VastRequest&m=1&x=https%3A%2F%2Foptimized-by.rubiconproject.com%2Fa%2Fapi%2Fvast.xmlaccount_id%3D23502%26site_id%3D374154%26zone_id%3D%202049512%26size_id%3D203%26p_aso.video.minduration%3D5%26p_aso.video.maxduration%3D300%26p_aso.video.api%3D2%26p_aso.video.mimes%3Dapplication%2Fjavascript%2Cvideo%2Fmp4%2Cvideo%2Fwebm%26rp_secure%3D1%26tg_c.language%3Den%26width%3D603%26height%3D338%26rf%3Dhttps%253A%252F%252Fmobilesyrup.com%252F2021%252F07%252F05%252Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%252F%26p_aso.video.protocols%3D2%2C3%2C5%2C6%26rp_floor%3D5.0%26p_aso.video.playbackmethod%3D2%26p_pos%3D0%26tg_i.%3D
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-95.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
via: 1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: 46xodPUJckZATOGZDeU2ww7lVw7QUKZeIDkWvweLJXmmWRBhUITBMA==
expires: -1

GET
H2 200 t.gif
sb.freeskreen.com/ Frame EF8E 43 B
413 B 46ms
46ms Image
image/gif 13.225.87.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1625510906&p=4444&c=5824&s=undefined&d=1430806&v=26116&t=6d275153-e725-4d26-87db-c22ec2ec5713&co=DE&pr=BE&ci=Berlin&dm=null&flc=&slc=&ttm=1625510905996&gdpr=1&gdpr_consent=-1&e=VastEmpty&m=1&x=
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-95.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
via: 1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: BdLkMHqDJ5E-idkboLUrH5OrBLaVdnQpdp6zJY5MqIGh-aJzvLwjkg==
expires: -1

GET
H/1.1 200
OK details Show response
disqus.com/api/3.0/forums/ Frame 3BC7 3 KB
3 KB 124ms
123ms XHR
application/json 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/forums/details?forum=mobilesyrup&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.3c0a438a5a4962a39ee30fd041fd5ca9.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

7d94c10a41311249fc3a8add709362ea480d79954c767793ccc8c80bc07174a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/recommendations/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:27 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Content-Type: application/json
Vary: Origin, Cookie
Content-Length: 3131
X-XSS-Protection: 1; mode=block

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F79E 22 KB
8 KB 8ms
7ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 05 Jul 2021 11:22:34 GMT
expires: Tue, 05 Jul 2022 11:22:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 26752
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 t.gif
sb.freeskreen.com/ Frame EF8E 43 B
411 B 72ms
71ms Image
image/gif 13.225.87.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1625510906&p=4444&c=5824&s=undefined&d=1240018&v=9316&t=6d275153-e725-4d26-87db-c22ec2ec5713&co=DE&pr=BE&ci=Berlin&dm=null&flc=&slc=&ttm=1625510905996&gdpr=1&gdpr_consent=-1&e=VastRequest&m=1&x=https%3A%2F%2Fpc027-5uv1f.ads.tremorhub.com%2Fad%2Ftag%3FadCode%3Dpc027-afz2p%26playerWidth%3D603%26playerHeight%3D338%26playerPosition%3D3%26srcPageUrl%3Dhttps%253A%252F%252Fmobilesyrup.com%252F2021%252F07%252F05%252Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%252F%26gdpr%3D1%26gdpr_consent%3D%26custom%3D5824%26c2%3Den-ca%26floor%3DUSD%3A5%26us_privacy%3D%26fmt%3Djson
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-95.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
via: 1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: 2cZNpx58aJ2RoKa36GXnj2vaj1Hn5yOYa6eGG3RdTfZ7uisicb7AYw==
expires: -1

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 01FD 624 B
297 B 16ms
15ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNupDBD70OkBGPbQ76MBMAE&v=APEucNVCzYC6Nc2IZnvr3807H8CKSOcI7CDP8oEaWbOgQcpJLfDfMftcj2R81TOfMZMG_thE79XQFHx2kqi2WMOZsQmfGvaAB6X9DLjeL4MieA1AyJ6hvwebu6V_iGDnbal5M1WJDIQkn1NE4v6bPeV5DBeAhkYk_bpP9a50U0O3tyiyC8-BoSw

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CNupDBD70OkBGPbQ76MBMAE&v=APEucNVCzYC6Nc2IZnvr3807H8CKSOcI7CDP8oEaWbOgQcpJLfDfMftcj2R81TOfMZMG_thE79XQFHx2kqi2WMOZsQmfGvaAB6X9DLjeL4MieA1AyJ6hvwebu6V_iGDnbal5M1WJDIQkn1NE4v6bPeV5DBeAhkYk_bpP9a50U0O3tyiyC8-BoSw
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnb4MS9_XJNrJ1G4aqvqetseAf6mceIU9dv4iWn18wsY1jlQTwmKDjlUKlpQSI
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 05 Jul 2021 18:48:26 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4ECD 43 KB
21 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BVApMZZOauKoCXua4fQpPRywxqT37WTKMnFuS0diSjXfhyOTDr1nRSYx44YhNgYhagMYyly0vys64eqv_69IAtKUtJwZ6q-gk-Nvop8DxAYPJu19HBDVajfSWXOVtyNEgjsQiJl6mDDlHJ6LE9fTr47AVb6w&dbm_d=AKAmf-DoaTXLvBae_ZEKBACsmCRPyVl6aOxoLyDRPgvsgbdBTshuqxajFwnexe2KIMjxJlHD7DJtAn3wahaeCtER1f-BScf2xVZogO4XTu-OI96Pas6OZt9i3TaaQzkuDDP3gfhkpwZaAIHMexgvgjdrVIERIoyUFoLG95hn0HlN2pWuhVZST3SsD-caODvlBPWiq8L4ga9MhyvG2vuayxuUu1wBvdfjQQp3kuQGktfI-wCx5NK6FvK4sm3hhq1mbkxQfY7ay7Rqx7C1G25Z_Zr0yBmntvv8eg4Fq_qcGBUNdpH4c4g9T2jZ3bFcuMJbXqeM0KQG4oRFqgiMB62d5D-hXv4-y8cfw31OXL26ov929QY9l2mce-hK9HtASy-VI0fFgNg8-JOEHgE8VuSXtAiA9PVCLyyduu8my2A7wegbhWDpjUpQ8V0fJLYFlW3xEzhtqs3p9SKW9L2d5QSckZh6WgF8QddL0elq1wzL97JlyqL6VPk4HKnxae4h5mNpUaw5sAUjtmpY9CjvzIapsyUwfDrQU72jYrHFSiPCVl0qGAX1gDNk8-d5NKQls_trDslibexPS3ARIZnovffDl2jOECpS_-D_8bT1hk9Do7N38GVOHJ9LcpizXKUVrlucIu0ZJ8guZxlVxMDUYRZ1XU6brTfVvgisKKDhGEC1LjsF5RLv7QqdGqQmPhsX1W1T-B5aXRL1TPTyzD-3UjtaExJqiUArBLCmRvayX4L7UlhKML4JMOTivXC2O52nt38aJeNfv3sjUJBUSKQZ3fuvSatrUPKKHwqHe93QAb4f_mXn6U-ww9gO32Ajrgf8Csnyi85scS_SN56qvYEbcYsDcWjS76YzCiz2ocezXfOfzzp_jAQnAoxpficSwVmAdEsGOI-XkZlV_GjfMaoPwdJRy4DqKE_XK4sNXFZAsAtYXvAlI-7rlW83DPFBY-YUb5S-UJkK5A4_I2E_zbCnND8WXL3mzKFfwvXgCusZMaEuBYkiXyX6okFS0WYjw9XPOZLrUC3Dqvo1-Yq0XeSRcM248D40_SRWZ9loPoyz71by3xmyD1bZvMTnv4KxsKfSlpcQTEiwHcKqxDAkt_9CaW3IBq1KaHlWHLpDlXfF60BTFjnPvHu4Ls7qAI1yJGcNXBjsBDdfI6L9XzOwSJiJwN365M_4ObBxze3WZdocPnRZTvyBzA4PBPE5nG5AgSLoGJnZvWeWjkpEhxx2M64dqoZM1kzEFo7gGbB3OqN9yYb1Zzd47cW_vYcUBcsC1ym_nD52R3e7z1l2v7fX-FS18VEJaChjd9DMIel8QMa1ZR0tu_PY1KdLeDI_m3BfmM4kbJbdXbUk41QHSBKU9NASQv7ZLVuFpWhZirdO-0kQr2AVcJsaRRNn18AkGKO9KNWt-kORAi8SdTUaY8p0qnI4HdXq1hU-O66wV3bvJV2UQEmzOtTii1rtT0GpYXrj4nOP3rLNjBfQWiVjhUh6SDqNmOLVK3H8qyeXw_vrDy3GXYnWg3b6d2MJZ18nCNB0nS_ifoeVHWDTGcf16uyKRVDTKL8-U3kHXHTeH-x_uLFxf-Fpk4t6eHJiXmRKOEfLmbuF4M-5Jau13ii8UPqELpg-COu8D8ORZhPGpRaSWvg_naKejNswIYGWlIUD6Th6mvWLsOR726E8N0SF41_fca_-vg2aPivzv758XoQGgVnm4gd-3Bd2JYdFDVz7Cgq0pyN8kEJJe2BkiyGrr8d0Kydpng5IJqln5NvB5namuhX6hDMv3Jg5R9jLonsrNKjsrQUWdFvp5-NJjjNEdlGuDjMHw8w8xQN5sBEgN5-e-45J0Fnq-5CIvUlWw05XU3wi4FRHkSJ9xJjj7yDvCpSCFj_3wRmwAEK3ZJ_4gyGeuHUdol1sc2uB9sSqKhs87ePS2rrQ0I_9Ail1V1Lq05ty9osCeYG4DIjJcO_KKe0kw0qzPNwmvm0VzWmePAgoXHVkGriwQI3JY_GN6AujmBlgBDUIPmJ6dUD92zJwsoSOAm11wlo4QvTApebltV-WIAyeVcjSRwX0FEtRwrqfGy919kLMEj8LmTheChl8dofEzqV5XbPslwgcMTRuyJj3KaWFfqD5RpPHhfp47BduMHS_0VJ0YhgpywXiw2YxE6lTEK2Wl_CW0_5E2KwQDeMLsjJzKJwj3v4W8Ylopgl43kliVQxqFtnrExe-S4S_28t-6hUhX1tVY-4EMQDgVjo1EE2srMWDCCIc08Z3cUgFuRA3PVWSbN16-OOundLqu-7MKEbkslAqHSv-j83B8RS_ts-ccUOjarpjJqk_hv6NEwGddtQHFFQt-YXcWx-3cLRaFC2YxG3DKdAuPgj_XAr0zL8pCR4h0AC4oZW5TFk7xCipX7d55pXt7fuEBHCaZqdCfSG2Wy1qu6RYzLreyndeURt7fcRSEX11v258sNDs5ZhMrb9Hld-7f6UCNWKxzXW_u9UpoOpJ0xxgfZtyn6mK66x7-tOUpSJZTaXpaKO5X5G5ArOqd2_bUBDbzBoH3O9hX4HL1UPkTNMJbJEwwuERNch_vfDUUKkWA37wWZJdmUnExFRbCyAxsdYaRWmn9B77byv6CiD9HlTlQTpFrz4oxGqAni-524CXh9UTo8LauBe_QUjhDQajyrHb5ElCGDU_ewGd5OtZY9S5LfkTW8kPIDQHW4K_qk-AhEOqXffSQA4xgWLiM25MQdpExAO3AV0OMmnmKXpZXQk519RSyMlWyXdMFJ74r_dRWVcuSBtPzWK2Y9vIRLUAdc4yiSVosnKDhqyo02Ccyq8RBvVOuBnYpy4RFnmNQP_3mSgvLKjgz6bC1JsD_iPz8_Ps19J97u-S9Pcdl5t663igRcukBpPs0Tqq4iXQrXVWQxRzkSNj2CVsAwbhIwEX5p2EApDhbIP8QNpcMNGZbJcQrhqHAU3AFuBHIFo5U1TfvdXwbYGvQHI4BaXxXJvV0RBN8gW4MWEvynkWoPBAVYRVykmDPbmxVcBEXz2g3_bbar0mlMydAGRtjaxHH2H7Q2mCHI9Tv5LnkcxgwlY4S453nD2oAY9EnpS5aagGLxmghLCxzkdDpjqJRyTJVwTc6SyBHVvAylSIKkULonVVDByT0lsaceFQa3diVextPZ0Lz1HLDT7WKjBezbxGA6EFJzEYLhtgv5tJKhCK0S_eiGlwiPhdLjms2P1eH9P8zbJjkbjM3cKomiYgJYYHy5SavypW7atjNjU1Og&cid=CAASEuRo_hc77vuBbQDzoDHVYLarIQ&rfl=1%2Chttps%253A%252F%252Fmobilesyrup.com%252F%240

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ff4ce3c14ebd3ebc3e6f4313fbf359c43d3fa657d116ad5204bbc6063fefb449

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21239
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4ECD 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DY-hQi-4TGopBj6GOWROjWpCAwhyHwyV3o3x8Ubk17oTyUOOt2n4G1stA01LoaQ01SqKlggokp3eV_0CGmyEgALkBvIQZ5z6R_H-F2BKmiB8qdy1M

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 4ECD 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:46:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 102
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:46:44 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4ECD 123 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225346277716"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:26 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 4ECD 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:48:16 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 4ECD 0
0 15ms
14ms Image
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRbQalfUHpqUI629x26j8b31NGEiPnqjuTRYPD8Dmrm91286y-uQq4pWF5nCQcqH-FKJ_JKJ-GiZZgK6oJkPAsPkUpT0w
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/ Frame 012B 6 KB
2 KB 8ms
7ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=CVdNyZTxRE&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97f6f81b224c70cf2431f07287d287446129697370b4419a9b82838be0ea0174

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=CVdNyZTxRE&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 12:25:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22988
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1656
x-xss-protection: 0
last-modified: Fri, 11 Sep 2020 17:03:37 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jul 2021 12:25:18 GMT

GET
H3-29 200 Enabler_01_244.js Show response
s0.2mdn.net/879366/ Frame 012B 109 KB
37 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_244.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=CVdNyZTxRE&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7052ee7e4fa3d19fa953957b23d6cd29b2311739ec0932d6e570577d19f2503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=CVdNyZTxRE&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 10:51:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28589
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38072
x-xss-protection: 0
last-modified: Tue, 07 Jul 2020 18:35:15 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jul 2021 10:51:57 GMT

GET
H3-29 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/ Frame 012B 59 KB
22 KB 34ms
24ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=CVdNyZTxRE&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3c5ff7e114ffe32212ee07123f9dc6aa19c09072e44fe64649c9cc747040cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1255890
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 21678
cf-request-id: 0acebdc73500004ee66e004000000001
timing-allow-origin: *
last-modified: Tue, 21 Jul 2020 23:12:03 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f177643-eca3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Y76fF2Ja68W3gASP%2Fk%2FZeG5gSgwo1SsnCX9eW6Hmj1Fvzl%2FgkiI6C4a95yxXOKuFijCAWFjiqJrsIYUwdSkjIO0MiQ4B%2BpmPP6Gw%2BJiKzN%2BI3NwNl2JMhRtrojgHp5DR9Ubi1ofoWv4fDxYYAA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 66a2c480bdde4ddc-FRA
expires: Sat, 25 Jun 2022 18:48:27 GMT

GET
H3-29 200 sdk.js Show response
connect.facebook.net/en_US/ Frame 2FDB 234 KB
68 KB 17ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=7fe4e1991b0bc0a86a0d9430d2003193

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e6281dc7a88aea40ee7c7aefc9e972d484daf0061165fd43b025c6fa7508c5e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://disqus.com
Referer: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: pHEGc2YlEwHVkbhLPl31gQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 69354
x-fb-rlafr: 0
x-fb-debug: Cy/tN1ibqN0AGANoVOj1q92rlDgBWGxdSWuPnp08OOrISZTxKh0/hH3uZeXqJpFroWoceAjI5nWZemgEYQMNDw==
x-fb-content-md5: 213f4fb4704c091bac23795c4697ade2
x-frame-options: DENY
date: Mon, 05 Jul 2021 18:48:27 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "8d6c75ae0f3460f4111b684307732b3c"
timing-allow-origin: *
priority: u=3,i
expires: Tue, 05 Jul 2022 17:26:34 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame AA24 35 B
464 B 29ms
10ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENRTVvUWBogvmE9bs0I6qVQ&google_cver=1&google_push=AYg5qPLJIAAhUXEEUF4jcnyOZhXK4T9GwbyDqRV-qyUSmIBa7pWX8jU56JQAWlouAYh5UMHSVP_D55q0dAzTuu73rpMWFLH93Ozc

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame AA24 0
104 B 99ms
69ms Image
text/plain 2a02:fa8:8806:13::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEMuOyfJvg0lrOH5oUtA7eOQ&google_cver=1&google_push=AYg5qPLjsmW42ZAwIXLvqqmRobV16Pt6y0PaGj4B4LbvyK3QMb2nxOJPdUl26n_81oepJciArT0b7xekofg3IsQeaNp5-8EijJ4k
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1370 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame AA24
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEIB57-BL9wrDfhEDfT5qsjQ&google_push=AYg5qPJYZnSv5pmsbjQWIjmUzrEdgGuR7pYlLzws6yUagtBkZBWpgyhgss...

170 B
188 B

17ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEIB57-BL9wrDfhEDfT5qsjQ&google_push=AYg5qPJYZnSv5pmsbjQWIjmUzrEdgGuR7pYlLzws6yUagtBkZBWpgyhgss6qSfExFljp_shT7RpdMoVxr4zO1I6WG1igJy26Hrnj

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1625510907.016550,VS0,VE89
x-served-by: cache-hhn4076-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEIB57-BL9wrDfhEDfT5qsjQ&google_push=AYg5qPJYZnSv5pmsbjQWIjmUzrEdgGuR7pYlLzws6yUagtBkZBWpgyhgss6qSfExFljp_shT7RpdMoVxr4zO1I6WG1igJy26Hrnj
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame AA24
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEDhqUs_mYPiDwJ-gD8oocrA&google_cver=1&google_push=AYg5qPJbFjISixLotht-lD7B5oGZA5f6Kxxa_9SK4F0lzF7gTu0vao5BAOEO5xXuSQBIi-zU0kk_TZPQ0Q2iltA1H0xf...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEDhqUs_mYPiDwJ-gD8oocrA&google_cver=1&google_push=AYg5qPJbFjISixLotht-lD7B5oGZA5f6Kxxa_9SK4F0lzF7gTu0vao5BAOEO5xXuSQBIi-zU0kk_TZPQ0Q2ilt...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJbFjISixLotht-lD7B5oGZA5f6Kxxa_9SK4F0lzF7gTu0vao5BAOEO5xXuSQBIi-zU0kk_TZPQ0Q2iltA1H0xf_kPPLdMT&google_hm=N1lKI7BXQ0mWdDegNnVyBA==

170 B
188 B

19ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJbFjISixLotht-lD7B5oGZA5f6Kxxa_9SK4F0lzF7gTu0vao5BAOEO5xXuSQBIi-zU0kk_TZPQ0Q2iltA1H0xf_kPPLdMT&google_hm=N1lKI7BXQ0mWdDegNnVyBA==

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJbFjISixLotht-lD7B5oGZA5f6Kxxa_9SK4F0lzF7gTu0vao5BAOEO5xXuSQBIi-zU0kk_TZPQ0Q2iltA1H0xf_kPPLdMT&google_hm=N1lKI7BXQ0mWdDegNnVyBA==
date: Mon, 05 Jul 2021 18:48:27 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame AA24
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEG0I7kMBqHrJMnqtklmrZRs&google_cver=1&google_push=AYg5qPJ76e6znd9DYhRbbrz9eFNnSpUZBFtswNCwH-S_YK4AUYD5amLc_LzsFo08BJ-eeXyyBSHEqzYTqodIg49OX7idcsV...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJ76e6znd9DYhRbbrz9eFNnSpUZBFtswNCwH-S_YK4AUYD5amLc_LzsFo08BJ-eeXyyBSHEqzYTqodIg49OX7idcsVl9Xrk&google_hm=MTk1OTMwMTg3MTYwMjI3ND...

170 B
188 B

17ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJ76e6znd9DYhRbbrz9eFNnSpUZBFtswNCwH-S_YK4AUYD5amLc_LzsFo08BJ-eeXyyBSHEqzYTqodIg49OX7idcsVl9Xrk&google_hm=MTk1OTMwMTg3MTYwMjI3NDI0NQ%3D%3D

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 05 Jul 2021 18:48:27 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJ76e6znd9DYhRbbrz9eFNnSpUZBFtswNCwH-S_YK4AUYD5amLc_LzsFo08BJ-eeXyyBSHEqzYTqodIg49OX7idcsVl9Xrk&google_hm=MTk1OTMwMTg3MTYwMjI3NDI0NQ%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame AA24
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEDYjlHGvaZT-EzoL0xhB-2A&google_cver=1&google_push=AYg5qPJ7kBGMSLDYb6Ldu7amTkYZvS4bQKSSlwnSufWInT4kIu2XYIgyZd3PCzvVZvbdRJNSP-IfBsum...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEDYjlHGvaZT-EzoL0xhB-2A&google_cver=1&google_push=AYg5qPJ7kBGMSLDYb6Ldu7amTkYZvS4bQKSSlwnSufWInT4kIu2XYIgyZd3PCzvVZvbdRJNSP-I...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzU3MTIzNjQzMjU0NDQ3OTIzMQ&google_push=AYg5qPJ7kBGMSLDYb6Ldu7amTkYZvS4bQKSSlwnSufWInT4kIu2XYIgyZd3PCzvVZvbdRJNSP-IfBs...

170 B
188 B

17ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzU3MTIzNjQzMjU0NDQ3OTIzMQ&google_push=AYg5qPJ7kBGMSLDYb6Ldu7amTkYZvS4bQKSSlwnSufWInT4kIu2XYIgyZd3PCzvVZvbdRJNSP-IfBsum7jWoMzT-h1EnhzInELk

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzU3MTIzNjQzMjU0NDQ3OTIzMQ&google_push=AYg5qPJ7kBGMSLDYb6Ldu7amTkYZvS4bQKSSlwnSufWInT4kIu2XYIgyZd3PCzvVZvbdRJNSP-IfBsum7jWoMzT-h1EnhzInELk
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame AA24
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEOF9KaYPKFNOG4Wnwrcj-HE&google_cver=1&google_push=AYg5qPLIaAJwF0jKjvMipXsGQPvNdLOsbSlsy8D5Lz14Okng_Wo87_jkUzuK1QHtk817LnI1NzsEWTYxfqt8zpRvFcJY0XjUv_4
https://rtb.openx.net/sync/dds?google_gid=CAESEOF9KaYPKFNOG4Wnwrcj-HE&google_cver=1&google_push=AYg5qPLIaAJwF0jKjvMipXsGQPvNdLOsbSlsy8D5Lz14Okng_Wo87_jkUzuK1QHtk817LnI1NzsEWTYxfqt8zpRvFcJY0XjUv_4&o...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLIaAJwF0jKjvMipXsGQPvNdLOsbSlsy8D5Lz14Okng_Wo87_jkUzuK1QHtk817LnI1NzsEWTYxfqt8zpRvFcJY0XjUv_4&google_hm=SxVaEfrqwb0tZH_BgJv4Gg==

170 B
188 B

16ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLIaAJwF0jKjvMipXsGQPvNdLOsbSlsy8D5Lz14Okng_Wo87_jkUzuK1QHtk817LnI1NzsEWTYxfqt8zpRvFcJY0XjUv_4&google_hm=SxVaEfrqwb0tZH_BgJv4Gg==

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLIaAJwF0jKjvMipXsGQPvNdLOsbSlsy8D5Lz14Okng_Wo87_jkUzuK1QHtk817LnI1NzsEWTYxfqt8zpRvFcJY0XjUv_4&google_hm=SxVaEfrqwb0tZH_BgJv4Gg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 70ftt003h4h1uhv0elqknhulo5iqirkq

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame AA24 0
12 B 16ms
14ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K_gcronllnni1wFUSNNUF2Oj1RC4cfz-80VjlKKIr0hRpTN7295PyUO_EJve6ocdEYPTGw

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:26 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK listRecommendations.json Show response
disqus.com/api/3.0/discovery/ Frame 3BC7 6 KB
7 KB 58ms
20ms XHR
application/json 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/discovery/listRecommendations.json?forum=mobilesyrup&thread=ident%3A818895+https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&limit=8&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.3c0a438a5a4962a39ee30fd041fd5ca9.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

8441c2623b3d20332195e99c5672801baa6269bd2539dfe5d0d86577494ac50a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://disqus.com/recommendations/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:27 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 1783
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Cache-Control: stale-while-revalidate=450, public, max-age=1800
Connection: keep-alive
Content-Type: application/json
Vary: Origin
Content-Length: 6316
X-XSS-Protection: 1; mode=block

GET
H3-29 200 yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js Show response
pagead2.googlesyndication.com/bg/ Frame F79E 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c971ec4829376335946d1beaa191f2c64a48e8954b422dea372c2d9029177b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 10:29:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29910
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5747
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 10:29:57 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 01FD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAKvtW_Vr1Ercj4cV0T3YbU&google_cver=1

43 B
1014 B

32ms
32ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAKvtW_Vr1Ercj4cV0T3YbU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNupDBD70OkBGPbQ76MBMAE&v=APEucNVCzYC6Nc2IZnvr3807H8CKSOcI7CDP8oEaWbOgQcpJLfDfMftcj2R81TOfMZMG_thE79XQFHx2kqi2WMOZsQmfGvaAB6X9DLjeL4MieA1AyJ6hvwebu6V_iGDnbal5M1WJDIQkn1NE4v6bPeV5DBeAhkYk_bpP9a50U0O3tyiyC8-BoSw
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:27 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 05 Jul 2021 18:48:27 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAKvtW_Vr1Ercj4cV0T3YbU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 01FD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YONT.uuebcUg9L1Ytyx5NQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAKvtW_Vr1Ercj4cV0T3YbU&google_cver=1&google_hm=2

43 B
894 B

55ms
55ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAKvtW_Vr1Ercj4cV0T3YbU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNupDBD70OkBGPbQ76MBMAE&v=APEucNVCzYC6Nc2IZnvr3807H8CKSOcI7CDP8oEaWbOgQcpJLfDfMftcj2R81TOfMZMG_thE79XQFHx2kqi2WMOZsQmfGvaAB6X9DLjeL4MieA1AyJ6hvwebu6V_iGDnbal5M1WJDIQkn1NE4v6bPeV5DBeAhkYk_bpP9a50U0O3tyiyC8-BoSw
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:27 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 05 Jul 2021 18:48:27 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAKvtW_Vr1Ercj4cV0T3YbU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 01FD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHDB6eUGYQGj15tFabnRZOw&google_cver=1

43 B
1004 B

58ms
58ms

Image
image/gif

37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHDB6eUGYQGj15tFabnRZOw&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNupDBD70OkBGPbQ76MBMAE&v=APEucNVCzYC6Nc2IZnvr3807H8CKSOcI7CDP8oEaWbOgQcpJLfDfMftcj2R81TOfMZMG_thE79XQFHx2kqi2WMOZsQmfGvaAB6X9DLjeL4MieA1AyJ6hvwebu6V_iGDnbal5M1WJDIQkn1NE4v6bPeV5DBeAhkYk_bpP9a50U0O3tyiyC8-BoSw

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:27 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 4aac93d5-36dd-4576-9221-0b04d4ab85dc
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHDB6eUGYQGj15tFabnRZOw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 01FD
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:27 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: f9a3a9df-b8b8-419a-9632-ac458b3d4a82
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 4ECD 22 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BVApMZZOauKoCXua4fQpPRywxqT37WTKMnFuS0diSjXfhyOTDr1nRSYx44YhNgYhagMYyly0vys64eqv_69IAtKUtJwZ6q-gk-Nvop8DxAYPJu19HBDVajfSWXOVtyNEgjsQiJl6mDDlHJ6LE9fTr47AVb6w&dbm_d=AKAmf-DoaTXLvBae_ZEKBACsmCRPyVl6aOxoLyDRPgvsgbdBTshuqxajFwnexe2KIMjxJlHD7DJtAn3wahaeCtER1f-BScf2xVZogO4XTu-OI96Pas6OZt9i3TaaQzkuDDP3gfhkpwZaAIHMexgvgjdrVIERIoyUFoLG95hn0HlN2pWuhVZST3SsD-caODvlBPWiq8L4ga9MhyvG2vuayxuUu1wBvdfjQQp3kuQGktfI-wCx5NK6FvK4sm3hhq1mbkxQfY7ay7Rqx7C1G25Z_Zr0yBmntvv8eg4Fq_qcGBUNdpH4c4g9T2jZ3bFcuMJbXqeM0KQG4oRFqgiMB62d5D-hXv4-y8cfw31OXL26ov929QY9l2mce-hK9HtASy-VI0fFgNg8-JOEHgE8VuSXtAiA9PVCLyyduu8my2A7wegbhWDpjUpQ8V0fJLYFlW3xEzhtqs3p9SKW9L2d5QSckZh6WgF8QddL0elq1wzL97JlyqL6VPk4HKnxae4h5mNpUaw5sAUjtmpY9CjvzIapsyUwfDrQU72jYrHFSiPCVl0qGAX1gDNk8-d5NKQls_trDslibexPS3ARIZnovffDl2jOECpS_-D_8bT1hk9Do7N38GVOHJ9LcpizXKUVrlucIu0ZJ8guZxlVxMDUYRZ1XU6brTfVvgisKKDhGEC1LjsF5RLv7QqdGqQmPhsX1W1T-B5aXRL1TPTyzD-3UjtaExJqiUArBLCmRvayX4L7UlhKML4JMOTivXC2O52nt38aJeNfv3sjUJBUSKQZ3fuvSatrUPKKHwqHe93QAb4f_mXn6U-ww9gO32Ajrgf8Csnyi85scS_SN56qvYEbcYsDcWjS76YzCiz2ocezXfOfzzp_jAQnAoxpficSwVmAdEsGOI-XkZlV_GjfMaoPwdJRy4DqKE_XK4sNXFZAsAtYXvAlI-7rlW83DPFBY-YUb5S-UJkK5A4_I2E_zbCnND8WXL3mzKFfwvXgCusZMaEuBYkiXyX6okFS0WYjw9XPOZLrUC3Dqvo1-Yq0XeSRcM248D40_SRWZ9loPoyz71by3xmyD1bZvMTnv4KxsKfSlpcQTEiwHcKqxDAkt_9CaW3IBq1KaHlWHLpDlXfF60BTFjnPvHu4Ls7qAI1yJGcNXBjsBDdfI6L9XzOwSJiJwN365M_4ObBxze3WZdocPnRZTvyBzA4PBPE5nG5AgSLoGJnZvWeWjkpEhxx2M64dqoZM1kzEFo7gGbB3OqN9yYb1Zzd47cW_vYcUBcsC1ym_nD52R3e7z1l2v7fX-FS18VEJaChjd9DMIel8QMa1ZR0tu_PY1KdLeDI_m3BfmM4kbJbdXbUk41QHSBKU9NASQv7ZLVuFpWhZirdO-0kQr2AVcJsaRRNn18AkGKO9KNWt-kORAi8SdTUaY8p0qnI4HdXq1hU-O66wV3bvJV2UQEmzOtTii1rtT0GpYXrj4nOP3rLNjBfQWiVjhUh6SDqNmOLVK3H8qyeXw_vrDy3GXYnWg3b6d2MJZ18nCNB0nS_ifoeVHWDTGcf16uyKRVDTKL8-U3kHXHTeH-x_uLFxf-Fpk4t6eHJiXmRKOEfLmbuF4M-5Jau13ii8UPqELpg-COu8D8ORZhPGpRaSWvg_naKejNswIYGWlIUD6Th6mvWLsOR726E8N0SF41_fca_-vg2aPivzv758XoQGgVnm4gd-3Bd2JYdFDVz7Cgq0pyN8kEJJe2BkiyGrr8d0Kydpng5IJqln5NvB5namuhX6hDMv3Jg5R9jLonsrNKjsrQUWdFvp5-NJjjNEdlGuDjMHw8w8xQN5sBEgN5-e-45J0Fnq-5CIvUlWw05XU3wi4FRHkSJ9xJjj7yDvCpSCFj_3wRmwAEK3ZJ_4gyGeuHUdol1sc2uB9sSqKhs87ePS2rrQ0I_9Ail1V1Lq05ty9osCeYG4DIjJcO_KKe0kw0qzPNwmvm0VzWmePAgoXHVkGriwQI3JY_GN6AujmBlgBDUIPmJ6dUD92zJwsoSOAm11wlo4QvTApebltV-WIAyeVcjSRwX0FEtRwrqfGy919kLMEj8LmTheChl8dofEzqV5XbPslwgcMTRuyJj3KaWFfqD5RpPHhfp47BduMHS_0VJ0YhgpywXiw2YxE6lTEK2Wl_CW0_5E2KwQDeMLsjJzKJwj3v4W8Ylopgl43kliVQxqFtnrExe-S4S_28t-6hUhX1tVY-4EMQDgVjo1EE2srMWDCCIc08Z3cUgFuRA3PVWSbN16-OOundLqu-7MKEbkslAqHSv-j83B8RS_ts-ccUOjarpjJqk_hv6NEwGddtQHFFQt-YXcWx-3cLRaFC2YxG3DKdAuPgj_XAr0zL8pCR4h0AC4oZW5TFk7xCipX7d55pXt7fuEBHCaZqdCfSG2Wy1qu6RYzLreyndeURt7fcRSEX11v258sNDs5ZhMrb9Hld-7f6UCNWKxzXW_u9UpoOpJ0xxgfZtyn6mK66x7-tOUpSJZTaXpaKO5X5G5ArOqd2_bUBDbzBoH3O9hX4HL1UPkTNMJbJEwwuERNch_vfDUUKkWA37wWZJdmUnExFRbCyAxsdYaRWmn9B77byv6CiD9HlTlQTpFrz4oxGqAni-524CXh9UTo8LauBe_QUjhDQajyrHb5ElCGDU_ewGd5OtZY9S5LfkTW8kPIDQHW4K_qk-AhEOqXffSQA4xgWLiM25MQdpExAO3AV0OMmnmKXpZXQk519RSyMlWyXdMFJ74r_dRWVcuSBtPzWK2Y9vIRLUAdc4yiSVosnKDhqyo02Ccyq8RBvVOuBnYpy4RFnmNQP_3mSgvLKjgz6bC1JsD_iPz8_Ps19J97u-S9Pcdl5t663igRcukBpPs0Tqq4iXQrXVWQxRzkSNj2CVsAwbhIwEX5p2EApDhbIP8QNpcMNGZbJcQrhqHAU3AFuBHIFo5U1TfvdXwbYGvQHI4BaXxXJvV0RBN8gW4MWEvynkWoPBAVYRVykmDPbmxVcBEXz2g3_bbar0mlMydAGRtjaxHH2H7Q2mCHI9Tv5LnkcxgwlY4S453nD2oAY9EnpS5aagGLxmghLCxzkdDpjqJRyTJVwTc6SyBHVvAylSIKkULonVVDByT0lsaceFQa3diVextPZ0Lz1HLDT7WKjBezbxGA6EFJzEYLhtgv5tJKhCK0S_eiGlwiPhdLjms2P1eH9P8zbJjkbjM3cKomiYgJYYHy5SavypW7atjNjU1Og&cid=CAASEuRo_hc77vuBbQDzoDHVYLarIQ&rfl=1%2Chttps%253A%252F%252Fmobilesyrup.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

598a6c545ec2b27cf7388041cb424a0f4ecc1884dc06e37781b927fbd3cd58fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 311
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8676
x-xss-protection: 0
server: cafe
etag: 11618055936852703379
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:43:16 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/ Frame 4ECD 8 KB
3 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:46:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 92
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:46:55 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4ECD 0
61 B 110ms
49ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst8nhsWv8dlUCES2uhFs7CaavxOJ8eDS_L38jpabzu4qAHRnUfHGOHn55amvS89ZNchruUzAMI0PUFt_LJqjgoRgj52qRC9ji9tncTFUlnyGe6ACKA5E9St9PDOrUuuGbmMRRvZ1LzJgPoVQvNFT23rt6AGkC_LMRUbM_dwNqt336NY6dJRTO8eg7lxStysu9PNhEkJuutpJ-frtc2TvVPu9I_2-GejGKohTSAvQuKAM3I8oH1ShwXYcuNtImWl3gBzOR_1gQXkw-nEBxCkDdO9IpVNwY1MlONMV26PtNlgNG6GoVjSCTDWOUrMJxSrnc5MCeh3_IVMrrXrUiRzwJwed1daMGiOvp8MU0ho_7XRxi46Fylmw10w5a4kIFTtx13D6caiVgH-R5GUUtldsF8Pw3PozW1cfzY8u4qJcAgjZtLZclhqDHuzXNp5IYQaG-IevWXZzF1MSHZ3I-pqo4JcVX3Y1eY9zghntG9eDDYv5cAElNKr-5lDOdG9Xy9aXeuV7-hZXaw0JRU-NLXi5J33QsU1zVo5hmaTtH-GZhxK3zh2QjGCDODk8f5R1bds4sMp0gGcJ9y-XpExanqR-6RTeE_EQKOXFYa-e_tQB949X0nV_o6LB2wLYH0JW01GSQYQ-Ql0-VrFCz5GC6XgnGoJy5804Qxydl8d3kW1s8Vy4_uv2ys_wMvqSl3EX8oMYGOHR8JJVARo_JvvJ8c3YNOTNE2SBXCptIEFj5naZGfoMXNGSHxGJyez_9Lxaxv0AJa0t3gwIZtsnHBdsI3lsCKZ-EKJXLIhlQmcKFErfd0lqJns4aht35ksk3vc5FKjsFgVdYWU2qkLBkpAaT8l4sA77nOaKQ6snM6zAC14X2THr0ZzVrJfQMHwT0B5ulHoJ6HGNUP8bu4dbuWN3ulY-fp5IwXrgAXlEBTbkNc5QZF8DsSWKY_aFaIDLdS1C-LwQl5w3WxmM9_B60te1fN94ZxPR8zB9RTjXSgrRCxkBjo1kVP6GJnmi7CiiimK8_TN3gE_QFF7fujmXLdl7sW4-QhrTdvUPFoBTtJtZX1a7uCrqSkpz765-r2_7rapF92wCxi2-p1KAQl7se-H3AzOjrIsYIcO5-lgsqPLDNsIsDoZwyTks0wZAJ8Ok5MG2uKx28H2iqCWCPNX5a2lmzwN4mtv3o1FaZbPjmhR1e_pt7PysQbGxucySTXVqrQuvf5MdzQU9-NQEHEq63bU4XDVN5a-o-7Phj3YDSfICUo&sai=AMfl-YQz694j104ke5zO_IraKWtHLeeA-FK44I4I5h2abFiI-WJ4WndrWiLT4y39ygdAAfy9B-G80TUXDzbXfUnU1lOmqqdsC0Cr6lsvxuh_6O3oK_Pjvb29Gx9a2IoIyjHujYiVMFEZn1CWG4qEJiohB4w_27XHVQ&sig=Cg0ArKJSzMC8B-QVL9nnEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20210624.58583&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 05 Jul 2021 18:48:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4ECD 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 09:09:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34710
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Jul 2022 09:09:57 GMT

GET
H3-29 200 04132021-092439675-300x250.gif
s0.2mdn.net/5524229/ Frame 4ECD 2 MB
2 MB 10ms
9ms Image
image/gif 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5524229/04132021-092439675-300x250.gif

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb502499cbed630a7003e16900217afc87d92f52bd9748cf6a2244c26edaab9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 07:37:34 GMT
x-content-type-options: nosniff
last-modified: Tue, 13 Apr 2021 16:24:39 GMT
server: sffe
age: 40253
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1972496
x-xss-protection: 0
expires: Tue, 06 Jul 2021 07:37:34 GMT

GET
H3-29 200 status
www.facebook.com/x/oauth/ Frame 2FDB 0
0 34ms
33ms Fetch
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?ancestor_origins=https%3A%2F%2Fmobilesyrup.com&client_id=52254943976&input_token&origin=1&redirect_uri=https%3A%2F%2Fdisqus.com%2Fembed%2Fcomments%2F%3Fbase%3Ddefault%26f%3Dmobilesyrup%26t_i%3D818895%2520https%253A%252F%252Fmobilesyrup.com%252F%253Fp%253D818895%26t_u%3Dhttps%253A%252F%252Fmobilesyrup.com%252F2021%252F07%252F05%252Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%252F%26t_e%3DGoogle%2520removes%2520nine%2520popular%2520apps%2520that%2520stole%2520users%25E2%2580%2599%2520Facebook%2520passwords%26t_d%3D%250A%2520%2520%2520%2520%2520%2520%2520%2520Google%2520removes%2520nine%2520popular%2520apps%2520that%2520stole%2520users%25E2%2580%2599%2520Facebook%2520passwords%2520%2520%2520%2520%2520%2520%26t_t%3DGoogle%2520removes%2520nine%2520popular%2520apps%2520that%2520stole%2520users%25E2%2580%2599%2520Facebook%2520passwords%26s_o%3Ddefault%23version%3De34a397b02545d73e126b1219e8f0e66&sdk=joey&wants_cookie_data=false

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.e51fe378e0cd63a2764bfb6c7ca542a8.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: Gl9tTgyeDAidSJMlBm/tyYb34PpSFngprm8bVMLlaA1xFXzhxtRZ7DSdbDCBxIM8KfxbJcL/WtW3+UPAntbvgw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
fb-s: unknown
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 05 Jul 2021 18:48:27 GMT
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://disqus.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9D65 0
545 B 72ms
43ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 18:48:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 get
c.disquscdn.com/ Frame 3BC7 12 KB
13 KB 17ms
16ms Image
image/jpeg 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/get?url=https%3A%2F%2Fcdn.mobilesyrup.com%2Fwp-content%2Fuploads%2F2021%2F01%2Fcogeco-header-2021-scaled.jpg&key=pMeeq-oG_25EPFmLpzWvIQ&h=200

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

bc004182f4c26b474b4df826f4e7ec89a3fbddc440d9554890ed0caf95942d94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 01:52:19 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 60968
x-cache: Hit from cloudfront
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-cache-hits: 0
content-length: 12531
x-xss-protection: 1; mode=block
x-served-by: static-web-1
server: nginx
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: gI_vC9HoVbnbgMw1CQYb_yHYzYicLravmWHUMCJt7hOlj7RZKLb3BA==
expires: Wed, 04 Aug 2021 01:52:19 GMT

GET
H2 200 get
c.disquscdn.com/ Frame 3BC7 7 KB
8 KB 19ms
17ms Image
image/jpeg 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/get?url=https%3A%2F%2Fcdn.mobilesyrup.com%2Fwp-content%2Fuploads%2F2021%2F02%2FRogers-header-scaled.jpg&key=LOZPXOtaizj514vQnoenEQ&h=200

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

784e67ec69232dfe11d65dd21ddc94e0acfd96ce7b74c7324e029f3258d6d5ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 04 Jul 2021 16:51:40 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 93407
x-cache: Hit from cloudfront
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-cache-hits: 0
content-length: 7378
x-xss-protection: 1; mode=block
x-served-by: static-web-1
server: nginx
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: fTkoIK59PHXwlAqZqnwEjokzZMI-EO4f97U0GVNx5i631iIjobBZdQ==
expires: Tue, 03 Aug 2021 16:51:40 GMT

GET
H2 200 get
c.disquscdn.com/ Frame 3BC7 15 KB
16 KB 17ms
16ms Image
image/jpeg 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/get?url=https%3A%2F%2Fcdn.mobilesyrup.com%2Fwp-content%2Fuploads%2F2021%2F07%2Fwindopws-11-syrupcast-scaled.jpg&key=GqeBnj9I11ATMdgpzsPAGg&h=200

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

06b5dadb78f8a84e13dbab3d90ab48a3451897d47573844f97aa292082f4c7f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 02 Jul 2021 18:50:11 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 259096
x-cache: Hit from cloudfront
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-cache-hits: 0
content-length: 15739
x-xss-protection: 1; mode=block
x-served-by: static-web-2
server: nginx
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: v8YkPMsCUFMl8C-xmuEt5hb97URpcVsGpTNdHOXYRFUWeMVN5Gah3A==
expires: Sun, 01 Aug 2021 18:50:11 GMT

GET
H2 200 get
c.disquscdn.com/ Frame 3BC7 17 KB
17 KB 18ms
17ms Image
image/jpeg 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/get?url=https%3A%2F%2Fcdn.mobilesyrup.com%2Fwp-content%2Fuploads%2F2021%2F07%2Fstarlink-dish-mounted-toyota-prius-scaled.jpg&key=wMXIfaNlRVCrpbkhDVdPnw&h=200

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

262c30826985c1b4169daf89d062d8c6eba1c2160869d1c7eff6d705f84c3b51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 03 Jul 2021 19:02:37 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 171950
x-cache: Hit from cloudfront
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-cache-hits: 0
content-length: 17032
x-xss-protection: 1; mode=block
x-served-by: static-web-2
server: nginx
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: 0neI57k8k8xFByTUhXavgMBUZXCrL93P-LRacVGtvRZGQX3BNU2Jig==
expires: Mon, 02 Aug 2021 19:02:37 GMT

GET
H2 200 get
c.disquscdn.com/ Frame 3BC7 8 KB
9 KB 18ms
17ms Image
image/jpeg 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/get?url=https%3A%2F%2Fcdn.mobilesyrup.com%2Fwp-content%2Fuploads%2F2021%2F02%2Ffacebook-header-not-evil-scaled.jpg&key=EmARAXpeUE7x0QAtCTM_rg&h=200

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

dae8a2202ab805b79241ff89afdd430134c9f7dd48bed08f98993f4a81fe8031

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 02:21:48 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 59199
x-cache: Hit from cloudfront
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-cache-hits: 0
content-length: 8352
x-xss-protection: 1; mode=block
x-served-by: static-web-1
server: nginx
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: QJXZ4J6q7V4eF9n3b5JxYIjQBZ7DkydCuleMEUs6z4ZAGFGvADr50A==
expires: Wed, 04 Aug 2021 02:21:48 GMT

GET
H2 200 get
c.disquscdn.com/ Frame 3BC7 11 KB
12 KB 19ms
18ms Image
image/jpeg 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/get?url=https%3A%2F%2Fcdn.mobilesyrup.com%2Fwp-content%2Fuploads%2F2020%2F03%2Fqualcomm-logo-header-resizzled-scaled.jpg&key=2lTO08aJQtVdF3oGJgYfnA&h=200

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

c794ce32d12cc839220b7fa2fb77737e0f3d716e1ba68f13840e9deefe15dab2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 03 Jul 2021 03:49:20 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 226747
x-cache: Hit from cloudfront
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-cache-hits: 0
content-length: 11305
x-xss-protection: 1; mode=block
x-served-by: static-web-2
server: nginx
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: D66zRpzCivjXALlcw3iSpgJpyLANsaFhXUzvbniPTJqG1QYw4Obdtg==
expires: Mon, 02 Aug 2021 03:49:20 GMT

GET
H2 200 get
c.disquscdn.com/ Frame 3BC7 9 KB
9 KB 25ms
25ms Image
image/jpeg 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/get?url=https%3A%2F%2Fcdn.mobilesyrup.com%2Fwp-content%2Fuploads%2F2021%2F07%2Fpsp-header.jpg&key=otty2jQ5EvqCbXhBSQxMbw&h=200

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

9b7cbbc88fa90dfe92e8d3f2e6907934df977fe709eedf677495002a3f0d742c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 02 Jul 2021 19:03:37 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 258290
x-cache: Hit from cloudfront
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-cache-hits: 0
content-length: 9163
x-xss-protection: 1; mode=block
x-served-by: static-web-1
server: nginx
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: 6aYwtZmPOoqi67ryfIiPmh8Xp6eS9t_s2TAtBzF9uqcpiMUfNX_Ebg==
expires: Sun, 01 Aug 2021 19:03:37 GMT

GET
H2 200 get
c.disquscdn.com/ Frame 3BC7 8 KB
8 KB 25ms
25ms Image
image/jpeg 2600:9000:21f3:4000:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/get?url=https%3A%2F%2Fcdn.mobilesyrup.com%2Fwp-content%2Fuploads%2F2021%2F02%2Fmacbook-pro-m1-1-header.jpg&key=d60Mw010jpaZM_w0YymuaQ&h=200

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:4000:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

832d76ac36ece16d634cb018bfef10585708acff0fe6160733d1efa9acfb76ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 02 Jul 2021 05:29:32 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 307135
x-cache: Hit from cloudfront
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-cache-hits: 0
content-length: 8214
x-xss-protection: 1; mode=block
x-served-by: static-web-1
server: nginx
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: jutxUKK0yvF18olVpcfNkVHiP_rlO1On-yxFiup8RgZOCELXsxzCQA==
expires: Sun, 01 Aug 2021 05:29:32 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012106212012000/ Frame 66EC 188 KB
55 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012106212012000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e872cbf02c8b399de0bc02a3120c525d1397d73e6fe9b396ddb9fb8ca645421f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 114507
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55206
x-xss-protection: 0
server: sffe
date: Sun, 04 Jul 2021 11:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "08e7b47afdadb9c9"
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Jul 2022 11:00:00 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012106212012000/v0/ Frame 66EC 13 KB
5 KB 37ms
15ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012106212012000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42c0019ac2f32d24160ef9f53853c7caeb65ea3b21bcbcd8e3b90a5a230dfba4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 513733
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4815
x-xss-protection: 0
server: sffe
date: Tue, 29 Jun 2021 20:06:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9c6d4b511682de4a"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jun 2022 20:06:14 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012106212012000/v0/ Frame 66EC 86 KB
27 KB 38ms
16ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012106212012000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac42f28820c1a06584cf80f69fc888b8d19d7b87197bef5ea6ea355b712df62c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 114508
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27658
x-xss-protection: 0
server: sffe
date: Sun, 04 Jul 2021 10:59:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "89763648e638c628"
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Jul 2022 10:59:59 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012106212012000/v0/ Frame 66EC 4 KB
2 KB 40ms
19ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012106212012000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48f9695743d1ea7156fe612eb25beb3be6ca81d94a30891b848d0177137dfaa6

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 114508
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1490
x-xss-protection: 0
server: sffe
date: Sun, 04 Jul 2021 10:59:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "e9b373dc53e7b532"
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Jul 2022 10:59:59 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012106212012000/v0/ Frame 66EC 40 KB
13 KB 41ms
19ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012106212012000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e54b897cb477a0ce61dc7c6900e1c57a4f127c24716662b84313be238e0f7abb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 114508
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12852
x-xss-protection: 0
server: sffe
date: Sun, 04 Jul 2021 10:59:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "432397294f345717"
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Jul 2022 10:59:59 GMT

GET
DATA 200
OK truncated
/ Frame 66EC 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4445ae18f7b6c621d1dd540d6963be5cb28b05681569f29443726057a4f9cb4a

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 12910289887879323135
tpc.googlesyndication.com/simgad/ Frame 66EC 67 KB
67 KB 13ms
12ms Image
image/gif 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12910289887879323135

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2478c6a984bbcc810096ce2378215dccb5ee0ed21952e2b25d0851cb3f8147a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 29 Jun 2021 04:20:03 GMT
x-content-type-options: nosniff
age: 570504
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 68751
x-xss-protection: 0
last-modified: Mon, 28 Jun 2021 07:42:30 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jun 2022 04:20:03 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 66EC 2 KB
2 KB 13ms
11ms Image
image/png 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 07:15:41 GMT
x-content-type-options: nosniff
server: cafe
age: 41566
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Tue, 06 Jul 2021 07:15:41 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 66EC 295 B
319 B 14ms
12ms Image
image/png 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 10:45:56 GMT
x-content-type-options: nosniff
server: cafe
age: 28951
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 06 Jul 2021 10:45:56 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 66EC 0
0 15ms
13ms Image
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQhFLWCwnRcg07Q-Bz8-9sgor3zLp18KQg-zqFOEviW_1yDX0jAUs1u_cb-h7CU8SzUeplmGxHiwu1tee0r4VPldx1sbA
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 66EC 0
0 44ms
42ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CMXLj-lPjYPnCKuDI7_UPyIudwAKzyrbKY8LC8O2TDrmF2P6SDhABII6cjn9glfrwgYwHoAHx6t_gAsgBA-ACAKgDAcgDCKoEqAJP0IEYwqpVMlw-sFdEEqQXccQGM8-1WBSFlUhP51a9xK5z84e3xM3nE7-d1511c-1ePqCPRi3FmcJkNVhIE4HdXaSxZbjjXaiT-69TwyKZg_EPPsqHcdm1rAahZFwsPP20dwOqACn0NIh_JBMLJelgtNNGRLH7kedjmGS0Ogn4vWfZxPOfWt2Oc8VWWu8LvAavgFQHXFHspvHiUPE3QUj2p7IKQO7nIpfmH_Bbev71_RMQQo9VqRWpD1gd0IfGf0HE-p-Yr1xyDL6AwWe8JnUt-Hu9va5Xb9knBpmFDUGAmXSlW0LbyDeqKrsmUlGLe-f9u4WJun5p5YoXXZgQdxhEj-tgdazsT3NGK20ZKzta48wT8HaW8yAct6K4uorZLe02vJratC8mtsAEwYWN9dsD4AQBkgUECAQYAZIFBAgFGASgBgOAB_eUoJ8BqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEELCHGtIICQiA4YAQEAEYHYAKA8gLAdgTDdAVAYAXAbIXGgoYCAASFHB1Yi0zMDU2NTY5MjE5NjM2OTAz&sigh=b3zByzKPknE
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A1E1 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 05 Jul 2021 11:22:34 GMT
expires: Tue, 05 Jul 2022 11:22:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 26753
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 t.gif
sb.freeskreen.com/ Frame EF8E 43 B
411 B 44ms
44ms Image
image/gif 13.225.87.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1625510907&p=4444&c=5824&s=undefined&d=1234605&v=298&t=6d275153-e725-4d26-87db-c22ec2ec5713&co=DE&pr=BE&ci=Berlin&dm=null&flc=&slc=&ttm=1625510905996&gdpr=1&gdpr_consent=-1&e=VastRequest&m=1&x=https%3A%2F%2Fads.freeskreen.com%2Fbid%3Fpid%3D4444%26tid%3D6d275153-e725-4d26-87db-c22ec2ec5713%26w%3D603%26h%3D338%26u%3Dhttps%253A%252F%252Fmobilesyrup.com%252F2021%252F07%252F05%252Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%252F%26ip%3D89.249.64.203%26ua%3DMozilla%252F5.0%2520(Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64)%2520AppleWebKit%252F537.36%2520(KHTML%252C%2520like%2520Gecko)%2520Chrome%252F89.0.4389.72%2520Safari%252F537.36%26g_co%3DDE%26g_p%3DBE%26g_ci%3DBerlin%26g_d%3Dnull%26s_1%3D%26s_2%3D%26cid%3D5824%26sid%3Dundefined%26vid%3D298%26did%3D1234605%26pf%3D500%26ttm%3D1625510905996%26eu_c%3D-1%26eu_g%3D1%26eu_ggl%3D0
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-95.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
via: 1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: fNAmemKScq0oJeAVooImxbxVJ_2cs7P_DjflW7L2H0TWI64HjfgkjQ==
expires: -1

GET
H2 200 t.gif
sb.freeskreen.com/ Frame EF8E 43 B
414 B 62ms
61ms Image
image/gif 13.225.87.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1625510907&p=4444&c=5824&s=undefined&d=1234605&v=298&t=6d275153-e725-4d26-87db-c22ec2ec5713&co=DE&pr=BE&ci=Berlin&dm=null&flc=&slc=&ttm=1625510905996&gdpr=1&gdpr_consent=-1&e=VastEmpty&m=1&x=
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-95.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
via: 1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: thF8fXLkMjW7If_HHXY-jPwKSJCu6URG8TAzgnYYWPNlBDsKUXbTzw==
expires: -1

GET
H2 200 t.gif
sb.freeskreen.com/ Frame EF8E 43 B
413 B 69ms
68ms Image
image/gif 13.225.87.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1625510907&p=4444&c=5824&s=undefined&d=&v=&t=6d275153-e725-4d26-87db-c22ec2ec5713&co=DE&pr=BE&ci=Berlin&dm=null&flc=&slc=&ttm=1625510905996&gdpr=1&gdpr_consent=-1&e=VideoError&m=1&x=ErrorNoPlayableAd
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-95.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
via: 1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: GXax7f_UYP6dPOoG3yFFOjNuGQPy3gQgeaq_3v7txjElL_xcFHbCYw==
expires: -1

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1F2D 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 05 Jul 2021 08:59:18 GMT
expires: Tue, 06 Jul 2021 08:59:18 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 35349
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 4ECD 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6d1bfaae783d4e7e808cbc4cdd06c3482c892dbcba619cf4b90c09b2b58325e7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 012B 5 KB
4 KB 25ms
24ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_244&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_244.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0387d7bdd5a58ee6ac60dfa387a1c6141ee78dbec2ef7a4812a169cd67995c72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 18:48:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4282
x-xss-protection: 0

GET
H3-29 200 skyLogo_970x250_2020.png_1621952551211_skyLogo_970x250_2020.png
s0.2mdn.net/dynamic/2/10812389/s0.2mdn.net/creatives/assets/3690075/ Frame 012B 15 KB
15 KB 8ms
7ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812389/s0.2mdn.net/creatives/assets/3690075/skyLogo_970x250_2020.png_1621952551211_skyLogo_970x250_2020.png

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

228bcb24447f47d86dc76134510b8944239701737221b012c19b1cbe54020add

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=CVdNyZTxRE&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 08:57:56 GMT
x-content-type-options: nosniff
last-modified: Tue, 25 May 2021 14:22:41 GMT
server: sffe
age: 381031
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15046
x-xss-protection: 0
expires: Fri, 01 Jul 2022 08:57:56 GMT

GET
H3-29 200 blank.png_1621952551211_blank.png
s0.2mdn.net/dynamic/2/10812389/s0.2mdn.net/creatives/assets/3690075/ Frame 012B 95 B
118 B 8ms
7ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812389/s0.2mdn.net/creatives/assets/3690075/blank.png_1621952551211_blank.png

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9df9512d0f2332b34e43e220b6bdc675dc6b663e72406edde64fd96dc9128e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=CVdNyZTxRE&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 17:54:11 GMT
x-content-type-options: nosniff
last-modified: Tue, 25 May 2021 14:22:33 GMT
server: sffe
age: 3256
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95
x-xss-protection: 0
expires: Tue, 05 Jul 2022 17:54:11 GMT

GET
H3-29 200 DCO_0106_Keyart_970x250_CIN_Highlights.jpg_1623763250549_DCO_0106_Keyart_970x250_CIN_Highlights.jpg
s0.2mdn.net/dynamic/2/10812389/s0.2mdn.net/creatives/assets/3690075/ Frame 012B 90 KB
90 KB 10ms
9ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812389/s0.2mdn.net/creatives/assets/3690075/DCO_0106_Keyart_970x250_CIN_Highlights.jpg_1623763250549_DCO_0106_Keyart_970x250_CIN_Highlights.jpg

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

922dc60025365b1cfecf3c7fc8f56234fc33112fbe9df75094830f1bb0242637

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=CVdNyZTxRE&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 11:45:49 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 13:21:05 GMT
server: sffe
age: 457358
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 92361
x-xss-protection: 0
expires: Thu, 30 Jun 2022 11:45:49 GMT

GET
H3-29 200 DCO_0106_Keyart_970x250_CIN_Horizon_Line.jpg_1623763250549_DCO_0106_Keyart_970x250_CIN_Horizon_Line.jpg
s0.2mdn.net/dynamic/2/10812389/s0.2mdn.net/creatives/assets/3690075/ Frame 012B 65 KB
65 KB 10ms
9ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812389/s0.2mdn.net/creatives/assets/3690075/DCO_0106_Keyart_970x250_CIN_Horizon_Line.jpg_1623763250549_DCO_0106_Keyart_970x250_CIN_Horizon_Line.jpg

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e2f8ab1b81476004e7313643a55e74c6824dcabf14e22526ce26eb8a2d11e88

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=CVdNyZTxRE&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 08:58:17 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 13:21:13 GMT
server: sffe
age: 381010
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66120
x-xss-protection: 0
expires: Fri, 01 Jul 2022 08:58:17 GMT

GET
H3-29 200 DCO_0106_Keyart_970x250_CIN_New_Mutants.jpg_1623763250549_DCO_0106_Keyart_970x250_CIN_New_Mutants.jpg
s0.2mdn.net/dynamic/2/10812389/s0.2mdn.net/creatives/assets/3690075/ Frame 012B 82 KB
82 KB 9ms
9ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812389/s0.2mdn.net/creatives/assets/3690075/DCO_0106_Keyart_970x250_CIN_New_Mutants.jpg_1623763250549_DCO_0106_Keyart_970x250_CIN_New_Mutants.jpg

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6a23d428deb3f92267bcb9392cb00f84af56e03b26c7ab0f9e487a6cf4b9632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=CVdNyZTxRE&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 10:49:44 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 13:21:04 GMT
server: sffe
age: 374323
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 84370
x-xss-protection: 0
expires: Fri, 01 Jul 2022 10:49:44 GMT

GET
H3-29 200 DCO_0106_Keyart_970x250_CIN_TWMD.jpg_1623763250549_DCO_0106_Keyart_970x250_CIN_TWMD.jpg
s0.2mdn.net/dynamic/2/10812389/s0.2mdn.net/creatives/assets/3690075/ Frame 012B 76 KB
76 KB 12ms
11ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812389/s0.2mdn.net/creatives/assets/3690075/DCO_0106_Keyart_970x250_CIN_TWMD.jpg_1623763250549_DCO_0106_Keyart_970x250_CIN_TWMD.jpg

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3e0bce1653f85b64ccdc97b01fab1b4eb5b3b487a28a88690ab968be8296952

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=CVdNyZTxRE&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 11:43:11 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 13:20:57 GMT
server: sffe
age: 371116
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 78263
x-xss-protection: 0
expires: Fri, 01 Jul 2022 11:43:11 GMT

GET
H3-29 200 sky_medium.woff
s0.2mdn.net/creatives/assets/3668815/ Frame 012B 27 KB
27 KB 6ms
6ms Font
font/woff 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3668815/sky_medium.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/style.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4373878b9f750698b6a199ebc0eb0e550df208c5a1f9f778a346e271a2b4d733

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:39:03 GMT
x-content-type-options: nosniff
last-modified: Thu, 20 Feb 2020 12:38:21 GMT
server: sffe
age: 564
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27952
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:54:03 GMT

GET
H3-29

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 66EC
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

39ms
38ms

Image
text/html

2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

date: Mon, 05 Jul 2021 18:48:27 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 012B 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_244.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:27 GMT

GET
H2 200 t.gif
sb.freeskreen.com/ 43 B
412 B 71ms
70ms Image
image/gif 13.225.87.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1625510906&p=4444&c=5824&s=undefined&d=&v=&t=6d275153-e725-4d26-87db-c22ec2ec5713&co=DE&pr=BE&ci=Berlin&dm=null&flc=&slc=&ttm=1625510905996&gdpr=1&gdpr_consent=-1&e=PassbackImpression_3254&m=2&x=
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-95.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
via: 1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: WC_qTEo0clQIq-Iq7knfQgXCn-kZfgKqH7agb3N1O7F3s3ESAF6dhw==
expires: -1

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 1F2D 0
103 B 14ms
12ms Image
text/plain 2a02:fa8:8806:13::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEFpL__RhLy9yrGPPuH9Xe-Y&google_cver=1&google_push=AYg5qPIS4MwVoYV8KHdhdE4N9prHTJLvRkUhjqS4gbwdgRpqJoZjhgi3zL7bHYh7j6ZIth0KAUU9j38r4bEFvWqqrijsIRxLuij1tg
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1370 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 1F2D
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESELgc2vbVIctBpM7WxqbJ9y8&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESELgc2vbVIctBpM7WxqbJ9y8&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SEVCVE85Q3IxTTB0RFI1&google_gid=CAESELgc2vbVIctBpM7WxqbJ9y8&google_cver=1&google_push=AYg5qPJzV0NUHhvRK_8HxJVxUb60k92-ZDvuRZMaZnduqWb...

170 B
188 B

16ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SEVCVE85Q3IxTTB0RFI1&google_gid=CAESELgc2vbVIctBpM7WxqbJ9y8&google_cver=1&google_push=AYg5qPJzV0NUHhvRK_8HxJVxUb60k92-ZDvuRZMaZnduqWbrwM2Zjk0HyqnXuSVjNVNHtxIDeqz4KB3KsW9VknZxectLbbfatZLVPg

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:27 GMT
Server: PingMatch/v2.0.30-655-g6f0fff2#rel-ec2-master i-09aa64c92a07a6de3@eu-central-1a@dxedge-app-eu-central-1-prod-asg
P3P: policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SEVCVE85Q3IxTTB0RFI1&google_gid=CAESELgc2vbVIctBpM7WxqbJ9y8&google_cver=1&google_push=AYg5qPJzV0NUHhvRK_8HxJVxUb60k92-ZDvuRZMaZnduqWbrwM2Zjk0HyqnXuSVjNVNHtxIDeqz4KB3KsW9VknZxectLbbfatZLVPg
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 1F2D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WU9OVF93QUNjd2VyZWdBQw==&google_gid=CAESEBvHNa8m1voNBqUy0BH1l1o&google_cver=1&google_push=AYg5qPLQfOhSZ9m6PfxID-4k0f3EX0v4N9...

170 B
188 B

17ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WU9OVF93QUNjd2VyZWdBQw==&google_gid=CAESEBvHNa8m1voNBqUy0BH1l1o&google_cver=1&google_push=AYg5qPLQfOhSZ9m6PfxID-4k0f3EX0v4N9A6p560EIzgC0_DZglrpZ0rQxufRmaZqXiZ9202RzhdvF--UB1eFdMe_VdjCVTUpfAIkQ

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1625510907.353209,VS0,VE0
x-served-by: cache-hhn4076-HHN
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WU9OVF93QUNjd2VyZWdBQw==&google_gid=CAESEBvHNa8m1voNBqUy0BH1l1o&google_cver=1&google_push=AYg5qPLQfOhSZ9m6PfxID-4k0f3EX0v4N9A6p560EIzgC0_DZglrpZ0rQxufRmaZqXiZ9202RzhdvF--UB1eFdMe_VdjCVTUpfAIkQ
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 1F2D 0
191 B 3370ms
30ms Image
text/plain 66.155.71.149
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEIj6O_jwpMnQYvCuAdZh9gA&google_cver=1&google_push=AYg5qPItDG6Nf2dZJcmQ0DoMY66AuHcSsm2XlEABLdC6B-rnwbwIxtHYxNJ8dNXgBjoQT-wLpNNEoRSsmC1Hqr_V4lWRmFCBB_HFXw
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.149 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:30 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 1F2D
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEIP5llkOX2lq21n1VJrV-Y8&google_cver=1&google_push=AYg5qPL5bo0PVXsPzGw4LVzoN7Edt3ue94IPfb485avQO80B8SgA3zzJRqcoI7P0fqE0QJPIf3N6i1ZU6cy...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPL5bo0PVXsPzGw4LVzoN7Edt3ue94IPfb485avQO80B8SgA3zzJRqcoI7P0fqE0QJPIf3N6i1ZU6cySQzieyYZ_hFR08Vu7Sw&google_hm=vXINS-3kRR2zOoVFKk...

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPL5bo0PVXsPzGw4LVzoN7Edt3ue94IPfb485avQO80B8SgA3zzJRqcoI7P0fqE0QJPIf3N6i1ZU6cySQzieyYZ_hFR08Vu7Sw&google_hm=vXINS-3kRR2zOoVFKkt-b8s

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPL5bo0PVXsPzGw4LVzoN7Edt3ue94IPfb485avQO80B8SgA3zzJRqcoI7P0fqE0QJPIf3N6i1ZU6cySQzieyYZ_hFR08Vu7Sw&google_hm=vXINS-3kRR2zOoVFKkt-b8s
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: clear
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 1F2D
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEP-TXmgqmm-9GoBmR3pIgvU&google_cver=1&google_push=AYg5qPKMs537-iVX8INGi9xF5IeExVfV7DMcLhAzpNbQB-qfQ1XCbQMDliVcpEYsks7IUsRMuUWp1kKGP5iWJ1nq7AD_P4PedQTEtQ
https://rtb.openx.net/sync/dds?google_gid=CAESEP-TXmgqmm-9GoBmR3pIgvU&google_cver=1&google_push=AYg5qPKMs537-iVX8INGi9xF5IeExVfV7DMcLhAzpNbQB-qfQ1XCbQMDliVcpEYsks7IUsRMuUWp1kKGP5iWJ1nq7AD_P4PedQTEt...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKMs537-iVX8INGi9xF5IeExVfV7DMcLhAzpNbQB-qfQ1XCbQMDliVcpEYsks7IUsRMuUWp1kKGP5iWJ1nq7AD_P4PedQTEtQ&google_hm=SxVaEfrqwb0tZH_BgJv4Gg==

170 B
188 B

16ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKMs537-iVX8INGi9xF5IeExVfV7DMcLhAzpNbQB-qfQ1XCbQMDliVcpEYsks7IUsRMuUWp1kKGP5iWJ1nq7AD_P4PedQTEtQ&google_hm=SxVaEfrqwb0tZH_BgJv4Gg==

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:26 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKMs537-iVX8INGi9xF5IeExVfV7DMcLhAzpNbQB-qfQ1XCbQMDliVcpEYsks7IUsRMuUWp1kKGP5iWJ1nq7AD_P4PedQTEtQ&google_hm=SxVaEfrqwb0tZH_BgJv4Gg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: mjgnhcqqc5g1jbngol8j1mn2sku7bfg3

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 1F2D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHsTgJPINAtDpTbHF6lmZlc&google_cver=1&google_push=AYg5qPItj3_2KT07Sn3mSJPrncyIxQ-hsH-tB0CT21J79PQbcfXqIq3-64nohxHqTBfqkzWMVlE...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRWjgyWkYtOS04VTg0&google_push=AYg5qPItj3_2KT07Sn3mSJPrncyIxQ-hsH-tB0CT21J79PQbcfXqIq3-64nohxHqTBfqkzWMVlEftENkr_TICURxaozUtM1Gv7iLcA

170 B
188 B

19ms
19ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRWjgyWkYtOS04VTg0&google_push=AYg5qPItj3_2KT07Sn3mSJPrncyIxQ-hsH-tB0CT21J79PQbcfXqIq3-64nohxHqTBfqkzWMVlEftENkr_TICURxaozUtM1Gv7iLcA

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRWjgyWkYtOS04VTg0&google_push=AYg5qPItj3_2KT07Sn3mSJPrncyIxQ-hsH-tB0CT21J79PQbcfXqIq3-64nohxHqTBfqkzWMVlEftENkr_TICURxaozUtM1Gv7iLcA
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
Expires: 0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 1F2D 0
12 B 16ms
15ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IbmsWQBCSHrpFXeGnn2oAYDZrsKuOeDMVtv6CYwvlC8uv2xnD8DfCdgzU4YXv4yvPmZORq

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK 23502.js Show response
ads.rubiconproject.com/ad/ Frame 0D7F 30 KB
9 KB 1040ms
7ms Script
text/javascript 2.19.35.65
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.rubiconproject.com/ad/23502.js
Requested by: Host: sb.freeskreen.com
URL: https://sb.freeskreen.com/publisher/script.js?bai=27&ut=&uts=&flc=&slc=&windowlocation=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&usp=&gdpr=-1&cs=-1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.35.65 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-35-65.deploy.static.akamaitechnologies.com
Software: Apache / PHP/5.3.3
Resource Hash: a969a9b32705092663a8c9019ac9835cf93fff0d525457961e309bf04dba1424

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:28 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=1208
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 8969
Expires: Mon, 05 Jul 2021 19:08:36 GMT

GET
H3-29 200 yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js Show response
pagead2.googlesyndication.com/bg/ Frame A1E1 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c971ec4829376335946d1beaa191f2c64a48e8954b422dea372c2d9029177b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 10:29:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29910
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5747
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 10:29:57 GMT

GET
H3-29 200 u5qa6Bce0_JDlbgkcQuMCffbH_LjsHWDv7QaTzlh7sk.js Show response
pagead2.googlesyndication.com/bg/ Frame E70F 35 KB
13 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/u5qa6Bce0_JDlbgkcQuMCffbH_LjsHWDv7QaTzlh7sk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb9a9ae8171ed3f24395b824710b8c09f7db1ff2e3b07583bfb41a4f3961eec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 13:52:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17785
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13289
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 16:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 13:52:02 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F79E 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BmJMT-lPjYJunIa6U9u8Pg4OY2AUAAAAAOAHgBAI&bg=!KCulK2_NAAYo4NJEKOA7ACkAdvg8WvDkPImQFtd2FyEOe_BfuaL7Kk_icuECIqgnN08HUptOS_alIAIAAAEsUgAAADJoAQcKAKyvK_whI7r8M6qTYyd6Cm1HNAEsPnxHiP1DOxw7z_HH9gAN435qhXLUqWRmv_McjSel-RxLmKUtNnmQw2ny_JuP2-FVnfe3raQzXiQuIz1oCOLkER-rF8IeFdxtu9g5eKKElGe57J6VlIpOh-_FP4PhKHCAZ6srgEc5JZwrehZzCybLaG-eGwYJVbPQw0bjge7WtYy3HtFzWWjqmH6QhQ8ktYUZ_cg_PsV0N88TmQLBb01gAjo3v0efP3BZSlZE43FCOP_8hqR0vJGFJDkrrv5Ihrj0KvQ8r5pjgKXdMnei6vcWD23SV1KA9nSsLsMtjt1SDR61fNDYN_ihq34xcc10tGuPZGTWziMW9BF3Y6TNHo9niweOjal0ULIudLoIaQQgAhJTA4xRBiKgZZh1Fx8kzkqRQGx9N0-ftbw64X3pZTOo7_zuiJm6dxyxzo8KRm0uImjJ7GV8gvkVmj8ORbpHsL2HNdvXpaslBRgfOFj9_UHBk2t9IAVklQ5EL79OtKLbtAibCbEo1dTc7ttmRVkRfivfwU3IeyxvDhXesRn35ikw_CdKXCZun-gcM8a2opGUxy00WPTzUdrZXqyC6Gd826NeIakvpkLTbok198BhUMFcjqjYnyTnzk-H6ShJh3p3e7Fnpm78R0PJ1XbE7ELrSJEX17VwCbH6j152SYZTX287-cYjonq3qUaO1ImYb0TBdPSAoadcWR8vLj7v84oxwe7SH2QqEYXQKyNoD4Z_jF1rqqFiw97UJ2H5eCDK_f-H6yUMIZ_0GLypeS_L6Ry3JRwOmf0Q9-66_Ufs30j11uzJA9zNX9DDBytJkc_Pd2am4t5n0zCCeLgqaZhXPqwNy_k9ZEGl0Hc1FAAI1xtJhNidSM8hFn4WL2hr3C5n5Rfsx7AwFvPkdkR76JOq5Ya-afJuk0t259fijPPNwiGJRcQFLx3f9UI-BOx9Du3lXxr0yDE-nrzUYHI4xwlskjvsRfoO1eTDaQwlK4cR6VFR10RjTPl6_HVVOrfmqILNxsAHE3S0WczpPBAxQcCKDxlb-cPBjWhZ6HjhYuYvITCjrKmiMzkhrdF9GBnCjv1nuSjOBoLZzEPOEFqQ-9nYZaQwhcFjohmqPbuZggYwQ1FR76ufi5GuboEQnaNThjMXOcxfn9IOPPa02WoOxSJobfcw

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 noavatar92.png
a.disquscdn.com/1624570071/images/ Frame 2FDB 2 KB
2 KB 7ms
6ms Image
image/png 151.101.114.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.disquscdn.com/1624570071/images/noavatar92.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.152a1430e3267673ea556dc28bb34a79.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:27 GMT
x-content-type-options: nosniff
last-modified: Thu, 24 Jun 2021 18:53:57 GMT
server: nginx
age: 601437
etag: "60d4d4c5-66c"
strict-transport-security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-xss-protection: 1; mode=block
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
content-type: image/png
content-length: 1644
x-amz-cf-id: 6tstZudMz1Mgb5HvxZYYB9aU1vfHMCB1lcqMcUSEuSzn3tDKQQxhdA==
expires: Wed, 28 Jul 2021 19:44:30 GMT

GET
H3-29 200 container.html Show response
8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6C4C 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mobilesyrup.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 05 Jul 2021 18:48:25 GMT
expires: Tue, 05 Jul 2022 18:48:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E919 624 B
297 B 16ms
15ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjFxtiZATAB&v=APEucNW6Zuuc5lBLIIci_Q4N3LWcGsc3OkLM4E0W5xQW91Vr7u962DQBmU2akYiVNehOY-RWT5z9ZvMR2ti3XQfCADEOpFUHwGrVv4v8LnAn-rmCgiRbboVCBre8y9H5V7J_O_2I8KKD56d5s9H-vqj8JPYeKjfr316iCsD093YMTnjswOe6d-c

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CPvjgQEQ_aOOARjFxtiZATAB&v=APEucNW6Zuuc5lBLIIci_Q4N3LWcGsc3OkLM4E0W5xQW91Vr7u962DQBmU2akYiVNehOY-RWT5z9ZvMR2ti3XQfCADEOpFUHwGrVv4v8LnAn-rmCgiRbboVCBre8y9H5V7J_O_2I8KKD56d5s9H-vqj8JPYeKjfr316iCsD093YMTnjswOe6d-c
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlKXhf4VU9J3dyKElcRntZGsHtthYGTxx9_Y23SRWyxUkUbguuJG35ExUn209o
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 05 Jul 2021 18:48:27 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6C4C 61 KB
24 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cn-F0noj-XaJ7Wl6i0Gro6v6W9GyonEcwilRbdlYWk666g02wK9_FXlu9OLTelvviO2CSTYP65JPxBp94bVCTsUJkU9DZ_88eeErmuj9IzS4DrHv7Odo6ECvWVYu-m7BnvImZlOx3lNIdy9TfXG0LLlA0log&dbm_d=AKAmf-B68ZF5kkaaxMbZ4SMPfc68h91O52EhOBiQEN34P6GieSostyfQF-d5UiKMlUzixhZzeNL8PhwcBy34gSJBIyX9sBPWjnwUYOqK9QTza2PiLdO_nSo7sNaSWWaylmKykIb48t2YIwq8FYVbeXM4smB1JgoaKzd_dBh54OX5DKYI767TbLeQAk-qDZUkHlQaa-EzOGf8pTQapnxUcfAmrGWBUT3yB_LRFm2QTLTatykG6XrmsEHxb9PCcomwMZZJC8GxmNkN-a5vDFqjyN6gvt8F30-1UYyEHFe45U_6g7y63ZJQBT6uHzk-k3J8wq_qz1HkqfHvXGvTYgQqvWaP8Aq8sX1KYh8fIomLNFLQYd6Z_84x-I9fwGA2hO66uxGQUh18-AcsxFaIEqDrV6H6juVzY_Jxl96u5g2zvEvIJOjgxSWESe8_ASSQRzbEwEjtcPdmjohIFH83hdYjsgjKrKsyxdDTyglh_nlGZBas6rrS6mUGYk9wwE5kfna4NpWhAejPCnBctGFrj4nrgO95XQ1JOMr0w7_DDoFnkEzyDTnzKdT7Nx03iVUSxrZokwYWLBwB21RY_mJinM8MKA0qDAFCyQVQnbGsd0LTT50ZPi5wUtBe1jz7HcTDcCBm9-Cx3R9DdLpJBiHr68-qKZVpIK98APUX3kfndCpKUmlIc4ipY5N-t_6U_MpQEBCi2LnS3eh7QiE_LLf3onfaDq_kCYYK88gF4kvxUYVG2ZDrHUm9pPPhx_YYX4fmdNITIrszJQsFBo53KYgjwGryOSrk2JY20xcOoxZIF42nSMe2_u_Pg3Ri6DSsMlz7G4OBzyQXfwPFEdveoiEv-FCebCGP18Dm9edL-clHOimQjU8esOwtsQWpv2cLfv4N5O228UDscimQSmMgMB0PYeu_Mcu27YWGAnmsHNU_uykzKCdQS0zvfCppAlwhtFLhZdlUstRHrZiqAAUKYskqBECpZdRhNVAKcECkL9HYLnCtGD-kY59z4wiAUm84llJjwy79SQMFKRmHZJ93rscYQ8Oj9eBh30mFBW0ECk3DyX5FzH_9LPw0u06580niLzVI37vQFCeZk0TBJDalkpwrDfwDpJkIRHe-02Kiik0QgL_DXXPUVZ1bjc-ijy3Dh2fJsG7Xq5jV5iVR-YYgFry5x7Fo8wSnTl1flmG8dWeqXtK6X2675TsR7TUHmWVfeumlO3NXuUNY_28bG0m81IdRCfcCfDxBKFIbqUlsth-XIiQrXGassByD1pGzOvdRlGXAMeGY_uXLxeg65XWGOo5f6w2-CVZo55Ng1dkpo6Z8PKSjxtWOmYOJxIvv02BwixIBHiRRkd3hGENpOvhqrsDsJm0EhW6FC25Y7cJauLaDpAoKwS3NBs9b8TGTTLdYfom7e0ULIkO_EWn6pt-SWQqpm9JAU08fvLSpjOIMOyYohVEghwwRDA5F4kqMaEzDvhe5Mf1XsTPZ7mQcYQ1CCOIx3V4ZzD6pZyrdTJiHYZR7O4e11jk8XwgVxTm1Zk9MldF3gM0re-tSE1rT6szaycV8kVp0uFtLx5jzWUfJlDO4NTh2eEoDf4yVNOHn1VfxLNwFoZ3E3RmCiB_kuQN8t1qGcHVY-OKCAzTFNoWY4_wPbG9v77OgPJ4KgP4yh-o7G2y4zHbTG05JvmxE6Ab4gKj_JxdK53PWmU9beOo5exqgQYm65ieF3V4KopKng3PNRLcUiBzgdU4VAAwHCsO67gK256PrQi7SZU39k9gKbuBZTxyl2dg49Q0M0sttoaSLW33cQ6-Bjbw9fpf2g85xL6zgTJaRwKt7G1kTZEY2srSC_m05Ni37CCy2Ezpm8A1a3qU6SeNyjOLmn4AWN0RfC2KNM89vzl0BWkRkhrP-OGyj1YUa1wPA4blE_Jzs_xzkkJibWJ74Rwyfiw-UymnXNV6EoqOIo6Ik1kWZV6xtlImktq1hsGldgPt01CPhgS9ii35ChbmtZ2xDXamu3BCGspDubvsSa6PCh_Z3UNe0swkZyulx5Q0E9fWJi0fPSEiqDjC392XHalx3ra2US7go7YRaadBNeQ3oKY9mDsym5oRCKQ57q1vEmbKvuFbIv_EpkfZ8Pge-ioTmM19AKQaG4rCQb3fZX4X_uAmZKv3-w-25fr-524135CGiD_k-HGY2icRJWT9nWcAVcus7ts07XCv2c0N653gQe4ryybM_JLk5hp93GknAYln45hrxQoXB5Ck3PESPdrzc2AC6elMFCh4NhsGmoFuh6oLZACDzkN7BSXyRPDnKWP6RqH5_kWJ7GDWwswapbHUV7lt3JWLwFDPpoe4iKXOze0u5a1hOrx52O6ZefTD29qcEI-vK5f3_CTfqa8YGQ7OLjuvTEwH9NM4bgjGX9FC5a_c-7Xcq4My3TA0Y6UZWmQZMcloGIF1xRTr0mHk48hWgPKm68vhLrJQn5I-wry-vkFo1o5F23Jyb0hCeW4tdQl0u1CcHxR4zVs0FYeg0mFasGy1icTwthn1I5Jweh0gdGVoI_o2_0tLffj2rVL23czsyZKAykbrqswWNIkRSxCeqImsZALfAfdP1JQA7E1T7T-TCLb3DVBWDm82QgeJRnUBdLtNjNuHZLhAbw1wWEZMeU9yDOOi_zGZRiwsCqPY7k6b2ZMkagmvmxlaQxIVB6Y_pn7Psl27GEF6wqnHJPFUoLO0ZBeg0KGIhzeBjCp-qvksKg-hHH5ciTZWA4SaHkISAzJgFHx0VOMW7G9d4DgCEVzcPVQxOhJUF9zkGXQU1OwUz8apo0A2yERmEd0EAOIIitIqbhOsKyCpqIttuVXsHufsWd_T_Z7gDHEd9jvzoA0D1Sr6OGM2qjtT9B8EGvpTwAF8tCdtJdt53nvbllP3uTd5TLOlg8V0SQacnMkUEWvpJeWNs34MvNQEJlpVf2KENB1iukgCka6G_cd_uA0Bcz6zZn_bKGjLi438tGyhFn-PLZY9jsaa9lYbcLyNwGqtIjopywsB7uh9e019sNTA55Wo3Gy98A6oG59nwO1TUyoixIHYaKGbVmvkygVWHwHdUrPxagiXhfDhldPzFYTLIsczYBmXo3IARK2P5D2U7gVuOG_MhyQ&cid=CAASEuRoA4Fyqn5ty7sKZIY2Ks4sVQ&rfl=1%2Chttps%253A%252F%252Fmobilesyrup.com%252F%240

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e38ff2e0af36de2ed100a603ad1c77bb1649ee37475a4d41ad54b0d21a83f288

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24947
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6C4C 42 B
63 B 40ms
38ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BRKKROI5ZzfDTeYgIX2ti3uJ3701idyhNUjM-YcsHHwqOF28Ip0L_YtjVCwA1w_x2L9Ma1795VefgjLhZpLDFtBVxZzFylyUC4dBezK7Z1A9X-X20

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 6C4C 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:46:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 103
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:46:44 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6C4C 123 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:27 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225346277716"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:27 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 6C4C 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:48:16 GMT

GET
H/1.1 200
OK event.gif
referrer.disqus.com/juggler/ Frame 2FDB 43 B
295 B 140ms
106ms Image
image/gif 151.101.12.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&integration=wordpress%203.0.19&load_time=884&event=init_embed&thread=8631453439&forum=mobilesyrup&forum_id=318046&imp=52pqot51pgrnmo&prev_imp&thread_slug=google_removes_nine_popular_apps_that_stole_users_facebook_passwords&user_type=anon&referrer=https%3A%2F%2Fmobilesyrup.com%2F&theme=next&dnt=0&tracking_enabled=0&experiment=network_default_hidden&variant=fallthrough&service=dynamic&promoted_enabled=false&max_enabled=false

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=mobilesyrup&t_i=818895%20https%3A%2F%2Fmobilesyrup.com%2F%3Fp%3D818895&t_u=https%3A%2F%2Fmobilesyrup.com%2F2021%2F07%2F05%2Fgoogle-removes-nine-popular-apps-that-stole-users-facebook-passwords%2F&t_e=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&t_d=%0A%20%20%20%20%20%20%20%20Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords%20%20%20%20%20%20&t_t=Google%20removes%20nine%20popular%20apps%20that%20stole%20users%E2%80%99%20Facebook%20passwords&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Content-Type: image/gif
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block

GET
H3-29 200 html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 6C4C 176 KB
61 KB 20ms
6ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2f126a8957c32db99e94d1bf7c9ed09fcd38ba99bd632ebd048f01f9c5f9c9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 16:18:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9001
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62241
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:47 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jul 2021 16:18:26 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/ Frame 6C4C 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cn-F0noj-XaJ7Wl6i0Gro6v6W9GyonEcwilRbdlYWk666g02wK9_FXlu9OLTelvviO2CSTYP65JPxBp94bVCTsUJkU9DZ_88eeErmuj9IzS4DrHv7Odo6ECvWVYu-m7BnvImZlOx3lNIdy9TfXG0LLlA0log&dbm_d=AKAmf-B68ZF5kkaaxMbZ4SMPfc68h91O52EhOBiQEN34P6GieSostyfQF-d5UiKMlUzixhZzeNL8PhwcBy34gSJBIyX9sBPWjnwUYOqK9QTza2PiLdO_nSo7sNaSWWaylmKykIb48t2YIwq8FYVbeXM4smB1JgoaKzd_dBh54OX5DKYI767TbLeQAk-qDZUkHlQaa-EzOGf8pTQapnxUcfAmrGWBUT3yB_LRFm2QTLTatykG6XrmsEHxb9PCcomwMZZJC8GxmNkN-a5vDFqjyN6gvt8F30-1UYyEHFe45U_6g7y63ZJQBT6uHzk-k3J8wq_qz1HkqfHvXGvTYgQqvWaP8Aq8sX1KYh8fIomLNFLQYd6Z_84x-I9fwGA2hO66uxGQUh18-AcsxFaIEqDrV6H6juVzY_Jxl96u5g2zvEvIJOjgxSWESe8_ASSQRzbEwEjtcPdmjohIFH83hdYjsgjKrKsyxdDTyglh_nlGZBas6rrS6mUGYk9wwE5kfna4NpWhAejPCnBctGFrj4nrgO95XQ1JOMr0w7_DDoFnkEzyDTnzKdT7Nx03iVUSxrZokwYWLBwB21RY_mJinM8MKA0qDAFCyQVQnbGsd0LTT50ZPi5wUtBe1jz7HcTDcCBm9-Cx3R9DdLpJBiHr68-qKZVpIK98APUX3kfndCpKUmlIc4ipY5N-t_6U_MpQEBCi2LnS3eh7QiE_LLf3onfaDq_kCYYK88gF4kvxUYVG2ZDrHUm9pPPhx_YYX4fmdNITIrszJQsFBo53KYgjwGryOSrk2JY20xcOoxZIF42nSMe2_u_Pg3Ri6DSsMlz7G4OBzyQXfwPFEdveoiEv-FCebCGP18Dm9edL-clHOimQjU8esOwtsQWpv2cLfv4N5O228UDscimQSmMgMB0PYeu_Mcu27YWGAnmsHNU_uykzKCdQS0zvfCppAlwhtFLhZdlUstRHrZiqAAUKYskqBECpZdRhNVAKcECkL9HYLnCtGD-kY59z4wiAUm84llJjwy79SQMFKRmHZJ93rscYQ8Oj9eBh30mFBW0ECk3DyX5FzH_9LPw0u06580niLzVI37vQFCeZk0TBJDalkpwrDfwDpJkIRHe-02Kiik0QgL_DXXPUVZ1bjc-ijy3Dh2fJsG7Xq5jV5iVR-YYgFry5x7Fo8wSnTl1flmG8dWeqXtK6X2675TsR7TUHmWVfeumlO3NXuUNY_28bG0m81IdRCfcCfDxBKFIbqUlsth-XIiQrXGassByD1pGzOvdRlGXAMeGY_uXLxeg65XWGOo5f6w2-CVZo55Ng1dkpo6Z8PKSjxtWOmYOJxIvv02BwixIBHiRRkd3hGENpOvhqrsDsJm0EhW6FC25Y7cJauLaDpAoKwS3NBs9b8TGTTLdYfom7e0ULIkO_EWn6pt-SWQqpm9JAU08fvLSpjOIMOyYohVEghwwRDA5F4kqMaEzDvhe5Mf1XsTPZ7mQcYQ1CCOIx3V4ZzD6pZyrdTJiHYZR7O4e11jk8XwgVxTm1Zk9MldF3gM0re-tSE1rT6szaycV8kVp0uFtLx5jzWUfJlDO4NTh2eEoDf4yVNOHn1VfxLNwFoZ3E3RmCiB_kuQN8t1qGcHVY-OKCAzTFNoWY4_wPbG9v77OgPJ4KgP4yh-o7G2y4zHbTG05JvmxE6Ab4gKj_JxdK53PWmU9beOo5exqgQYm65ieF3V4KopKng3PNRLcUiBzgdU4VAAwHCsO67gK256PrQi7SZU39k9gKbuBZTxyl2dg49Q0M0sttoaSLW33cQ6-Bjbw9fpf2g85xL6zgTJaRwKt7G1kTZEY2srSC_m05Ni37CCy2Ezpm8A1a3qU6SeNyjOLmn4AWN0RfC2KNM89vzl0BWkRkhrP-OGyj1YUa1wPA4blE_Jzs_xzkkJibWJ74Rwyfiw-UymnXNV6EoqOIo6Ik1kWZV6xtlImktq1hsGldgPt01CPhgS9ii35ChbmtZ2xDXamu3BCGspDubvsSa6PCh_Z3UNe0swkZyulx5Q0E9fWJi0fPSEiqDjC392XHalx3ra2US7go7YRaadBNeQ3oKY9mDsym5oRCKQ57q1vEmbKvuFbIv_EpkfZ8Pge-ioTmM19AKQaG4rCQb3fZX4X_uAmZKv3-w-25fr-524135CGiD_k-HGY2icRJWT9nWcAVcus7ts07XCv2c0N653gQe4ryybM_JLk5hp93GknAYln45hrxQoXB5Ck3PESPdrzc2AC6elMFCh4NhsGmoFuh6oLZACDzkN7BSXyRPDnKWP6RqH5_kWJ7GDWwswapbHUV7lt3JWLwFDPpoe4iKXOze0u5a1hOrx52O6ZefTD29qcEI-vK5f3_CTfqa8YGQ7OLjuvTEwH9NM4bgjGX9FC5a_c-7Xcq4My3TA0Y6UZWmQZMcloGIF1xRTr0mHk48hWgPKm68vhLrJQn5I-wry-vkFo1o5F23Jyb0hCeW4tdQl0u1CcHxR4zVs0FYeg0mFasGy1icTwthn1I5Jweh0gdGVoI_o2_0tLffj2rVL23czsyZKAykbrqswWNIkRSxCeqImsZALfAfdP1JQA7E1T7T-TCLb3DVBWDm82QgeJRnUBdLtNjNuHZLhAbw1wWEZMeU9yDOOi_zGZRiwsCqPY7k6b2ZMkagmvmxlaQxIVB6Y_pn7Psl27GEF6wqnHJPFUoLO0ZBeg0KGIhzeBjCp-qvksKg-hHH5ciTZWA4SaHkISAzJgFHx0VOMW7G9d4DgCEVzcPVQxOhJUF9zkGXQU1OwUz8apo0A2yERmEd0EAOIIitIqbhOsKyCpqIttuVXsHufsWd_T_Z7gDHEd9jvzoA0D1Sr6OGM2qjtT9B8EGvpTwAF8tCdtJdt53nvbllP3uTd5TLOlg8V0SQacnMkUEWvpJeWNs34MvNQEJlpVf2KENB1iukgCka6G_cd_uA0Bcz6zZn_bKGjLi438tGyhFn-PLZY9jsaa9lYbcLyNwGqtIjopywsB7uh9e019sNTA55Wo3Gy98A6oG59nwO1TUyoixIHYaKGbVmvkygVWHwHdUrPxagiXhfDhldPzFYTLIsczYBmXo3IARK2P5D2U7gVuOG_MhyQ&cid=CAASEuRoA4Fyqn5ty7sKZIY2Ks4sVQ&rfl=1%2Chttps%253A%252F%252Fmobilesyrup.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:46:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 92
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:46:55 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 6C4C 22 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

598a6c545ec2b27cf7388041cb424a0f4ecc1884dc06e37781b927fbd3cd58fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 311
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8676
x-xss-protection: 0
server: cafe
etag: 11618055936852703379
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:43:16 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame E919
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExPakPqnJGFEYuHdeFrGvo&google_cver=1

43 B
894 B

112ms
111ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExPakPqnJGFEYuHdeFrGvo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjFxtiZATAB&v=APEucNW6Zuuc5lBLIIci_Q4N3LWcGsc3OkLM4E0W5xQW91Vr7u962DQBmU2akYiVNehOY-RWT5z9ZvMR2ti3XQfCADEOpFUHwGrVv4v8LnAn-rmCgiRbboVCBre8y9H5V7J_O_2I8KKD56d5s9H-vqj8JPYeKjfr316iCsD093YMTnjswOe6d-c
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:27 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 05 Jul 2021 18:48:27 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExPakPqnJGFEYuHdeFrGvo&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame E919
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YONT.uuebcUg9L1Ytyx5NQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExPakPqnJGFEYuHdeFrGvo&google_cver=1&google_hm=2

43 B
894 B

62ms
62ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExPakPqnJGFEYuHdeFrGvo&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjFxtiZATAB&v=APEucNW6Zuuc5lBLIIci_Q4N3LWcGsc3OkLM4E0W5xQW91Vr7u962DQBmU2akYiVNehOY-RWT5z9ZvMR2ti3XQfCADEOpFUHwGrVv4v8LnAn-rmCgiRbboVCBre8y9H5V7J_O_2I8KKD56d5s9H-vqj8JPYeKjfr316iCsD093YMTnjswOe6d-c
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:27 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 05 Jul 2021 18:48:27 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExPakPqnJGFEYuHdeFrGvo&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame E919
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEN1nnKFSqMCKliSWn_W5LKU&google_cver=1

43 B
1004 B

17ms
17ms

Image
image/gif

37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEN1nnKFSqMCKliSWn_W5LKU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjFxtiZATAB&v=APEucNW6Zuuc5lBLIIci_Q4N3LWcGsc3OkLM4E0W5xQW91Vr7u962DQBmU2akYiVNehOY-RWT5z9ZvMR2ti3XQfCADEOpFUHwGrVv4v8LnAn-rmCgiRbboVCBre8y9H5V7J_O_2I8KKD56d5s9H-vqj8JPYeKjfr316iCsD093YMTnjswOe6d-c

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:27 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 5ed1ba8e-ca7e-4556-926a-b7d8bf9d8e2e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEN1nnKFSqMCKliSWn_W5LKU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame E919
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

170 B
188 B

17ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:27 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 5d81623e-568f-4e71-9e5e-e96bc260a749
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4ECD 0
23 B 57ms
42ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 18:48:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 300x250.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61437457/20210611025929124/ Frame 9A99 41 KB
10 KB 14ms
14ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61437457/20210611025929124/300x250.html?e=69&leftOffset=0&topOffset=0&c=6O6n30wsbO&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8abe2986c6baec432502499e66aa9b64ba9fb5020ec1a63041e81b4b22f68e2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61437457/20210611025929124/300x250.html?e=69&leftOffset=0&topOffset=0&c=6O6n30wsbO&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9907
date: Mon, 05 Jul 2021 18:48:27 GMT
expires: Tue, 06 Jul 2021 18:48:27 GMT
cache-control: public, max-age=86400
last-modified: Fri, 11 Jun 2021 09:59:29 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6C4C 0
24 B 48ms
48ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssR9J1jDX48sNtjB41HI2W0pa6NYOWo89ZGFGDImY1G6uvijDrWPIGgwSb7eeRNH53jfvHGhXLEayAUQHT2mi2KeTog2zATFbmOMJKw1O-gtxi2bJMFr6YVQcvrOWS7klrgkMIOLU1f6M_DXd_rqTxwLQKMPNW_KOWEXONh3KI2kpLnYAnwsXNm704PtvVNTvwbtKa-_W5JQwYQF9ap2n8Gs86kU7ujluEQU6-ug2iHLOQaZpJQKYuikKCBoOsVLm4kpEIF3-55J4xjEryVvg5Qju49yfF1GS4TFCR-Dxq66nq134AOQURlucPlR55KcIYysi_Mh4lDtzJFJRVx4DdvaakVFASCNcSbAqd4nMTG-wFux6MKG1tqF_cFK-s78RUxmaCKtzlN07YcLrY7W2b6ufhiewXzbA-oCNmfTF4b0rirSDC3e05XUUIIbZWlgryhwz_GhSE_3-i9AJFgOq_MHax1vQcIRVs432dcbYbZabYoXodj-B6cOlDJDX6JCcstnWE-oJzjFsy9cyNAlvDI8JJrlNLNIO85DqSJU68YOnxnuXsOwq_uc43WeTmSseVe3B87OpzRSgLESqdAdz59hrtTwQStZd_Ln8H79eTpjIBUqAOMNnaOIR-yCk-U7s5LjK29hPayuxhG3z4YBswHVeJg-141VDaJjHIgDpypF4TdEDm9cRT-NmKnszhqy_HsiLxzcfLLKs4rMi3P7AoBXuszZDroRaT9HjZmFXYhLfLbJQIXl3y703QvhUIRT9ALyiQvYlzgWSUK-lZOESu7frsbAKTkCBybtBEViDaZhVXtGjs_ZKKqCfewV5C5BAR2AdHgYdrEK_Q8S88pAw0IfQdqkFflXIu5DKhjHXN5iXo4sSF99FH1RjAauRuWBgg7Q6PDjqxc9dINrEA7rjuuunn0943HE-auNU8ALAHgdaSbSIWzjESgJLCacQVtMvqap419mUFWyb1q5ymULiwQFQolgQsIVxhXi5JNNGXx46Pg9Svq3lADLPi4zj-WveE-ZpjauDYyRR4n9Ek-2-rlbxzSSdOe8EweFi7ScklFeCO_LFemUcq7LoN8xmOrLEMIy-VoWLKwss0A1EXgg_qDymwBIzAdQe8yVZk9kcl6yxqpdBzwlPP9M8wkPEt9uwrVGLcRMu4WMBIRqFrgXwfTG4PnYD9sZ0A2u4foJMo&sai=AMfl-YS7j6P_qb8hml56USpJd2VfFE37Nip6DV4I5HX3s8gtJQvJ4dKnM8vsDkTuU3ON8sSpmSs93YCLXxJONnE_xfUn9Xn0jugsXOrunpCgwyw1LuH0aLMz5PiOLdeeou3PHv7670jGiS1ws23kCZCo-vdSN0GQDQ&sig=Cg0ArKJSzP5RkMg92MAUEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=107&cbvp=1&cstd=98&cisv=r20210624.37855&adurl=

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 05 Jul 2021 18:48:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6C4C 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 09:09:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34710
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Jul 2022 09:09:57 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2429 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 05 Jul 2021 08:59:18 GMT
expires: Tue, 06 Jul 2021 08:59:18 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 35349
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 36F4 22 KB
8 KB 8ms
7ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 05 Jul 2021 11:22:34 GMT
expires: Tue, 05 Jul 2022 11:22:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 26753
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame 9A99 110 KB
38 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61437457/20210611025929124/300x250.html?e=69&leftOffset=0&topOffset=0&c=6O6n30wsbO&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61437457/20210611025929124/300x250.html?e=69&leftOffset=0&topOffset=0&c=6O6n30wsbO&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 16:18:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9000
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jul 2021 16:18:27 GMT

GET
H3-29 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 9A99 60 KB
24 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61437457/20210611025929124/300x250.html?e=69&leftOffset=0&topOffset=0&c=6O6n30wsbO&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61437457/20210611025929124/300x250.html?e=69&leftOffset=0&topOffset=0&c=6O6n30wsbO&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Jul 2021 18:48:27 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A1E1 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BCKyq-lPjYNH4PNTE7_UP0eCWyAYAAAAAOAHgBAI&bg=!3d6l3prNAAYo4NJEKOA7ACkAdvg8WkmZ9oix4jH2V7Jokk_m13enrhx8yNLIZy8aRJDnJ_CQrEkDkQIAAAE-UgAAACxoAQcKAHKPRJXfmNRU5OFTUe2mBiAsIgcGPLTbaIJGsTQGMAGtpC0nb5XkK6pr7UWhN1nuxEI3RGuWiICAGNgATpLeqXsL1Z-3GrEcSu5WzTV9MaNMy3TDNXo-KHi5kguWDrScyiRhhIqC4wzoL8q15aMEbr5MFyaZAtIuWRPzRFJe6PyfPPxFa96BzfeFtcSRIiCtvAqH0nXrjxq4vWpL5cyEVUGVt0G0Sgq1nn5fngLciELMJjTgToB7rsUP1sZvfTaF8-qe1bDaZQoe_DyXwigfvcgyBIDaKJI0xTVkYEOqinDFdVRke3TlA3xoqFNwvDBbgPJRpT5uBO8ZMpxyS25hICl2CTMsi1sxx8wpRW4a5tPC9rCaDDj_AZ13AO8py4raCd79ONSgyJw3sn8GHfRfKsAMX-kuohezwOLdwxT7TUMbNwR0bHH97wWA4St3bCxU46GtpF4iRMEaoKxnU_Vnv4hJ4Y55DBtSIewmj1dsz4KdYuUstGgvR6Cl_nr9sQ5eBwvJnRa6p83bG1nhlVTaLLvzrVm5tZG698K9JcVNRjokk-zXgDWgvPxjYFSwNogJdZ3Ak6GVhMXZczCeLnDGnvJgTUxmdJKOqW1wgub5q37oruvdBqniW24OFODVEPGBiSeoHInICMlnjKVi1-agNCCzXtCve3fMV9gFLa4YGiQvBggO2tKpdM_mKb5XdqCs_KLFczF-J1OHFcvhYUoFdZANXx_dKEucvFiC8CltG-aQMreSH35hgee2QpU0mSzVsB9Ki096YtVSCCEFAKtaYKwoxm6wLS_7VC7L1twVHNjdKnnJyWZBZ4cZG8aUE-6G6Y8uPgsAEOT9gO4wJ8_gzCCcUlyHqNT0Sm9stZqJppekiwl0lW3hx-sFK2v8kVrH_251HRkQWK0IJ35WxAwwgVuwMa2D2QWVt5uxlpU1a7rmPi8vbSPhM1I-IyrtuMtrz3ZxJQrnyHWM2E0uAd3LsEFfdj1ODg9loG2R-udI9dwgbUpI_wM6P_v9v7iHZgErf1i4wIKZQMGUCKKRDZ5ERpDA1X5FOZjIGxhhN3AbkIkvedGcAyjV80bbqRVpTua7kGOScdTdgIUh4dMT4GWP9QfiXqK4aLalGQ

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9D65 42 B
64 B 45ms
45ms Fetch
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstbU5tHVLy5_cKEyJhHVfYkXNZ_SqSDtYbJ1ufe5QGg51T6MsGWQtBbp_5Mjl0iVNY6RWmZTROtkN73zR38H28lXhDgWUxCHRQ57QNh2L4TAkcW24pBlz0rfNSggw&sai=AMfl-YQq01xAcVxBBiCOVxlZ8eeXV4oQYBwkaV8mxvPqorqYBxvvnS1Xl2T_PuF4GrOzdwe1RVlVUj8NeNLxwn1aygk0m5wp0B-UgNC9QM2FRsIwZv4nARX9jHSxhi0&sig=Cg0ArKJSzC6dZUlhbFE8EAE&cid=CAASEuRopq5yF5G0L09V3gAxAPg7cw&id=lidar2&mcvt=1019&p=145,315,395,1285&mtos=1019,1019,1019,1019,1019&tos=1019,0,0,0,0&v=20210702&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2406243525&rs=4&met=ce&la=1&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1625510906251&dlt=58&rpt=632&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2429
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPL50CnSkCDICBxiYWsmQ6gPMigFWo_3kCYwtEH...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU9OVF93QUNjd2VyZWdBQw&google_push=AYg5qPL50CnSkCDICBxiYWsmQ6gPMigFWo_3kCYwtEHtBRhCoBtif6Nrl49nVtceWZ-7kMgiHKCOcanfeQ9M1HxpIioXvb95nFc

170 B
188 B

25ms
25ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU9OVF93QUNjd2VyZWdBQw&google_push=AYg5qPL50CnSkCDICBxiYWsmQ6gPMigFWo_3kCYwtEHtBRhCoBtif6Nrl49nVtceWZ-7kMgiHKCOcanfeQ9M1HxpIioXvb95nFc

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU9OVF93QUNjd2VyZWdBQw&google_push=AYg5qPL50CnSkCDICBxiYWsmQ6gPMigFWo_3kCYwtEHtBRhCoBtif6Nrl49nVtceWZ-7kMgiHKCOcanfeQ9M1HxpIioXvb95nFc
Date: Mon, 05 Jul 2021 18:48:28 GMT
Server: Apache
Connection: keep-alive
Content-Length: 390
Content-Type: text/html; charset=iso-8859-1

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 2429
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEMJ6bXfhOvQvdTpDNdOl0vg&google_cver=1&google_push=AYg5qPKjjkcb_vbECPlkw_bAu97gPnbkSGpN3fyqu5OfbyYvCNF-z8a9BjekgzW9rINFv7UxR1C-t5SqzIehbOK_-GZbBWOYa8NG&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMJ6bXfhOvQvdTpDNdOl0vg&google_cver=1&google_push=AYg5qPKjjkcb_vbECPlkw_bAu97gPnbkSGpN3fyqu5OfbyYvCNF-z8a9BjekgzW9rINFv7UxR1C-t5SqzIehbOK_-GZbBWOYa8N...

43 B
429 B

181ms
179ms

Image
image/gif

2606:4700::6812:d05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMJ6bXfhOvQvdTpDNdOl0vg&google_cver=1&google_push=AYg5qPKjjkcb_vbECPlkw_bAu97gPnbkSGpN3fyqu5OfbyYvCNF-z8a9BjekgzW9rINFv7UxR1C-t5SqzIehbOK_-GZbBWOYa8NG&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKjjkcb_vbECPlkw_bAu97gPnbkSGpN3fyqu5OfbyYvCNF-z8a9BjekgzW9rINFv7UxR1C-t5SqzIehbOK_-GZbBWOYa8NG%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 66a2c4876f664e8b-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 98
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 66a2c4862bfc4e8b-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMJ6bXfhOvQvdTpDNdOl0vg&google_cver=1&google_push=AYg5qPKjjkcb_vbECPlkw_bAu97gPnbkSGpN3fyqu5OfbyYvCNF-z8a9BjekgzW9rINFv7UxR1C-t5SqzIehbOK_-GZbBWOYa8NG&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKjjkcb_vbECPlkw_bAu97gPnbkSGpN3fyqu5OfbyYvCNF-z8a9BjekgzW9rINFv7UxR1C-t5SqzIehbOK_-GZbBWOYa8NG%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2429
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEIsRb6hBV16o9vgF7fSIYxc&google_cver=1&google_push=AYg5qPKQ-9pK2fRLPmMTWGeaQEidJEygBf2MpzkjchcDK9ygjad1ziUYQimPavhmNT4unF13XzQXEk-dNXNI_ibZ3rCC05h9wW8
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=DF1F1FFB15B3482B9509E43C6B95C8A8&google_push=AYg5qPKQ-9pK2fRLPmMTWGeaQEidJEygBf2MpzkjchcDK9ygjad1ziUYQimPavhmNT4unF13XzQXEk-dNXNI_ib...

170 B
188 B

19ms
19ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=DF1F1FFB15B3482B9509E43C6B95C8A8&google_push=AYg5qPKQ-9pK2fRLPmMTWGeaQEidJEygBf2MpzkjchcDK9ygjad1ziUYQimPavhmNT4unF13XzQXEk-dNXNI_ibZ3rCC05h9wW8

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 05 Jul 2021 18:48:27 GMT
x-content-type-options: nosniff
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=DF1F1FFB15B3482B9509E43C6B95C8A8&google_push=AYg5qPKQ-9pK2fRLPmMTWGeaQEidJEygBf2MpzkjchcDK9ygjad1ziUYQimPavhmNT4unF13XzQXEk-dNXNI_ibZ3rCC05h9wW8
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 154
expires: Sun, 04 Jul 2021 18:48:27 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 2429 70 B
264 B 112ms
111ms Image
image/gif 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEL8195KGbaYBQyhl_NbTnSg&google_cver=1&google_push=AYg5qPJplqgxxPwY_OcOwjzh2nI64JoCD8GA9at5G64WfxxPlW32alyWdMfea5AmJb66Qgwxkj5iNd7I28k-iPpUQtp23nxAayXN
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:27 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 2429 0
135 B 31ms
14ms Image
text/plain 34.96.105.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEE2sIQ4ZAkGNVkcUWp_K_Go&google_cver=1&google_push=AYg5qPLxmsG-dGB7gNxZqGT1yoD2d6q-bqOeK50BEU2BxJGfo2wc2qjnj05bnt4-v-25rN3Bc0XqBi3Rru_AnuSQdj8LVMVhMB69
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:27 GMT
via: 1.1 google
alt-svc: clear

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2429
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEGww_DzNzkDAscffLd6xtjk&google_cver=1&google_push=AYg5qPIdoAww3H-aTEVSmQs5pOSoy3pOuNT2wZ1WPkKUiXZamWerFrd9kzIK9RYoC5tO2hXF3qt9_OKrg3ChFbd2jmmeyp-8dSFY
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPIdoAww3H-aTEVSmQs5pOSoy3pOuNT2wZ1WPkKUiXZamWerFrd9kzIK9RYoC5tO2hXF3qt9_OKrg3ChFbd2jmmeyp-8dSFY&goog...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzc1NTc0MDMwNTMwNTUwMjY0OQ%3D%3D&google_push=AYg5qPIdoAww3H-aTEVSmQs5pOSoy3pOuNT2wZ1WPkKUiXZamWerFrd9kzIK...

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzc1NTc0MDMwNTMwNTUwMjY0OQ%3D%3D&google_push=AYg5qPIdoAww3H-aTEVSmQs5pOSoy3pOuNT2wZ1WPkKUiXZamWerFrd9kzIK9RYoC5tO2hXF3qt9_OKrg3ChFbd2jmmeyp-8dSFY

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzc1NTc0MDMwNTMwNTUwMjY0OQ%3D%3D&google_push=AYg5qPIdoAww3H-aTEVSmQs5pOSoy3pOuNT2wZ1WPkKUiXZamWerFrd9kzIK9RYoC5tO2hXF3qt9_OKrg3ChFbd2jmmeyp-8dSFY
date: Mon, 05 Jul 2021 18:48:28 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3-29 200 dot.gif
s0.2mdn.net/ Frame 2429 43 B
68 B 15ms
14ms Image
image/gif 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEPxVAQAFXJu0TMmLDV5YioE&google_cver=1&google_push=AYg5qPIWiGwSAIrZlC9XZyasVLLY7RDVAMT0cY7yDSt9l378qTbZSEHYq4zCTzDzzGcoZH9skXUujPcF-Ew4B5psszg8JsH-pWMRFA

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:27 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Tue, 06 Jul 2021 18:48:27 GMT

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 2429 0
12 B 16ms
15ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JdgoWxw6wSd6wyBt8Yl4lzxvryxHxr1NMLqFl5vyJzrTqnKsaRD4sqbIrMkKuaTM5AsSqGgg

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:27 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6C4C 0
23 B 43ms
43ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 18:48:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 36F4 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c971ec4829376335946d1beaa191f2c64a48e8954b422dea372c2d9029177b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 10:29:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29910
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5747
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 10:29:57 GMT

GET
H3-29 200 OnAir-Bold.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 9A99 47 KB
47 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Bold.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61437457/20210611025929124/300x250.html?e=69&leftOffset=0&topOffset=0&c=6O6n30wsbO&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c284299aeec8595fd3a10dcd2c27022edfda37c815571843a90c45cad18ace95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61437457/20210611025929124/300x250.html?e=69&leftOffset=0&topOffset=0&c=6O6n30wsbO&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:34:30 GMT
x-content-type-options: nosniff
last-modified: Thu, 06 May 2021 11:38:39 GMT
server: sffe
age: 837
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47676
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:49:30 GMT

GET
H3-29 200 OnAir-Regular.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 9A99 47 KB
47 KB 9ms
9ms Font
font/woff2 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Regular.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61437457/20210611025929124/300x250.html?e=69&leftOffset=0&topOffset=0&c=6O6n30wsbO&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c110419995948214e5b16d9d0df8f7d91536cc42783edd90c7fc1810308309ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61437457/20210611025929124/300x250.html?e=69&leftOffset=0&topOffset=0&c=6O6n30wsbO&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:39:58 GMT
x-content-type-options: nosniff
last-modified: Thu, 06 May 2021 11:38:29 GMT
server: sffe
age: 509
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47848
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:54:58 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 9A99 5 KB
4 KB 18ms
16ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c84cbbcab469f51dfd2276c2d9e21a96b940eafc20c236f29f4343493de42722

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 18:48:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4214
x-xss-protection: 0

GET
H3-29 200 60005582_20210611055044150_SOHO_Airpods-Pro_STOERER.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 9A99 5 KB
5 KB 7ms
6ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210611055044150_SOHO_Airpods-Pro_STOERER.png

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13d2b0a4190de3a2b3b4a224a43a766af29d011c163bef4ceee7ea6ddc8fa9f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61437457/20210611025929124/300x250.html?e=69&leftOffset=0&topOffset=0&c=6O6n30wsbO&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 09:58:13 GMT
x-content-type-options: nosniff
last-modified: Fri, 11 Jun 2021 12:50:44 GMT
server: sffe
age: 31814
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5347
x-xss-protection: 0
expires: Tue, 06 Jul 2021 09:58:13 GMT

GET
H3-29 200 60005582_20210225011351604_APP_iPhone-12-Pro-Max_AirPods_Logo.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 9A99 37 KB
37 KB 8ms
6ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210225011351604_APP_iPhone-12-Pro-Max_AirPods_Logo.png

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9cf0ab4bf43f2fa519e175fab2c5f931f67974fb4823cbe9e929638974045e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61437457/20210611025929124/300x250.html?e=69&leftOffset=0&topOffset=0&c=6O6n30wsbO&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 04 Jul 2021 20:17:43 GMT
x-content-type-options: nosniff
last-modified: Thu, 25 Feb 2021 09:13:51 GMT
server: sffe
age: 81044
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37858
x-xss-protection: 0
expires: Mon, 05 Jul 2021 20:17:43 GMT

GET
H/1.1 200
OK postview.gif
portal.o2online.de/nws/img/ Frame 9A99 43 B
609 B 1040ms
9ms Image
image/gif 82.113.101.132
TDDE-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.o2online.de/nws/img/postview.gif?partnerId=O2_DSP_TRA_HAV_14114_PV&mediacode=25118221_4307561_291449281_131466082_-0&ref=25118221_4307561_291449281_131466082_-0
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 82.113.101.132 Offenbach, Germany, ASN6805 (TDDE-ASN1, DE),
Reverse DNS: portal.o2online.de
Software: Apache /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:28 GMT
Last-Modified: Wed, 26 Aug 2020 10:11:24 GMT
Server: Apache
ETag: "2b-5adc50abeeb00"
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 9A99 17 KB
6 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:27 GMT

GET
H3-29 200 u5qa6Bce0_JDlbgkcQuMCffbH_LjsHWDv7QaTzlh7sk.js Show response
pagead2.googlesyndication.com/bg/ Frame 14C9 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/u5qa6Bce0_JDlbgkcQuMCffbH_LjsHWDv7QaTzlh7sk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb9a9ae8171ed3f24395b824710b8c09f7db1ff2e3b07583bfb41a4f3961eec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 13:52:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17785
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13289
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 16:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 13:52:02 GMT

GET
H3-29 200 container.html Show response
8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C667 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mobilesyrup.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 05 Jul 2021 18:48:25 GMT
expires: Tue, 05 Jul 2022 18:48:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/ Frame 3D1E 223 KB
37 KB 7ms
7ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/index.html

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7bf67883867f93d08cbf4eeac0485e641cb9e5b123e18bef046b7c706cffd28

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/17626451119355985920/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Wed, 30 Jun 2021 03:45:32 GMT
expires: Thu, 30 Jun 2022 03:45:32 GMT
last-modified: Mon, 03 May 2021 14:21:52 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 38330
age: 486176
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame C667 0
0 43ms
43ms Fetch
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CGbs6-1PjYLmVHa2O7_UPq_WfsAflto7OYuTK-tnwDdrZHhABII6cjn9glfrwgYwHoAGVz-jxA8gBCakCgbSGQdzmsz7gAgCoAwHIAwKqBKYCT9Cd2tdVAqOHzFcddQl9GE6MY9tntvU7YTatHy45fCtpuJ33SZt6PgqkPonJ64tx9Cz7Q8QGp0APebCUIDvctnu-VgwDeh53Snu9YXsNoFRK_Nv0YGwS3OYrQ2j9ZjHFLJChwubklaX0fgH0C_TK8GeuIu4jNbRw6dQxhi29GUeti6u7fCDDvDgi4bqZAKZzAeC2SmjaSkdZ1uZZ_LTF8NpV2tYEl9L4ib9SnQaMh1tgHNA24QyRvbFLRH2tu0YSVItvzpW8-bJ8YW0v5XWrazxlm1rhaiHSEK_NuwgGwxtPLZpSNT_oOL1LVbi1Y7_ywOpfo12XOH-GnEfFbMHFsTwlkIViWOGW5wxT-OYFECzPuEacF95pKTNZCP5KqAgVr1aTiibMwAT1utTEwwPgBAGSBQQIBBgBkgUECAUYBKAGXYAH07CXDqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBCRhAfSCAkIgOGAEBABGB2ACgPICwHYEw3QFQGYFgGAFwGyFxoKGAgAEhRwdWItMzA1NjU2OTIxOTYzNjkwMw&sigh=L_gbsFTS7Sg
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7FBE 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlyH5sc1G_YvQAoKaNVl5ZBeyVox116ncFtnOHGy86q6-EVpMjR0XWLbVJ8Bnc
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 05 Jul 2021 17:57:41 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3047
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame C667 3 KB
1 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:46:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:46:44 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C667 123 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:28 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225346277716"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:28 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame C667 14 KB
6 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:48:16 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 3D1E 2 KB
595 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:regular,700|Bungee:regular

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2130554153fa8c200d17c28a5c70c3b0cf4bd9b4796d6e431c89c7f99417a1a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 18:11:45 GMT
server: ESF
date: Mon, 05 Jul 2021 18:48:28 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Jul 2021 18:48:28 GMT

GET
H3-29 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 3D1E 16 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:10:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38263
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5866
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 06 Jul 2021 08:10:45 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 3D1E 26 KB
10 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:31:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 06 Jul 2021 18:31:13 GMT

GET
DATA 200
OK truncated
/ Frame C667 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9727f8b82329c78c793902da82f26b56605432a34aebeaad329cbfda33a4340f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 36F4 0
20 B 43ms
43ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B0vPl-1PjYLipI66U9u8Pg4OY2AUAAAAAOAHgBAI&bg=!4-Cl4KTNAAYo4NJEKOA7ACkAdvg8WoFmZx3KLuja8-4gMXBNnyjOMJmxQdeRY0GCg_SkZ5BpF7TX0AIAAACtUgAAAFZoAQcKAFTmqt1UVwvmM9S5vOkrt_h_xLY8WB-OawfDztzYb0xDuBr5KwexpiS1Dn8Q5mSKNHM-zw34SJiXxfy-GoW3eyjY4PmC5dPZ5w1oXF_AJ18upJaZUx6ZAsleERPg83sAUDDPEIUbXFhbU2I3vPPh13t_eqaIApt5m-VY32ubtBFGdDdkyX3VVNVwcPD8elMBoaGLzkCbJpdYNEgPW-PcL3KLa6Nv0Ek-S7Lu6fU7kLXlv5yYEBA39Dw_ccJgqg9p868HYzW2ckU-3SPTVXmauHEHWhFlgRoYrYNxxTg14MH4JTVVJmdf7w90buFHtsvRjd1bvm0BK3rgIRhL09xNO2L6vRsNeoTquV3vCAmR4XCUvFXdV8wi2eF2EhVo4Pi_YUpBWB-ZEu-q-bCtNQMhcwT3_TCD0JVExem4orCRvnO0o7gKuJtypFavvZKW6BkxExfhiqwIoycBkFdUPbw1Ed3Cl_v_wtQtWHa_c7V5ZciHYc9sV9Zpa6ZrRfmUAlvjHpBma_ig2TQaCW4R3OKXAwmUlmlILCn-tXDteeQkTv3Ch8vorN_hvd5bmlnPldYCCSovSuGBFT252mwF7LKpDisnVZdxsTYCHNvocH7YsGGvAoEy4RW1QrzBy96n2rwGzuT-z33DZ47pwH_GIC0hwd3R7kIKoezRa6XtPxfQuRtZNBYm2MB-ReGxb_6GDbYsEH4HI71_7hDlwPiWtwTEVcoAy9L9I8uch1zAKTkh4bKOI8ivZgHGGGOdRwTeA7glH2jk_e8_IPoADj7beB30C5LKh4Qc-uTS0IFMXplWEi3Mr1PYEGK4tO1kISYDfa0Z1AABs_CjOPhsw30DQLpyIZz2wy4p2cvzA3HMXeWqZCgLkJWTsCNITaZXEJbO2kD8ifswCF2Ioc6X8usDkx-Ow-HDdLIs4GjOw8ZZRkSDjC3SORy1gtMmdHorBWkrYdJjtGCFfZiFj2V5CuBf2HKmt-X6EcPhEq-Y2mb18GlJSokFVkLF-WJW3VxWxB59L_c4dewJua1GOo1dlvSQ7Me_eQ434NLz6wqyXIANtgQQElRtow

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7FBE
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

40ms
39ms

Document
text/html

2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlyH5sc1G_YvQAoKaNVl5ZBeyVox116ncFtnOHGy86q6-EVpMjR0XWLbVJ8Bnc
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 05 Jul 2021 18:48:28 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 05-Jul-2021 19:48:28 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 05 Jul 2021 18:48:28 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 05 Jul 2021 18:48:28 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4ECD 42 B
64 B 45ms
45ms Fetch
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv5qf9qf6nIUUJsQQqat-PrY-vGVljoXMi7qM2yyE4f9uFPA6JnZHjNlFaDmD2nb0yffag_wmR9GKtmnmeypOqVr4EsxVSvHJi5e0OISmylN4ttajb3osvLZVIjDQ&sai=AMfl-YQ3QlcYnZULY_WIIH7sAI5MvvxIHPdKcd4T4rVWsSZA6yzr9XjOPnRDOnErg2hduqRN01dkjhKnHcLIYx13V8b3Zpse8kzgUpTae1AqoNRiQoYEAN7s4gXh4oc&sig=Cg0ArKJSzMA7Oykea5SNEAE&cid=CAASEuRo_hc77vuBbQDzoDHVYLarIQ&id=lidar2&mcvt=1024&p=806,1055,1060,1355&mtos=0,1024,1024,1024,1024&tos=0,1024,0,0,0&v=20210702&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=2899332225&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1625510906837&dlt=89&rpt=1&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v17/ Frame 3D1E 23 KB
23 KB 16ms
14ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:regular,700|Bungee:regular

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 06:21:47 GMT
x-content-type-options: nosniff
age: 476801
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23484
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:46 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 06:21:47 GMT

GET
H3-29 200 N0bU2SZBIuF2PU_0DXR1.woff2
fonts.gstatic.com/s/bungee/v6/ Frame 3D1E 17 KB
17 KB 26ms
24ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/bungee/v6/N0bU2SZBIuF2PU_0DXR1.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:regular,700|Bungee:regular

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b00176dbbd9e4c77629b36fae58d076c8c3b55754e7c2dd3a6e4986e7ec9c37b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 29 Jun 2021 10:52:10 GMT
x-content-type-options: nosniff
age: 546978
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17268
x-xss-protection: 0
last-modified: Tue, 01 Sep 2020 03:47:49 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jun 2022 10:52:10 GMT

GET
H3-29 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v17/ Frame 3D1E 22 KB
22 KB 29ms
27ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:regular,700|Bungee:regular

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 29 Jun 2021 13:10:17 GMT
x-content-type-options: nosniff
age: 538691
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22992
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:12:12 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jun 2022 13:10:17 GMT

GET
H3-29 200 null-leasing-logo-final_white_1.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/ Frame 3D1E 2 KB
2 KB 8ms
7ms Image
image/png 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/null-leasing-logo-final_white_1.png

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62cdccf1ab4b4215586295612a4a2ef96fa490250fa96dbccc565f659cab86ab

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 1004
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1738
x-xss-protection: 0
last-modified: Mon, 03 May 2021 14:21:52 GMT
server: sffe
date: Mon, 05 Jul 2021 18:31:44 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Jul 2022 18:31:44 GMT

GET
H3-29 200 autos_licht_1.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/ Frame 3D1E 6 KB
6 KB 9ms
8ms Image
image/png 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/autos_licht_1.png

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a87352099e9b3946d71f4f73c69f9217ef99278088a177d5eef09df78c11e4ae

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 491177
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5867
x-xss-protection: 0
last-modified: Mon, 03 May 2021 14:21:52 GMT
server: sffe
date: Wed, 30 Jun 2021 02:22:11 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 02:22:11 GMT

GET
H3-29 200 autos.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/ Frame 3D1E 48 KB
48 KB 10ms
9ms Image
image/png 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/autos.png

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c45bfa2dc80f54eb8564aa778a0929a00811168617ee6340cc59f0af48e5cca

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 456929
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49113
x-xss-protection: 0
last-modified: Mon, 03 May 2021 14:21:52 GMT
server: sffe
date: Wed, 30 Jun 2021 11:52:59 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 11:52:59 GMT

GET
H3-29 200 hintergrund_plain.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/ Frame 3D1E 30 KB
30 KB 9ms
8ms Image
image/jpeg 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17626451119355985920/hintergrund_plain.jpg

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

969231fe165a93933d6908d45bfa09c364b66de37160efea47d87d18d7d37bd8

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 470850
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30604
x-xss-protection: 0
last-modified: Mon, 03 May 2021 14:21:52 GMT
server: sffe
date: Wed, 30 Jun 2021 08:00:58 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 08:00:58 GMT

GET
H/1.1 200
OK Cookie set 2098550-15.html Show response
smarttag.rubiconproject.com/a/23502/379250/ Frame C1DB 2 KB
2 KB 222ms
157ms Document
text/html 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://smarttag.rubiconproject.com/a/23502/379250/2098550-15.html?&cb=0.9273429485836502&tk_st=1&rf=https%3A//mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=379250_15&rp_secure=1
Requested by: Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/23502.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 90326cd81104fe9cfbafc9d4991f1700c8ade20860442da7e83ca3769686c6c8

Request headers

Host: smarttag.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://mobilesyrup.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: khaos=KQQZ82ZF-9-8U84; rsid=1|AIfsdBUO++vuGxiryvY4NyLgsLINffPD0nJRTZPyMmB0r4WWOQTuL9+eZLvlgeCkRh3C4WPGUmesEFiaAnqRSjT4sl0Fg1EK+hUVPp2REB9Ko2i2DakxOMWpH+S3NzCR; audit=1|hLZGFuTafB3Is/bY9lK5mwZ1csWKyxPo+FyL7wuc7Pr96GjuzVBbGC+JfdKy0Ozhcpj76PKZXj+rlecObOHEYdzpQ7vzkXQ/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

Server: nginx/1.16.0
Date: Mon, 05 Jul 2021 18:48:28 GMT
Content-Type: text/html
Content-Length: 1327
Connection: keep-alive
Keep-Alive: timeout=5
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Expires: Wed, 17 Sep 1975 21:32:10 GMT
Pragma: no-cache
Vary: Accept-Encoding
Set-Cookie: khaos=KQQZ82ZF-9-8U84; Domain=.rubiconproject.com; Path=/; Expires=Tue, 05-Jul-2022 18:48:28 GMT; Max-Age=31536000; SameSite=None; Secure ses15=379250^1; Domain=.rubiconproject.com; Path=/; Expires=Tue, 06-Jul-2021 05:59:59 GMT; Max-Age=40291; SameSite=None; Secure vis15=379250^1; Domain=.rubiconproject.com; Path=/; Expires=Tue, 06-Jul-2021 05:59:59 GMT; Max-Age=40291; SameSite=None; Secure audit=1|hLZGFuTafB3Is/bY9lK5mwZ1csWKyxPo+FyL7wuc7PqlLkir1utWGy+JfdKy0Ozhcpj76PKZXj+rlecObOHEYdzpQ7vzkXQ/; Domain=.rubiconproject.com; Path=/; Expires=Tue, 05-Jul-2022 18:48:28 GMT; Max-Age=31536000; SameSite=None; Secure
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Encoding: gzip

GET
H3-29 200 container.html Show response
8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 8996 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mobilesyrup.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 05 Jul 2021 18:48:25 GMT
expires: Tue, 05 Jul 2022 18:48:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5044 624 B
297 B 18ms
17ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhjljap5MAE&v=APEucNV6EtntELDUvgOsrBPgevoCbS2icc3zSaUEcgxdGA_ZYL6N8sIy_0ROhdiYD9mC2rgqxGclVjxKg7yi7dSeRMTN3_6zauj6V_kw8Ieo7wAQoJu43HCKnsS9xkFTmuuNAtmDr5uoy6nRy3RJswRCivhElh7i6WuoQA74831YZKro56kaxk4

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CNHn4wEQ4JWpAhjljap5MAE&v=APEucNV6EtntELDUvgOsrBPgevoCbS2icc3zSaUEcgxdGA_ZYL6N8sIy_0ROhdiYD9mC2rgqxGclVjxKg7yi7dSeRMTN3_6zauj6V_kw8Ieo7wAQoJu43HCKnsS9xkFTmuuNAtmDr5uoy6nRy3RJswRCivhElh7i6WuoQA74831YZKro56kaxk4
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlYvdiZqbUPB3rwlQXJZutqACZaywc4oqNbmX0QuN16q62yWIFgoBH7TcK-KYY
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 05 Jul 2021 18:48:28 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8996 62 KB
24 KB 47ms
45ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B3k7YHjYvKLv-A2k83sketbBDi-spkJ7cb9xQtcIOXFLwKGYeV6fBudXXQ5qaBAYuk07I2fBTkw_O09lyXKt3LJzSWjNr8FFlMJhkLG6D8dkjtlkldHcAormH7Mb11VkgSono0MhUlSWraErTf010aARuVFQ&dbm_d=AKAmf-BmIZWLFBvR32o1fBF0kYosqy_SxOwQJCPk6wbbC4HBVENMWMx2Px6c0yujNFiOOcYC-7ENApCdrnHdGbmkqumL4uU9flrgbb5ElKhrdJMrDDSKjkfeEvdMYmQAi5TohdZwGmup5gx9O1Kxb4GGusCgYWJtOgjITf3rAfuKVRCgVgn4Xr387kutRSi_NEL-fhaMsy0nSnL3qEwpdcXe_JDaDcUoEjr5HrYbpineFV6wx_SViB1K3a9JAQk_1Pi7O1gO2Pv8lCwOv67Xw3XkzsvAeGu3aLExaLpHEYivxJ3mEdK7oPHULiGkyT1WD27zoQA48ygf1izxv20C9OfnHsqPOOhGqD7PsS3MJS6QqIdyUCxOrug7DQCW8eobixri-VyYKCEvbVGYEHhkkMN-QrpvmEVBR-uZFMnNkUEL4DXTGrAhDEaQXDH4s3idVGXPy9fa9jwANu08bH-crNcfbliK_R1iZ1FAofWttsf_F6IiFvJ-RVXoUK2C-Ii0v4iUPHE4dxqE5MWS5E1JF2HqCSm-NVnNNzrGEOS3VYLzFrgUne5qt0aPD4DcTnsXsbiFirQTJJQQijnKXa_jBBfoKl9PacHCC5pqs6TsEWS61uy5AJabf5EGcfydMkm09YhEETH_gn05F0m0Ie_DPK2ZfzcZxhmjz5xc4XNgsqoFV8aIWCJ0nKSSoloUwyylvkQh-CRr9J-0hjSxkzpJY9y1a5pa_Gg7yEf9_W3pvx0mrg2SWBqcv9iS6DEfW88IIiPvXchkkzIs1NaKetmb7x-RYk8BNbCX1CsDDpsWVVKlkOf0F00GXKELDfHah5t0EjRBpCxnRPPprUtD3bzkLfe7evS03sn3k-8mRyhsg2g8XKrKenQwFRxeqGWv071_adECDUfrLzjTGE_2rkHYkV3Jo5-C-_PCBuyM2AarM1sFIoKtR0t6sagfXFJYRzlVINsyv1aF2p3iPj0LSXH3voFoaF9dUzuIGKLjTDF77C5_veFnC2TUvlhRe3bqvNMbmE2kGFhqjUsvaRHEJw39oQMh8Iv1spANwjfi1IHNch6Szt3NBC9ioHnT66ZuZ03mJvh0yDk_x6BDFmOM6oPIi0dbL5Li1SjuwQz0Ou-x54EhqvOg4jM5sX5fSIi94MTEn2BdbDkaaGB-CkL1m2ymuy49birWa3jfgra6wMOvWpBD_ZU6VnnxSX-EkcBHHE9LHEPJrd8pGuXJqND1iSY7l8MB7yCfuzDb4dkCopbpmgCN6hFvHe7p_yCZCqBl7uQeZYnlWO52dLybRvWm2Y9unXWDSil0mkfFCxhmJzihw_DO_Fs4gq4mbQHf44Paa0YFw4iK9YiY2Ull4APpNYw8xbsYszzwbRmaYh-2R9TnX6KjFQjW8yjgMgnms9A2amy4U9cPnNIzNcRT98odyC5H97tb4EfXZPC56nFHjPaIMqub3b6lik8DSeiDgIOdkZTZsr9NHSLAE-RaZz4Nhz2lIkmB7wF4lKx-96KUIRFTOEtnxFIZjdkDCuuC8HlRsxIzcLOsnE-6PQFmFAYvMxlECSQHpr3bsuvsLnuVutN9buHPvBD5nHkRYnocMYCT8JBg6AR-PhwNRAN93ioQpK9zVBwd0qYmPztp_pOxcOvRxcoj3ofBi7u46ifU2BvYeDwCkg7cbcXvUHJvWwIJspzseuavXlEmAOl1Y0lklTq-qtOTokgXr3pVWWzOGmvC1QZ2JMaq6C2CA1Jo1cP_d4pRJAVvETyVhsYlcEAq0dXIPSTaM3LCdV4RYXOKai8fk-YSc8GBnh2bifCKhLhbg6SZ377Wtmp6sSZ6veSNkrEmALwHJ5_-yUHcDXlUq_MaLElqBM_2JU7jQfi2u1jDgvB9TZkHq30LRd7cYfKbeGKa_3KA3Vu1EGJH6Nz2h_7cOu6CdWQpDjtk7tWepkTzF-HpZ6kr2n6XrmudRrfkf5LNXIuqq-vlzVu8MMwaJItwbPBgJ6v87Ng9RYjOqHRl-x7i1XilIPV4aw0s3brpHAWNjYybxe9xB3Scbl3g00VOWEU3x-LAsvMgRUwbptFSGgdlLVQBy8XPtts7Q5n5ZVD5N2j2fT8UMM7YWcnIc9U1fubqgmR48q250qtaFB9yGEqkL9h9_u4EWv2h27-Zj42kAdD8-HbIW0GVAjgffXvv1K0ocHbJYPq7xxMK_77dwI3kNHz56BrRkrSWx80C-nB7lBOnwIQvelo7w7RwXmgqqL2G4Tdak4g_qAtEM0aN5xdkwwsKxBcJuGerLnlNcekN7pydU8W73WDH6Cu3_GkihrCd3MPD6-CWgYuq_whCptxWDHDfJvXcS_J81Sig_-LeTF9AcuHY3_YsDTeK_22tHxAlrqA-XffrYzJgfl4909Ii-Aap5gf7QMFCzd7pR15CsgmzGsNJj9GlizeIlg9Mn3oRlH0nCWCAqx6UtXH3jSPU11sShOizm0H8Yt2VlPucMmvIdt29N76HOHTjVOf6jzOqfoZaFbfiETesKCb4FFXEAPPfnl6Gxp19l_FiypBoQBSe96ox0gXJWKKzF8IEgwM8jQsY8iiDVK4XTl8LxPbewVCofdVFTnqnt2dBKyJ8I_ZBYuOHkFLs8yQ9o42Pl_E7MDVRXR_Q82YhggkAomXJbbmvPMcSechC8Ws8e1KgVF8LVDhHAipkJRCA1JThZdicZnW75BDzoaQgXpvL9GqYmwYm33w9XbRVPa5SNnniSP3l74qFCOFKx2uungEFZlO97qAFYZcpAEGuECNs-wmH3p2vCc-5rZnlXf8OOgAaOIVHyzfhT0wUcSuHkVf4xeRdoib5pXmnbWaHSAo4Oym5W7GFQue0_czTxriZDrcc6Q7F8uTr89MMrYo7ce93x3a3i9bhzw1vs1YxA00OwGx1epeCz5e7176CGVI3c3pO--_aW1-LKrxYnxJBVVgHnx12yXLKFsgW3g0MQrS9XOP3cMcba2PvzX1iAdFVPsl5Ma-QSJ3yA4YaI2GbnJdlDif7Je_djbKAw4h59VBn1MUThwZ29XQz0AW3uw&cid=CAASEuRoaD0nsDrVq2HG7ooN1AwjmQ&rfl=1%2Chttps%253A%252F%252Fmobilesyrup.com%252F%240

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

43dc1b0087e7cd6ce91fa36181b1f9c3699933508bea1a97cd3ec4210c7ef7ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24856
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8996 42 B
63 B 40ms
38ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BHb2cOGCcAe8Vk20VQSqYPHWbp7-IMaQwpLPCaVi-7QSBz30Hk_D3wx1D4I_xt1iT4_nE0-qZpBJAnMRdoSlp1kL2waU8BQ-Hzq7QBqd3cDuVF0q4

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 8996 3 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:46:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:46:44 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8996 123 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:28 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225346277716"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:28 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 8996 14 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:48:16 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 8996 0
0 15ms
14ms Image
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTva9nSPjivM3NTE5dOB9pPIiDXBpcOfmVYSJibgS6EA3OtxtgtLhcB4ZVr2RnDX8Ge0sGqCnXrudobSYx2ZbRjiaVXhg
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 200 30881edc-eaca-4a19-9596-72883fa9e0fe
beacon-fra2.rubiconproject.com/beacon/d/ Frame C1DB 43 B
378 B 31ms
9ms Image
image/avif 2602:803:c004:200::154
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://beacon-fra2.rubiconproject.com/beacon/d/30881edc-eaca-4a19-9596-72883fa9e0fe?oo=0&accountId=23502&siteId=379250&zoneId=2098550&sizeId=15&e=6A1E40E384DA563B5DF94B46C1AF2A98B15179E76957B52F782247712FA1F9C4B1F8A7F905F5A2F339D6C9F37DC8F004172DB22D3B21A9B5B79ACC8B90290E2B4A1A983E5DB97E768E6842E87F2C99A3D16561051C841CE1249E6923BED19FF437C1AEB9729A935157AB92806F53E7467DBC8ADF5E620A5BF4D6EE0E895F1A7FA01BB43E9321848890E385F9572B9DD50B4C11510402490B9F7E3DACA837DB35201ABFA5EA7DAAA721BCB3423987DD96FAC0B2848F67A2E644AC828C12FB5D9D

Requested by

Host: smarttag.rubiconproject.com
URL: https://smarttag.rubiconproject.com/a/23502/379250/2098550-15.html?&cb=0.9273429485836502&tk_st=1&rf=https%3A//mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=379250_15&rp_secure=1

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

2602:803:c004:200::154 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:28 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: image/avif
Cache-Control: private, max-age=0, no-cache
Connection: keep-alive
Keep-Alive: timeout=60
Content-Length: 43
X-XSS-Protection: 1; mode=block
Expires: 01 Jan 1970 10:00:00 GMT

GET
H2 200 / Show response
track.adform.net/adfscript/ Frame C1DB 1 KB
1 KB 32ms
29ms Script
text/javascript 37.157.2.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfscript/?bn=46799729;rtbwp=771C5C6841B9C874;rtbdata=yQacwFaTChz7JQOvIXtm1JSi-YWQriluwydsPWvTQxHJ73-5ielt14MGL7IBijxRq6lPm1ilwF_MUlsgBNM1Xhg5hQNiVK-sarAh5yHarYS9VRUcrbXgC2DhJpdbqQl3ikSyMY6XAlyEqANAZr5aTc2cTbBdtR0p3AuG3h2pUs8Uo2oS7_29Ud9mJtS7Ii0vQn5tLvPdHChnQGF6Gk19RJzEdDvpo8-A5snpuFlrP8pLgddP9ypfMaH9Fosdtl0ty5fNXt1l12e6E_vMQHAgF56rpxm003OG2DNdriwde5nGM5emh6eZ2ht-h5LT-bpGCImUfIqzziNtGh4rdcOntBbvyzVAp4U6mpuJwIBdd7mAiMRMx8y_nw2;OOBClickTrack=http://beacon-nf.rubiconproject.com/beacon/v2/t/0/30881edc-eaca-4a19-9596-72883fa9e0fe/

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

9b3f639cbe1ebbc30e042443e5a10745dd037ac3a56c42cd8b48e74455721375

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 989
expires: -1

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5044
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEObsvZ9A4rAYURkKfNO-OxY&google_cver=1

43 B
1014 B

105ms
104ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEObsvZ9A4rAYURkKfNO-OxY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhjljap5MAE&v=APEucNV6EtntELDUvgOsrBPgevoCbS2icc3zSaUEcgxdGA_ZYL6N8sIy_0ROhdiYD9mC2rgqxGclVjxKg7yi7dSeRMTN3_6zauj6V_kw8Ieo7wAQoJu43HCKnsS9xkFTmuuNAtmDr5uoy6nRy3RJswRCivhElh7i6WuoQA74831YZKro56kaxk4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:28 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 05 Jul 2021 18:48:28 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEObsvZ9A4rAYURkKfNO-OxY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5044
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YONT.uuebcUg9L1Ytyx5NQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEObsvZ9A4rAYURkKfNO-OxY&google_cver=1&google_hm=2

43 B
894 B

116ms
115ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEObsvZ9A4rAYURkKfNO-OxY&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhjljap5MAE&v=APEucNV6EtntELDUvgOsrBPgevoCbS2icc3zSaUEcgxdGA_ZYL6N8sIy_0ROhdiYD9mC2rgqxGclVjxKg7yi7dSeRMTN3_6zauj6V_kw8Ieo7wAQoJu43HCKnsS9xkFTmuuNAtmDr5uoy6nRy3RJswRCivhElh7i6WuoQA74831YZKro56kaxk4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:28 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 05 Jul 2021 18:48:28 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEObsvZ9A4rAYURkKfNO-OxY&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 5044
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIkSlnISTKfTdUPnGUtG-4A&google_cver=1

43 B
1004 B

16ms
16ms

Image
image/gif

37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIkSlnISTKfTdUPnGUtG-4A&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhjljap5MAE&v=APEucNV6EtntELDUvgOsrBPgevoCbS2icc3zSaUEcgxdGA_ZYL6N8sIy_0ROhdiYD9mC2rgqxGclVjxKg7yi7dSeRMTN3_6zauj6V_kw8Ieo7wAQoJu43HCKnsS9xkFTmuuNAtmDr5uoy6nRy3RJswRCivhElh7i6WuoQA74831YZKro56kaxk4

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:28 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 7d2f0c59-b71d-4fd6-bf92-ed34eea91714
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIkSlnISTKfTdUPnGUtG-4A&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 5044
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:28 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 516d8397-ecf6-42b6-b54f-0522814df58e
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 8996 176 KB
61 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2f126a8957c32db99e94d1bf7c9ed09fcd38ba99bd632ebd048f01f9c5f9c9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 16:18:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9002
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62241
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:47 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jul 2021 16:18:26 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/ Frame 8996 8 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B3k7YHjYvKLv-A2k83sketbBDi-spkJ7cb9xQtcIOXFLwKGYeV6fBudXXQ5qaBAYuk07I2fBTkw_O09lyXKt3LJzSWjNr8FFlMJhkLG6D8dkjtlkldHcAormH7Mb11VkgSono0MhUlSWraErTf010aARuVFQ&dbm_d=AKAmf-BmIZWLFBvR32o1fBF0kYosqy_SxOwQJCPk6wbbC4HBVENMWMx2Px6c0yujNFiOOcYC-7ENApCdrnHdGbmkqumL4uU9flrgbb5ElKhrdJMrDDSKjkfeEvdMYmQAi5TohdZwGmup5gx9O1Kxb4GGusCgYWJtOgjITf3rAfuKVRCgVgn4Xr387kutRSi_NEL-fhaMsy0nSnL3qEwpdcXe_JDaDcUoEjr5HrYbpineFV6wx_SViB1K3a9JAQk_1Pi7O1gO2Pv8lCwOv67Xw3XkzsvAeGu3aLExaLpHEYivxJ3mEdK7oPHULiGkyT1WD27zoQA48ygf1izxv20C9OfnHsqPOOhGqD7PsS3MJS6QqIdyUCxOrug7DQCW8eobixri-VyYKCEvbVGYEHhkkMN-QrpvmEVBR-uZFMnNkUEL4DXTGrAhDEaQXDH4s3idVGXPy9fa9jwANu08bH-crNcfbliK_R1iZ1FAofWttsf_F6IiFvJ-RVXoUK2C-Ii0v4iUPHE4dxqE5MWS5E1JF2HqCSm-NVnNNzrGEOS3VYLzFrgUne5qt0aPD4DcTnsXsbiFirQTJJQQijnKXa_jBBfoKl9PacHCC5pqs6TsEWS61uy5AJabf5EGcfydMkm09YhEETH_gn05F0m0Ie_DPK2ZfzcZxhmjz5xc4XNgsqoFV8aIWCJ0nKSSoloUwyylvkQh-CRr9J-0hjSxkzpJY9y1a5pa_Gg7yEf9_W3pvx0mrg2SWBqcv9iS6DEfW88IIiPvXchkkzIs1NaKetmb7x-RYk8BNbCX1CsDDpsWVVKlkOf0F00GXKELDfHah5t0EjRBpCxnRPPprUtD3bzkLfe7evS03sn3k-8mRyhsg2g8XKrKenQwFRxeqGWv071_adECDUfrLzjTGE_2rkHYkV3Jo5-C-_PCBuyM2AarM1sFIoKtR0t6sagfXFJYRzlVINsyv1aF2p3iPj0LSXH3voFoaF9dUzuIGKLjTDF77C5_veFnC2TUvlhRe3bqvNMbmE2kGFhqjUsvaRHEJw39oQMh8Iv1spANwjfi1IHNch6Szt3NBC9ioHnT66ZuZ03mJvh0yDk_x6BDFmOM6oPIi0dbL5Li1SjuwQz0Ou-x54EhqvOg4jM5sX5fSIi94MTEn2BdbDkaaGB-CkL1m2ymuy49birWa3jfgra6wMOvWpBD_ZU6VnnxSX-EkcBHHE9LHEPJrd8pGuXJqND1iSY7l8MB7yCfuzDb4dkCopbpmgCN6hFvHe7p_yCZCqBl7uQeZYnlWO52dLybRvWm2Y9unXWDSil0mkfFCxhmJzihw_DO_Fs4gq4mbQHf44Paa0YFw4iK9YiY2Ull4APpNYw8xbsYszzwbRmaYh-2R9TnX6KjFQjW8yjgMgnms9A2amy4U9cPnNIzNcRT98odyC5H97tb4EfXZPC56nFHjPaIMqub3b6lik8DSeiDgIOdkZTZsr9NHSLAE-RaZz4Nhz2lIkmB7wF4lKx-96KUIRFTOEtnxFIZjdkDCuuC8HlRsxIzcLOsnE-6PQFmFAYvMxlECSQHpr3bsuvsLnuVutN9buHPvBD5nHkRYnocMYCT8JBg6AR-PhwNRAN93ioQpK9zVBwd0qYmPztp_pOxcOvRxcoj3ofBi7u46ifU2BvYeDwCkg7cbcXvUHJvWwIJspzseuavXlEmAOl1Y0lklTq-qtOTokgXr3pVWWzOGmvC1QZ2JMaq6C2CA1Jo1cP_d4pRJAVvETyVhsYlcEAq0dXIPSTaM3LCdV4RYXOKai8fk-YSc8GBnh2bifCKhLhbg6SZ377Wtmp6sSZ6veSNkrEmALwHJ5_-yUHcDXlUq_MaLElqBM_2JU7jQfi2u1jDgvB9TZkHq30LRd7cYfKbeGKa_3KA3Vu1EGJH6Nz2h_7cOu6CdWQpDjtk7tWepkTzF-HpZ6kr2n6XrmudRrfkf5LNXIuqq-vlzVu8MMwaJItwbPBgJ6v87Ng9RYjOqHRl-x7i1XilIPV4aw0s3brpHAWNjYybxe9xB3Scbl3g00VOWEU3x-LAsvMgRUwbptFSGgdlLVQBy8XPtts7Q5n5ZVD5N2j2fT8UMM7YWcnIc9U1fubqgmR48q250qtaFB9yGEqkL9h9_u4EWv2h27-Zj42kAdD8-HbIW0GVAjgffXvv1K0ocHbJYPq7xxMK_77dwI3kNHz56BrRkrSWx80C-nB7lBOnwIQvelo7w7RwXmgqqL2G4Tdak4g_qAtEM0aN5xdkwwsKxBcJuGerLnlNcekN7pydU8W73WDH6Cu3_GkihrCd3MPD6-CWgYuq_whCptxWDHDfJvXcS_J81Sig_-LeTF9AcuHY3_YsDTeK_22tHxAlrqA-XffrYzJgfl4909Ii-Aap5gf7QMFCzd7pR15CsgmzGsNJj9GlizeIlg9Mn3oRlH0nCWCAqx6UtXH3jSPU11sShOizm0H8Yt2VlPucMmvIdt29N76HOHTjVOf6jzOqfoZaFbfiETesKCb4FFXEAPPfnl6Gxp19l_FiypBoQBSe96ox0gXJWKKzF8IEgwM8jQsY8iiDVK4XTl8LxPbewVCofdVFTnqnt2dBKyJ8I_ZBYuOHkFLs8yQ9o42Pl_E7MDVRXR_Q82YhggkAomXJbbmvPMcSechC8Ws8e1KgVF8LVDhHAipkJRCA1JThZdicZnW75BDzoaQgXpvL9GqYmwYm33w9XbRVPa5SNnniSP3l74qFCOFKx2uungEFZlO97qAFYZcpAEGuECNs-wmH3p2vCc-5rZnlXf8OOgAaOIVHyzfhT0wUcSuHkVf4xeRdoib5pXmnbWaHSAo4Oym5W7GFQue0_czTxriZDrcc6Q7F8uTr89MMrYo7ce93x3a3i9bhzw1vs1YxA00OwGx1epeCz5e7176CGVI3c3pO--_aW1-LKrxYnxJBVVgHnx12yXLKFsgW3g0MQrS9XOP3cMcba2PvzX1iAdFVPsl5Ma-QSJ3yA4YaI2GbnJdlDif7Je_djbKAw4h59VBn1MUThwZ29XQz0AW3uw&cid=CAASEuRoaD0nsDrVq2HG7ooN1AwjmQ&rfl=1%2Chttps%253A%252F%252Fmobilesyrup.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:46:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 93
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:46:55 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 8996 22 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

598a6c545ec2b27cf7388041cb424a0f4ecc1884dc06e37781b927fbd3cd58fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 312
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8676
x-xss-protection: 0
server: cafe
etag: 11618055936852703379
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:43:16 GMT

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/626/s1.adform.net/ Frame C1DB 33 KB
16 KB 89ms
27ms Script
text/javascript 37.157.6.236
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Requested by: Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=46799729;rtbwp=771C5C6841B9C874;rtbdata=yQacwFaTChz7JQOvIXtm1JSi-YWQriluwydsPWvTQxHJ73-5ielt14MGL7IBijxRq6lPm1ilwF_MUlsgBNM1Xhg5hQNiVK-sarAh5yHarYS9VRUcrbXgC2DhJpdbqQl3ikSyMY6XAlyEqANAZr5aTc2cTbBdtR0p3AuG3h2pUs8Uo2oS7_29Ud9mJtS7Ii0vQn5tLvPdHChnQGF6Gk19RJzEdDvpo8-A5snpuFlrP8pLgddP9ypfMaH9Fosdtl0ty5fNXt1l12e6E_vMQHAgF56rpxm003OG2DNdriwde5nGM5emh6eZ2ht-h5LT-bpGCImUfIqzziNtGh4rdcOntBbvyzVAp4U6mpuJwIBdd7mAiMRMx8y_nw2;OOBClickTrack=http://beacon-nf.rubiconproject.com/beacon/v2/t/0/30881edc-eaca-4a19-9596-72883fa9e0fe/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: e11ab67b0ee9ecac143fd021228fda3e5c75a1e5328d0ea9fd1f30197b70f130

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:28 GMT
content-encoding: gzip
last-modified: Thu, 10 Jun 2021 12:36:46 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Tue, 06 Jul 2021 22:04:28 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8996 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 09:09:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34711
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Jul 2022 09:09:57 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 18A1 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 05 Jul 2021 08:59:18 GMT
expires: Tue, 06 Jul 2021 08:59:18 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 35350
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 8996 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 313f0af83895880907059e5259e8570e3cdedeced03c8a7c8164604470a53df1

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/ Frame 1FBA 148 KB
28 KB 14ms
14ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/index.html?e=69&leftOffset=0&topOffset=0&c=bXFPL3nJ2G&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54571d3081d854c82b9f775ad942a9e272d0e0fc5a6d19caf7595648fda0dbe9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/60776582/20210317021448276/index.html?e=69&leftOffset=0&topOffset=0&c=bXFPL3nJ2G&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 28975
date: Mon, 05 Jul 2021 18:48:28 GMT
expires: Tue, 06 Jul 2021 18:48:28 GMT
cache-control: public, max-age=86400
last-modified: Wed, 17 Mar 2021 09:14:48 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8996 0
24 B 50ms
49ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvtyyH1qOP0eXLVGILhIgJxMKuC67x86xjeztRS2zxazZZ1OuGmOiw91Md4yMsbTcytxNX-La6LsI6wHJohxHXzfBws-n9TTTxpnSa4Vbo4bciCiLEY4u2zkWuqAmfXEckHbuYu2rv7C4Zw6HpO6BTczFLDeyuFYc4xivpHZev6I8s0dU6Cj1s9IxKZUWFqTNRW3H8uM8y-KM8O_7DhYj0gJwfGBR7b9a8P6Edd_11qBtaEHlVqu-ZoAS5gLgdnR-01fnBjWGPjXY8G_UZK9RYzD3hxoMioKvKOeK45FOrYAXN53Aq3y08Bd8Om6HqXjwEavBY29-HqThs5Y_qcdlYwcDuvUh6h0eBPV_lwBvSmjIfOM-iF2dwKTe6d-DTc5filIzfESd4R0H0G6QNI-mkArNltlKfuHQf5P3Y1t5z646GIgWBBE1cG2OeglDQVzZ9WaxkNKSwu6vrF19FU3Nth6npyNzChnJ_231m5vklVprVzCSuD9Hcit56OPSXLBWLdCa7oJkl5Vqpbl0FLbLJeOHeOen_FWGlqtk8ciF3JBz94liXYuQkUy9I6_tGV78BTOcRftar9uf_Yx11hqSqM-8iNvWPpJr7Uurg1V71XIskDAAiqu33gb008kOCn3RgJ-I2YoLBj7-HKPmoiz4Gap7ds6FF82SIpPRaol9iGapSd6YBy4QJftz_oM5mC3A9CY9m-89TwRRvDxrg-Hi0ERoXPlaoB0-XGht-jtVhMjBerQN-DfyNT2K8ncGTRHYeN95-WD1cVbN4ul0uBB1_PPITmouEXQuipxa29cmqASM-VNmiLkqa8zlbWu_nzr1yNAnJ9s-flYwZ3k6DIEQ9A4oviRU8ygaZa7yT750DXAVpXx4Yy3iMGuk_fXG2nyXzwcwUB7j1X_RM15bCR0J_o_HqB_6VaLeV4WhnDuq7TMbx1VYTVBhLMnPAwmg1ms5O9HZkrbz6Y83UKOH2lmy9xHbgp8Kv9kJ_h-Ks0cQNI8taGD_EaoJln3DFP4IxuI2q77no7jxkh3mxFxmP9JGx4SmpeKrWufPT1PkfVhzXJkEJPV8xbxwY_x51I67IHwPAf_EcD2XzmL2iLJtetu_htyJO9KEU1WjmHr19c4LnvbFPUAA8uL3HZqnyyGb0k3A_apDWe2aCiLbUTWZIsm5JGhmhwrQH_kv55C1JnB9Bek4W-s69pzTD663zZbg&sai=AMfl-YQbDz8cKd1Z5z0mRPwMGoQQ_hjtjZ0YF468VoxGyovTQARuMzStBSUqH0YMImazrwoSy8MVVoBMbZSJyuAN0M6C4ayphzCAiAYS25xq9XVxJ3kVAK-m_0944rUu0jNmUaILIjZQefliEcOgJMo6fLkehOj5ug&sig=Cg0ArKJSzPBG26HHK7EDEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=66&cbvp=1&cstd=62&cisv=r20210624.78633&adurl=

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 05 Jul 2021 18:48:28 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8B91 22 KB
8 KB 8ms
8ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 05 Jul 2021 11:22:34 GMT
expires: Tue, 05 Jul 2022 11:22:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 26754
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 18A1
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPIM_NWOkES8kMCXq_C_nHb7WHc6O_uApZlEMjY...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU9OVF93QUNjd2VyZWdBQw&google_push=AYg5qPIM_NWOkES8kMCXq_C_nHb7WHc6O_uApZlEMjY-qdRkV0wYv0tHEe88wTzDQMR_sAVm4qjCQAx2I7nTC7xKYVYR8YIu1cA

170 B
188 B

16ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU9OVF93QUNjd2VyZWdBQw&google_push=AYg5qPIM_NWOkES8kMCXq_C_nHb7WHc6O_uApZlEMjY-qdRkV0wYv0tHEe88wTzDQMR_sAVm4qjCQAx2I7nTC7xKYVYR8YIu1cA

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU9OVF93QUNjd2VyZWdBQw&google_push=AYg5qPIM_NWOkES8kMCXq_C_nHb7WHc6O_uApZlEMjY-qdRkV0wYv0tHEe88wTzDQMR_sAVm4qjCQAx2I7nTC7xKYVYR8YIu1cA
Date: Mon, 05 Jul 2021 18:48:28 GMT
Server: Apache
Connection: keep-alive
Content-Length: 390
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1

200
OK

cm
a.rfihub.com/ Frame 18A1
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=445&google_gid=CAESEDmFRs9mg4rybufAoFktKsE&google_cver=1&google_push=AYg5qPJwVwsZG_-xdfEP1Y8BIg2tkq50a-whSMJy82DGbx7UKUNifCUkpluArSRuz26MK685bk-PnotdfyOQpToTcf0gICk...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPJwVwsZG_-xdfEP1Y8BIg2tkq50a-whSMJy82DGbx7UKUNifCUkpluArSRuz26MK685bk-PnotdfyOQpToTcf0gICkIEcsi&google_hm=MTk2MTg1ODc...
https://a.rfihub.com/cm?pub=445&google_error=5

42 B
808 B

82ms
22ms

Image
image/gif

193.0.160.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.rfihub.com/cm?pub=445&google_error=5
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.129 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:29 GMT
Cache-Control: no-cache
Server: Jetty(9.3.29.v20201019)
Content-Type: image/gif
Content-Length: 42
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://a.rfihub.com/cm?pub=445&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 247
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 18A1
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEIRLD6X9Zgw5eoi5jSNWtW0&google_cver=1&google_push=AYg5qPJjr8Ro7A4KH3jTn4lRzvbnZQ3yzN7-xFq4uuG8HINsUgMMVRSuWbCF28oJkzTgPnH_my1OF6AC9U-g56TR...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=7KT3rRMeRT6FT9VGMX6MUg2&google_push=AYg5qPJjr8Ro7A4KH3jTn4lRzvbnZQ3yzN7-xFq4uuG8HINsUgMMVRSuWbCF28oJkzTgPnH_my1OF6AC9U-g56TR9C5QmUR7rl3b

170 B
188 B

17ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=7KT3rRMeRT6FT9VGMX6MUg2&google_push=AYg5qPJjr8Ro7A4KH3jTn4lRzvbnZQ3yzN7-xFq4uuG8HINsUgMMVRSuWbCF28oJkzTgPnH_my1OF6AC9U-g56TR9C5QmUR7rl3b

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 05 Jul 2021 18:48:29 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.15.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=7KT3rRMeRT6FT9VGMX6MUg2&google_push=AYg5qPJjr8Ro7A4KH3jTn4lRzvbnZQ3yzN7-xFq4uuG8HINsUgMMVRSuWbCF28oJkzTgPnH_my1OF6AC9U-g56TR9C5QmUR7rl3b
x-host: tde-deliveryengine-production-7b746fb94c-nbf5z
alt-svc: clear
content-length: 0

GET google
pix.impdesk.com/csync/ Frame 18A1 0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 18A1
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEPi1EsA-a5BR6Nm8EN4x3hg&google_cver=1&google_push=AYg5qPJRv3mO28iXadt_UjiYCP_6t6VUouhfnxIM3hhIQ6o41CwPS0BuJGQTSnVdoNTiUxawZzXWcSvN...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzU3MTIzNjQzMjU0NDQ3OTIzMQ&google_push=AYg5qPJRv3mO28iXadt_UjiYCP_6t6VUouhfnxIM3hhIQ6o41CwPS0BuJGQTSnVdoNTiUxawZzXWcS...

170 B
188 B

17ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzU3MTIzNjQzMjU0NDQ3OTIzMQ&google_push=AYg5qPJRv3mO28iXadt_UjiYCP_6t6VUouhfnxIM3hhIQ6o41CwPS0BuJGQTSnVdoNTiUxawZzXWcSvN3TUwris4uw8EYUmK-Yd0

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzU3MTIzNjQzMjU0NDQ3OTIzMQ&google_push=AYg5qPJRv3mO28iXadt_UjiYCP_6t6VUouhfnxIM3hhIQ6o41CwPS0BuJGQTSnVdoNTiUxawZzXWcSvN3TUwris4uw8EYUmK-Yd0
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 18A1
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESENh8PG-lNMZR9rQ2VdK5sGU&google_cver=1&google_push=AYg5qPLRnx9NNXpQxySGRTCgtfxQeyQd6_UWjzw3JizmtB1B84nSRJ_IJMYi8zwNpF36oTpEmZA8GDSdzqyOXKFfd58lT-Rip7hO
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPLRnx9NNXpQxySGRTCgtfxQeyQd6_UWjzw3JizmtB1B84nSRJ_IJMYi8zwNpF36oTpEmZA8GDSdzqyOXKFfd58lT-Rip7hO&goog...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzc1NTc0MDMwNTMwNTUwMjY0OQ%3D%3D&google_push=AYg5qPLRnx9NNXpQxySGRTCgtfxQeyQd6_UWjzw3JizmtB1B84nSRJ_IJMYi...

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzc1NTc0MDMwNTMwNTUwMjY0OQ%3D%3D&google_push=AYg5qPLRnx9NNXpQxySGRTCgtfxQeyQd6_UWjzw3JizmtB1B84nSRJ_IJMYi8zwNpF36oTpEmZA8GDSdzqyOXKFfd58lT-Rip7hO

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzc1NTc0MDMwNTMwNTUwMjY0OQ%3D%3D&google_push=AYg5qPLRnx9NNXpQxySGRTCgtfxQeyQd6_UWjzw3JizmtB1B84nSRJ_IJMYi8zwNpF36oTpEmZA8GDSdzqyOXKFfd58lT-Rip7hO
date: Mon, 05 Jul 2021 18:48:28 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 18A1 0
12 B 16ms
15ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Kj_bfxQuMWNDVNiIUZx2P4FaGStZ8u0gjFzX_GepMu2WuUanh59cFFJITFxBBgfw

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:28 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame 1FBA 110 KB
38 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/index.html?e=69&leftOffset=0&topOffset=0&c=bXFPL3nJ2G&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/index.html?e=69&leftOffset=0&topOffset=0&c=bXFPL3nJ2G&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 16:18:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9001
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jul 2021 16:18:27 GMT

GET
H3-29 200 yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 8B91 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c971ec4829376335946d1beaa191f2c64a48e8954b422dea372c2d9029177b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 10:29:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29911
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5747
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 10:29:57 GMT

GET
H3-29 200 kia.woff
s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/ Frame 1FBA 23 KB
23 KB 7ms
7ms Font
font/woff 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/kia.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/index.html?e=69&leftOffset=0&topOffset=0&c=bXFPL3nJ2G&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4974622fff31e0fe9dcc6c31c33e3f74dfb665d2678bd876ab807506e3bab60c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/index.html?e=69&leftOffset=0&topOffset=0&c=bXFPL3nJ2G&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 11:49:57 GMT
x-content-type-options: nosniff
last-modified: Wed, 17 Mar 2021 09:14:48 GMT
server: sffe
age: 25111
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23072
x-xss-protection: 0
expires: Tue, 06 Jul 2021 11:49:57 GMT

GET
H2 200 / Show response
track.adform.net/adfserve/ Frame C1DB 5 KB
3 KB 30ms
29ms Script
text/javascript 37.157.2.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfserve/?bn=46799729;rtbwp=771C5C6841B9C874;rtbdata=yQacwFaTChz7JQOvIXtm1JSi-YWQriluwydsPWvTQxHJ73-5ielt14MGL7IBijxRq6lPm1ilwF_MUlsgBNM1Xhg5hQNiVK-sarAh5yHarYS9VRUcrbXgC2DhJpdbqQl3ikSyMY6XAlyEqANAZr5aTc2cTbBdtR0p3AuG3h2pUs8Uo2oS7_29Ud9mJtS7Ii0vQn5tLvPdHChnQGF6Gk19RJzEdDvpo8-A5snpuFlrP8pLgddP9ypfMaH9Fosdtl0ty5fNXt1l12e6E_vMQHAgF56rpxm003OG2DNdriwde5nGM5emh6eZ2ht-h5LT-bpGCImUfIqzziNtGh4rdcOntBbvyzVAp4U6mpuJwIBdd7mAiMRMx8y_nw2;oobclicktrack=http%3a%2f%2fbeacon-nf.rubiconproject.com%2fbeacon%2fv2%2ft%2f0%2f30881edc-eaca-4a19-9596-72883fa9e0fe%2f;js=1;adfxid=1x;6380;set=en-US|en-US|1600X1200|0|300|250|24|8|3|7|1|;fd=0|0&CREFURL=https%3A%2F%2Fmobilesyrup.com

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

4d38294c2dab9e7ddbf972ba1a28bdf2fd445d0515e848eaee0a23f259466c28

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 2630
expires: -1

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8996 0
23 B 42ms
42ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 18:48:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 2EB3 281 B
554 B 11ms
11ms Document
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by: Host: smarttag.rubiconproject.com
URL: https://smarttag.rubiconproject.com/a/23502/379250/2098550-15.html?&cb=0.9273429485836502&tk_st=1&rf=https%3A//mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=379250_15&rp_secure=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://smarttag.rubiconproject.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: khaos=KQQZ82ZF-9-8U84; rsid=1|AIfsdBUO++vuGxiryvY4NyLgsLINffPD0nJRTZPyMmB0r4WWOQTuL9+eZLvlgeCkRh3C4WPGUmesEFiaAnqRSjT4sl0Fg1EK+hUVPp2REB9Ko2i2DakxOMWpH+S3NzCR; ses15=379250^1; vis15=379250^1; audit=1|hLZGFuTafB3Is/bY9lK5mwZ1csWKyxPo+FyL7wuc7PqlLkir1utWGy+JfdKy0Ozhcpj76PKZXj+rlecObOHEYdzpQ7vzkXQ/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://smarttag.rubiconproject.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 23 Feb 2021 20:47:52 GMT
ETag: "402b0-119-5bc0708346e00"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 05 Jul 2021 18:48:28 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 1FBA 6 KB
4 KB 21ms
20ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eddc23d2057af328d0dde8a8c174b9a122e6e61c399f06cfef0aee7afb675c57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 18:48:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4325
x-xss-protection: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 2EB3 31 KB
9 KB 8ms
7ms Script
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 9ddda23179d75bf5090b03b5ca00786004a82b54dd9346599aa9eece613c9ed5

Request headers

Referer: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:28 GMT
Content-Encoding: gzip
Last-Modified: Mon, 14 Jun 2021 16:13:39 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=73683
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9276
Expires: Tue, 06 Jul 2021 15:16:31 GMT

GET
H2 200 Standard Show response
s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.207/e/igSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/ Frame C1DB 89 KB
38 KB 38ms
38ms Script
text/javascript 37.157.6.236
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.207/e/igSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: c441bbf89d0d9390e8b0148ea04b49e3ceeaee39fe451b6cbef7b3ed39ef25b6

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:28 GMT
content-encoding: gzip
last-modified: Thu, 10 Jun 2021 12:36:46 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Tue, 06 Jul 2021 21:43:11 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 1FBA 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:28 GMT

GET
H3-29 200 u5qa6Bce0_JDlbgkcQuMCffbH_LjsHWDv7QaTzlh7sk.js Show response
pagead2.googlesyndication.com/bg/ Frame EB5C 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/u5qa6Bce0_JDlbgkcQuMCffbH_LjsHWDv7QaTzlh7sk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb9a9ae8171ed3f24395b824710b8c09f7db1ff2e3b07583bfb41a4f3961eec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 13:52:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17786
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13289
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 16:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 13:52:02 GMT

POST
H2 200 /
track.adform.net/csimpr/ Frame C1DB 35 B
468 B 29ms
29ms Ping
image/gif 37.157.2.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/csimpr/?bn=46799729&csi=BuBDlvFYdT-ZdmpDfcDUOlC5TH3SEQM97OdHDnxL1GcJDwKV3Zer3COT-yJVv55EWO8HsVVXtTJD222VX-v9yGQBbo50IEXs0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:28 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://smarttag.rubiconproject.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 9814258.js Show response
s1.adform.net/Banners/Elements/Files/2062555/9814258/ Frame 04F7 2 KB
1 KB 27ms
27ms Script
application/x-javascript 37.157.6.236
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://s1.adform.net/Banners/Elements/Files/2062555/9814258/9814258.js?ADFassetID=9814258&bv=257

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

2c4099a97ee2116ce727ac315660ccf0ce3ba0836be82006094a441a87520507

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: gzip
last-modified: Tue, 08 Jun 2021 12:45:17 GMT
server: nginx
etag: W/"60bf665d-7a5"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

GET
H3-29 200 motif.svg
s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/ Frame 1FBA 478 B
364 B 9ms
7ms Image
image/svg+xml 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/motif.svg

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7efd7b6e6bc1738a943aeb7166b06ffdda1c36241821bd905a62c446a1c1019

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/index.html?e=69&leftOffset=0&topOffset=0&c=bXFPL3nJ2G&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 00:38:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65414
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 332
x-xss-protection: 0
last-modified: Wed, 17 Mar 2021 09:14:48 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jul 2021 00:38:15 GMT

GET
H3-29 200 23717839_20210104241907079_stinger.svg
s0.2mdn.net/ads/richmedia/studio/23717839/ Frame 1FBA 4 KB
2 KB 11ms
9ms Image
image/svg+xml 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23717839/23717839_20210104241907079_stinger.svg

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5976bde1e9f571f2724b939d8c4b9f451565c55f4591a9e6384d89b9e70a35a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/index.html?e=69&leftOffset=0&topOffset=0&c=bXFPL3nJ2G&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 04 Jul 2021 23:48:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 68400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1833
x-xss-protection: 0
last-modified: Mon, 04 Jan 2021 08:19:07 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Jul 2021 23:48:29 GMT

GET
H3-29 200 logo_kia.svg
s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/ Frame 1FBA 1 KB
692 B 10ms
9ms Image
image/svg+xml 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/logo_kia.svg

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c995290dbf27de9164f855b49d38e38662ab43b021b8bd9712ab3a8559c5a0d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/index.html?e=69&leftOffset=0&topOffset=0&c=bXFPL3nJ2G&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 15:29:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11968
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 660
x-xss-protection: 0
last-modified: Wed, 17 Mar 2021 09:14:48 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jul 2021 15:29:01 GMT

GET
H3-29 200 23717839_20210317074958684_bg_06.jpg
s0.2mdn.net/ads/richmedia/studio/23717839/ Frame 1FBA 40 KB
40 KB 10ms
8ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23717839/23717839_20210317074958684_bg_06.jpg

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01538ab047c3e59b928ee7a29305ef195560c62521e6ff10e76eb8af83614997

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/index.html?e=69&leftOffset=0&topOffset=0&c=bXFPL3nJ2G&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 09:42:42 GMT
x-content-type-options: nosniff
last-modified: Wed, 17 Mar 2021 14:49:58 GMT
server: sffe
age: 32747
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40890
x-xss-protection: 0
expires: Tue, 06 Jul 2021 09:42:42 GMT

GET
H3-29 200 23717839_20180917035306445_bg_04.jpg
s0.2mdn.net/ads/richmedia/studio/23717839/ Frame 1FBA 20 KB
20 KB 13ms
12ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23717839/23717839_20180917035306445_bg_04.jpg

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a9a1ec29f7f44d990ace916ef9d2fcbd36cb488a3d9484cb76d541fe6dc3dc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/index.html?e=69&leftOffset=0&topOffset=0&c=bXFPL3nJ2G&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 09:42:34 GMT
x-content-type-options: nosniff
last-modified: Mon, 17 Sep 2018 10:53:06 GMT
server: sffe
age: 32755
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20008
x-xss-protection: 0
expires: Tue, 06 Jul 2021 09:42:34 GMT

GET
H3-29 200 23717839_20201019070945697_bg_02.jpg
s0.2mdn.net/ads/richmedia/studio/23717839/ Frame 1FBA 41 KB
41 KB 12ms
10ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23717839/23717839_20201019070945697_bg_02.jpg

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab3bb590f07535507362bf45d373ee3a6bbb0a1a2fe31ab7863ef54340309149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/index.html?e=69&leftOffset=0&topOffset=0&c=bXFPL3nJ2G&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 14:41:18 GMT
x-content-type-options: nosniff
last-modified: Mon, 19 Oct 2020 14:09:45 GMT
server: sffe
age: 14831
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41801
x-xss-protection: 0
expires: Tue, 06 Jul 2021 14:41:18 GMT

GET
H3-29 200 23717839_20210104011256589_bg_01.jpg
s0.2mdn.net/ads/richmedia/studio/23717839/ Frame 1FBA 25 KB
25 KB 11ms
10ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23717839/23717839_20210104011256589_bg_01.jpg

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2341a6097c16ded8f2735c958fbcdc3c2c59c91f8767442ac8a49922f4612fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60776582/20210317021448276/index.html?e=69&leftOffset=0&topOffset=0&c=bXFPL3nJ2G&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 04 Jul 2021 23:48:37 GMT
x-content-type-options: nosniff
last-modified: Mon, 04 Jan 2021 09:12:56 GMT
server: sffe
age: 68392
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25110
x-xss-protection: 0
expires: Mon, 05 Jul 2021 23:48:37 GMT

GET
H2

200

Adform.DHTML.js Show response
s1.adform.net/banners/scripts/rmb/ Frame 04F7
Redirect Chain

https://track.adform.net/banners/scripts/rmb/Adform.DHTML.js
https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js

30 KB
14 KB

38ms
38ms

Script
application/x-javascript

37.157.6.236
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js
Requested by: Host: smarttag.rubiconproject.com
URL: https://smarttag.rubiconproject.com/a/23502/379250/2098550-15.html?&cb=0.9273429485836502&tk_st=1&rf=https%3A//mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=379250_15&rp_secure=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: gzip
last-modified: Fri, 14 May 2021 12:35:38 GMT
server: nginx
etag: W/"609e6e9a-76d9"
x-cache-status: HIT
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

Redirect headers

location: https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js
date: Mon, 05 Jul 2021 18:48:29 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/html

GET
H3-29 200 container.html Show response
8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E756 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mobilesyrup.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 05 Jul 2021 18:48:25 GMT
expires: Tue, 05 Jul 2022 18:48:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8B91 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BJTaN_FPjYIH1Je2wlQelrrqIBgAAAAA4AeAEAg&bg=!yMuly4_NAAYo4NJEKOA7ACkAdvg8Wm0nopLqjsGeLQITFJ04ZBzsrMW4qAmeEIPgbM5sd9hkiZ4PWgIAAACQUgAAADhoAQcKAC_SiWXtL1UXKkQTiCK5jpdyR1x-boGcsUv2s5GfgMNuL2i4-1zaFl4hIXVQDbx0wZkCvjtfSatadN0h_JtXby8_jawac5YPvU4Cw6LAlDwn8lknk1wj_z2WLMScDPxHg6RdtpQVirEbmWnMDrgb7czh6JNCpRbwCTU2H-DJzpnSU83qN5Wx_RKqNJVvNapitVs90-rfGsv7bPHWf4cObLwWNGPqWunB1S1PJnaoLwIBiwFdOWbX1hv9sDnFQGEgjQ3M3clKsmO-K3Vr9MbCKyU3WdrLnJB1RR-bDzStR0iKOoe33L02kxoW0rxBZGKDWS8XmrIx1sZD0KJyhBnRa8WyG4gQuOX_TjrUUiVgLCyT3bLb84rhjqZauCINe_lNMTT8m4f6XvKj6NIsDVKK7ZI27boIzAl26K0-MEw8BojUheL-d6thtbJmvtp_K4WakrYxV5I4d5I4dwT6sI8Cm56fCNUTUd8uKtT7jD51Xay2-jC809k0rru1tItdCw0-EOlT6353OI5JPo665T3riiVL-_tv4BPXHPn6VKnU5XnhY_o3inn9p0ugD5XyjY-Qv01pWB6y4NFNauEM1vllpNZ7JmLzPwcMI7t7qGPPyx4Rm-CkpyD0vPoXNjbjtaKrBqGQGFfNpOQv2mdT6Mti196Msj0U7PeNWouUbCRp0ATfAVq4LyxhKbIyz1UjUeft-xl74IUY0d60SGgj2Shf74L9Dg39BH3DiWJZkK5D0RiDlvym6yBUMR-dVeHz8_THb9hEIR5fmmjHb6fZmY5o5VPFDgklYBkLXoNJITC3li5rTKGHCEsicKeoAhlH2GzHs3tLx-mBa-xQ1FLqBL-VIQHMyS6eKnaprtpf_23-N0nTDRG9rDJv2yv9L_Qrj4VFAdMURG-UcoVeY3Z-jRDSeaSj4dyrTEk7ezlGKHlpeZLkM56VNUgRg1d0XQvkeZ6XIaT3eE3Hhjwa9Eh0TllvoQ6VcJ_fbpx_XGfvXXeNpOdR1w

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame EF1A 624 B
297 B 20ms
20ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNUZRZe-5Nnbg7qQQ5nr_n8fhcp4-bJsTtwo5wd-PBiUkkggTHMKp20WNePHYzG943ORJAY-EClMTcJk7A2RCTtvJjZ_coZrG3S4u-blwooRE2QLfJm_PnmiK4zuK4-MMHDRvoVQeDgVbFAOohpX0KrZ60RL5iqOj60YKEinUfKmetXqgNM

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNUZRZe-5Nnbg7qQQ5nr_n8fhcp4-bJsTtwo5wd-PBiUkkggTHMKp20WNePHYzG943ORJAY-EClMTcJk7A2RCTtvJjZ_coZrG3S4u-blwooRE2QLfJm_PnmiK4zuK4-MMHDRvoVQeDgVbFAOohpX0KrZ60RL5iqOj60YKEinUfKmetXqgNM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUnj4Zi2B6SFar177wQ2MZH07K_2F278TIs-gnxFvyqhnqPQOXZmd9s_56WloFk
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 05 Jul 2021 18:48:29 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E756 23 KB
12 KB 38ms
36ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CEiNhn5Zym69GMM1WLmOLj1jx4ezG5WlWrTgZ7gbzmQ4bweAGaKaM-qfFunHeIVnThHWT0Ex11QR7pPET88zE5rS6k11atlkNXE4oz_GNFU_xmsnSdEjt-cOAmOz6PPXsWOUCyMXews4xtW0LcOc88M_8qDA&cry=1&dbm_d=AKAmf-B6RjV7Kh5nTHTy-4tA-qCq-C9CLPMNNu1R5xzjaK9MLNtEmyI-i0qTcx3xsk9QuGlM2lRbHLjdpjyP1v5TyqUU9UjD66lqmElnUwhUlWAUADfeosg3UNlyyqNv6NmtZQaUD8AfGefurY0M17qNUIbk4x6lgD8kFasvRln2CPNgEXGGULFKdyv1Z0qN5Jo8oGwmbTnitn7hSNyfBfV0xIxeAslf670OwsRaEpyAmchTGLmYm0S7JAMIVMWGCZLgUpbDqIHJEq9iFPbLJYspaSMPmzqRN0hFTsjEikW1Gpw8BoMO2xzYzPJhsBj6F-ZUKE_iCsJ4yQiI56cQPCjct0N_v18zNjn18b8Ggn7jX7gpd3ofQp_CpBWFS1-qMx4KmWXMdImTl0k7t1RDaia3x1NlvFq2gvXPhO_G4u7bK9LcSef7Q_VJAWdA_aWpDNSUjKLz9W1zdzLYjyKc7hEiYltKktsaMMy_7ewnYPDGlEv5JowIGaWjSY1dxPuhOiTtWDeDzB6TEFKYXc-1uKwlqPsP8PSjX7HNMxA3QXz-dgx55Bb0cwxUhU59fbvfUsXEWJiXY3yBG-ysdya7Q1WISYIrbzASO1-mcVkVsQCNXyQZlM4hb5nck80sO8F9lOFiAtm6VM4udNy0hsAS8Ou6B98u3LrJxR8_KAgDpmOt4IJgazMFHx102_8oPORaL7daO1oKXEZyhBPfCtBHicgdkKEFlAhurPJUPkYHimXZq0UPmprYr3ozhWDIPq3vOnJBFSjfE1QJwBKzAkWHILVhYFhArBN1QaPQYRbs9MOf1Ka3QB27k0y7hfyKKFyqm24yon224bhuSgOQifNjfX7R8S8cVVCCG2hbBuqmJaS_1EjLo32XoO1deHVZ6ka6LVJAWxMjshJsk32r0jp-Cu6_AuZgzoPef3anfNV9GSbhKEB0vV42S518XEI5qjM_ECnvPUoDupQPPW8-7ArQ0QGZsgBJHyukZGjHJXjRE4GRl-_wjCxihLtf2glOfhWPn01IiqWvJFA8Ej74GATK9Fftb5qBYkJbWXCk-sDGTux1VfdQMmAst0EouVSQjnJ-OCrnCir1-pzcMk2pl4TcpfyPfKAbn9loiB5fQay-8_tmITu1wvWUeECQsET5de_jsckkw5AOmVwxzusPit2ngcQghZgHHWE-NtGnOqQi-nL_BziG8f6g1hX8r62cid4IMEL3a97KV0i0BFw21D2Pjg5MJ-r9RhTNDspVP6M4xsapUhHvtMwg2twjP1j_07hF28mGpYsA2c9mS1NdZDKiqGoFb7T32aUtffX7vlOu8rn3QOd0s3feowmCE6T_xb7H4bKEvysZJT7PZeltDX2-VSKpTcVDScY_Jemv7N_DiviwWY7erRv4XUUTbP1Y6IixF4uINz8yVGd2c6jPJOMwsqC8TTFrLfk5v6f50qyJyxk-OsaQm2VQWLrG8b8Ktna0qYuJT9TAqZxAfqc4ZT3iReWmDQINZ9yaSP3Gz-NDF2wWZ13FNt7GWX-DLYAZQvRnQvL_fM20a3VeC3rQbQ7-EKAV-mPyPaXsPt6PcMB9sDmkLUONHuMJS8-uT4e_sUPlBNvKOmMr3u3BGChxOWidBRvi9jqlGIMdUw6ZCMI93qGyyGMC9ywGvG6wPI7QV82EWLJAePn7dxijoggsGayg1Cy6Wx7MSKsypbyJwNhid0T3mXUyvdMXzawOIQfRTy5pxNko2eZVgrDVPI0zxo-US0znopqzxBH-ok-RRyRiuFoim_OnZyMAPxZrbpT3WNntZgltl4at5NqEH_d_mSIguCZAm9HsQBkDcztedBBIhhaFz7EsdmagJf49chXqJoSqdu3mlYWsxhMNFKb-gdhk4T_lWISIQ0uiGkmoVH3wlJe75_bNLRLBfNGm3PrhL2eg2zEjtPS7HEu35dN43nTOMGbPpYOJaMCS0_-Aw2J1W2-o4WtZpW8UOd_8u2Cu5jFvP_0pTPrJE-W2kIkkv-J0ECGT7_nPmffDvoAWFJ00nqq100E6lZjdAUqXR8SGZREZRU_JvZPRsT9McRTLmvi6WqlhKE-eN0L8AafNH_rNfYU5QUcvoeJsUWRKLAw32VWwIk-0WW0-bFEylwv9oLiSJblxExIJ5x3vjQi2jpVbY9Eb_NIH_DvC8Eb1PaFy2B-YsppCw569BI_WR8Z7OG8aN963-JKg0Gxi87Bxeig--qH9r4zx6H5mIoWDYnF0ApR7MyQ9X4KxJXtC60J-m5bwbZcdbfmXtzS3M1siEKxystDJNvJPIEqbqVJAGs3aHb_pGYCWXti5WEHwUCNkJYcDxBMa6wDgMq9M_gRrdcuBnKApdujRMzT9LATx50h8SLpXz9xCr24YsEioglY3ffabGMJnY9Y-60hdQPqN5-QqALX8fjjAZmO7QM9l0IonR-V6OYo0QLWwZO0J77CAmdSeMZxiRgzjtKFkG8zX21V4YV4nSsDQS0k_39dHkFqdg33_eA5cPcpWT9_TsyNtGeaxhapWxPio4rNrWdsUsfTZM3RJ5owmNpkHEwvu8uh5235dUKTaiiBEsKnxleBE5yUZweaaXuEP5i-96mT1rytvSLSjJk47rrZa-S8GAzLQd_bKd2Y_4HU-Xi9Z4Y8mhoKZb-4KpRCF6Eu3fkJwzKuf2kwVwX1KZesoeyeaz8DAbcquaWO7OUOBOdcTxaUF3ZQfiZRyy54ppQuhL-DWf4mQBNAR5Dn7eVC6FpXDEuuTmEQVUTUuwp85HsmkzPPnPmpoc2vF6f7dR20_v7wWwxLVr0Xz3zO3eSlfdAICFXRGqc2iPN-GPOkWCfQv2fVpret4HtrGI2uWZn1Zfxl7hmDFisQ52imgvKb9tHWp5QCucXr6IVxxQ2VykKI8w3XpehJi-5piYY3SLewiF10miGxsbd8lzG4_2sQxUkbBSMewxG11fBBBc27q8xEIoxyFoa7bTYSK15CGQo7WsRcf7DS9lnKc_gKjS6-GIS05U5WYSJ_4ntL1Q53wdvRMVvicGcaFk8bT4FhN35pJj3EuCmjxMp0TM4WSCYOHVWkqo2mHUel2kQA6F7kmK8kq96C-MN0sUgjINtQxbFKoYDt3bzQmlqce8YOiART_3NDvOjmvxRslzHiX0ReZiEBG_bhxg1boAq0KcC5ty_ulEV3abyLx2Ut-NqbAPVqRvUSDXojD0V0y-Gevbfv2GWopBzp51zuHTK4nYi1XrNbHLA&cid=CAASEuRoyQzlf-JIujcLcl26zhckBA&rfl=1%2Chttps%253A%252F%252Fmobilesyrup.com%252F%240

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b8b0171dcd10f0cca33c2efe912ff16dc704bcd63243aff5110e5b3cd9ebcbde

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12209
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E756 42 B
63 B 40ms
38ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CtPstY9GkJWw_joEvtz2wqc-Hi9-Qrkd_wJZJgsiwFlyoSlJFhsy_ftfRl8inprzplK43C6p--X0b1aXtuh8IzMHJ8ciZtmH7-aXhYn1la98JeBWU

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame E756 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:46:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 105
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:46:44 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E756 123 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225346277716"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:29 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame E756 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:48:16 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame E756 0
0 15ms
14ms Image
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSt52ObNQycEs4j9snB77wtKiQaVJMT9QzNkUghxzi8iN-3Pc5owNT1apJmpwx3BxxdVxwn0XkSq60LjBQcD0wPm6fJRw
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame E756 22 KB
8 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CEiNhn5Zym69GMM1WLmOLj1jx4ezG5WlWrTgZ7gbzmQ4bweAGaKaM-qfFunHeIVnThHWT0Ex11QR7pPET88zE5rS6k11atlkNXE4oz_GNFU_xmsnSdEjt-cOAmOz6PPXsWOUCyMXews4xtW0LcOc88M_8qDA&cry=1&dbm_d=AKAmf-B6RjV7Kh5nTHTy-4tA-qCq-C9CLPMNNu1R5xzjaK9MLNtEmyI-i0qTcx3xsk9QuGlM2lRbHLjdpjyP1v5TyqUU9UjD66lqmElnUwhUlWAUADfeosg3UNlyyqNv6NmtZQaUD8AfGefurY0M17qNUIbk4x6lgD8kFasvRln2CPNgEXGGULFKdyv1Z0qN5Jo8oGwmbTnitn7hSNyfBfV0xIxeAslf670OwsRaEpyAmchTGLmYm0S7JAMIVMWGCZLgUpbDqIHJEq9iFPbLJYspaSMPmzqRN0hFTsjEikW1Gpw8BoMO2xzYzPJhsBj6F-ZUKE_iCsJ4yQiI56cQPCjct0N_v18zNjn18b8Ggn7jX7gpd3ofQp_CpBWFS1-qMx4KmWXMdImTl0k7t1RDaia3x1NlvFq2gvXPhO_G4u7bK9LcSef7Q_VJAWdA_aWpDNSUjKLz9W1zdzLYjyKc7hEiYltKktsaMMy_7ewnYPDGlEv5JowIGaWjSY1dxPuhOiTtWDeDzB6TEFKYXc-1uKwlqPsP8PSjX7HNMxA3QXz-dgx55Bb0cwxUhU59fbvfUsXEWJiXY3yBG-ysdya7Q1WISYIrbzASO1-mcVkVsQCNXyQZlM4hb5nck80sO8F9lOFiAtm6VM4udNy0hsAS8Ou6B98u3LrJxR8_KAgDpmOt4IJgazMFHx102_8oPORaL7daO1oKXEZyhBPfCtBHicgdkKEFlAhurPJUPkYHimXZq0UPmprYr3ozhWDIPq3vOnJBFSjfE1QJwBKzAkWHILVhYFhArBN1QaPQYRbs9MOf1Ka3QB27k0y7hfyKKFyqm24yon224bhuSgOQifNjfX7R8S8cVVCCG2hbBuqmJaS_1EjLo32XoO1deHVZ6ka6LVJAWxMjshJsk32r0jp-Cu6_AuZgzoPef3anfNV9GSbhKEB0vV42S518XEI5qjM_ECnvPUoDupQPPW8-7ArQ0QGZsgBJHyukZGjHJXjRE4GRl-_wjCxihLtf2glOfhWPn01IiqWvJFA8Ej74GATK9Fftb5qBYkJbWXCk-sDGTux1VfdQMmAst0EouVSQjnJ-OCrnCir1-pzcMk2pl4TcpfyPfKAbn9loiB5fQay-8_tmITu1wvWUeECQsET5de_jsckkw5AOmVwxzusPit2ngcQghZgHHWE-NtGnOqQi-nL_BziG8f6g1hX8r62cid4IMEL3a97KV0i0BFw21D2Pjg5MJ-r9RhTNDspVP6M4xsapUhHvtMwg2twjP1j_07hF28mGpYsA2c9mS1NdZDKiqGoFb7T32aUtffX7vlOu8rn3QOd0s3feowmCE6T_xb7H4bKEvysZJT7PZeltDX2-VSKpTcVDScY_Jemv7N_DiviwWY7erRv4XUUTbP1Y6IixF4uINz8yVGd2c6jPJOMwsqC8TTFrLfk5v6f50qyJyxk-OsaQm2VQWLrG8b8Ktna0qYuJT9TAqZxAfqc4ZT3iReWmDQINZ9yaSP3Gz-NDF2wWZ13FNt7GWX-DLYAZQvRnQvL_fM20a3VeC3rQbQ7-EKAV-mPyPaXsPt6PcMB9sDmkLUONHuMJS8-uT4e_sUPlBNvKOmMr3u3BGChxOWidBRvi9jqlGIMdUw6ZCMI93qGyyGMC9ywGvG6wPI7QV82EWLJAePn7dxijoggsGayg1Cy6Wx7MSKsypbyJwNhid0T3mXUyvdMXzawOIQfRTy5pxNko2eZVgrDVPI0zxo-US0znopqzxBH-ok-RRyRiuFoim_OnZyMAPxZrbpT3WNntZgltl4at5NqEH_d_mSIguCZAm9HsQBkDcztedBBIhhaFz7EsdmagJf49chXqJoSqdu3mlYWsxhMNFKb-gdhk4T_lWISIQ0uiGkmoVH3wlJe75_bNLRLBfNGm3PrhL2eg2zEjtPS7HEu35dN43nTOMGbPpYOJaMCS0_-Aw2J1W2-o4WtZpW8UOd_8u2Cu5jFvP_0pTPrJE-W2kIkkv-J0ECGT7_nPmffDvoAWFJ00nqq100E6lZjdAUqXR8SGZREZRU_JvZPRsT9McRTLmvi6WqlhKE-eN0L8AafNH_rNfYU5QUcvoeJsUWRKLAw32VWwIk-0WW0-bFEylwv9oLiSJblxExIJ5x3vjQi2jpVbY9Eb_NIH_DvC8Eb1PaFy2B-YsppCw569BI_WR8Z7OG8aN963-JKg0Gxi87Bxeig--qH9r4zx6H5mIoWDYnF0ApR7MyQ9X4KxJXtC60J-m5bwbZcdbfmXtzS3M1siEKxystDJNvJPIEqbqVJAGs3aHb_pGYCWXti5WEHwUCNkJYcDxBMa6wDgMq9M_gRrdcuBnKApdujRMzT9LATx50h8SLpXz9xCr24YsEioglY3ffabGMJnY9Y-60hdQPqN5-QqALX8fjjAZmO7QM9l0IonR-V6OYo0QLWwZO0J77CAmdSeMZxiRgzjtKFkG8zX21V4YV4nSsDQS0k_39dHkFqdg33_eA5cPcpWT9_TsyNtGeaxhapWxPio4rNrWdsUsfTZM3RJ5owmNpkHEwvu8uh5235dUKTaiiBEsKnxleBE5yUZweaaXuEP5i-96mT1rytvSLSjJk47rrZa-S8GAzLQd_bKd2Y_4HU-Xi9Z4Y8mhoKZb-4KpRCF6Eu3fkJwzKuf2kwVwX1KZesoeyeaz8DAbcquaWO7OUOBOdcTxaUF3ZQfiZRyy54ppQuhL-DWf4mQBNAR5Dn7eVC6FpXDEuuTmEQVUTUuwp85HsmkzPPnPmpoc2vF6f7dR20_v7wWwxLVr0Xz3zO3eSlfdAICFXRGqc2iPN-GPOkWCfQv2fVpret4HtrGI2uWZn1Zfxl7hmDFisQ52imgvKb9tHWp5QCucXr6IVxxQ2VykKI8w3XpehJi-5piYY3SLewiF10miGxsbd8lzG4_2sQxUkbBSMewxG11fBBBc27q8xEIoxyFoa7bTYSK15CGQo7WsRcf7DS9lnKc_gKjS6-GIS05U5WYSJ_4ntL1Q53wdvRMVvicGcaFk8bT4FhN35pJj3EuCmjxMp0TM4WSCYOHVWkqo2mHUel2kQA6F7kmK8kq96C-MN0sUgjINtQxbFKoYDt3bzQmlqce8YOiART_3NDvOjmvxRslzHiX0ReZiEBG_bhxg1boAq0KcC5ty_ulEV3abyLx2Ut-NqbAPVqRvUSDXojD0V0y-Gevbfv2GWopBzp51zuHTK4nYi1XrNbHLA&cid=CAASEuRoyQzlf-JIujcLcl26zhckBA&rfl=1%2Chttps%253A%252F%252Fmobilesyrup.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

598a6c545ec2b27cf7388041cb424a0f4ecc1884dc06e37781b927fbd3cd58fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 313
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8676
x-xss-protection: 0
server: cafe
etag: 11618055936852703379
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:43:16 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E756 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 09:09:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34712
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Jul 2022 09:09:57 GMT

GET
H2 200 60bf65e70304680efd5a2e25 Show response
c.bannerflow.net/a/ Frame 04F7 56 KB
18 KB 53ms
33ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/a/60bf65e70304680efd5a2e25?did=5ced02fe0fd60d000186f5ac&deeplink=on&redirecturl=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D46799729%3Bcrtbwp%3D771C5C6841B9C874%3Bcrtbdata%3DyQacwFaTChz7JQOvIXtm1JSi-YWQriluwydsPWvTQxHJ73-5ielt14MGL7IBijxRq6lPm1ilwF_MUlsgBNM1Xhg5hQNiVK-sarAh5yHarYS9VRUcrbXgC2DhJpdbqQl3ikSyMY6XAlyEqANAZr5aTc2cTbBdtR0p3AuG3h2pUs8Uo2oS7_29Ud9mJtS7Ii0vQn5tLvPdHChnQGF6Gk19RJzEdDvpo8-A5snpuFlrP8pLgddP9ypfMaH9Fosdtl0ty5fNXt1l12e6E_vMQHAgF56rpxm003OG2DNdriwde5nGM5emh6eZ2ht-h5LT-bpGCImUfIqzziNtGh4rdcOntBbvyzVAp4U6mpuJwIBdd7mAiMRMx8y_nw2%3Badfibeg%3D0%3Bcdata%3DQRRpgGmaRY1Nkoim8y32RgwRZGuFuL6pEx14g_hcwfpYBRXMc3-0AkKr1ztCzqheMrfXzzOMYt6ZEcL4IGxjG_mSa-dPaMJBpYEU1paOco2MqXOOM3TjWshx9mcYMzVG0GASrjXBs9YIW9lQwlg6ow-XPvhmcx4bJrU2oJ30vQyFQDTbhOXDhcT58pXKErdKktbN0X8qgHnB81ifIhuSCY3scUm5kCP3S5QNXFy9YSU8OFX3fdSv1ZwKegl6sCKGVkRNjvxIbFHHoFEk39kKgMN4iOtIBxgX0%3B%3BCREFURL%3Dhttps%253a%252f%252fmobilesyrup.com%3BC%3D1%3Bcpdir%3D&targetwindow=_blank
Requested by: Host: smarttag.rubiconproject.com
URL: https://smarttag.rubiconproject.com/a/23502/379250/2098550-15.html?&cb=0.9273429485836502&tk_st=1&rf=https%3A//mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=379250_15&rp_secure=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dfd53ee2628d7f08bfb5d5bb5d2f9ef139aa041fbfe34809a28da076381ee2b6

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/javascript
cf-ray: 66a2c48e69fb4e5c-FRA
link: <https://c.bannerflow.net/accounts/sportwetten/609109bdc2248e94211da756/published/788072/996572/preload.jpg>; rel=preload; as=image
request-context: appId=cid-v1:8ccc0d93-c9cf-4965-a9de-1823f9df557e

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame EF1A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJFhJCx6pkfmYLfdcq6ezxQ&google_cver=1

43 B
1014 B

61ms
60ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJFhJCx6pkfmYLfdcq6ezxQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNUZRZe-5Nnbg7qQQ5nr_n8fhcp4-bJsTtwo5wd-PBiUkkggTHMKp20WNePHYzG943ORJAY-EClMTcJk7A2RCTtvJjZ_coZrG3S4u-blwooRE2QLfJm_PnmiK4zuK4-MMHDRvoVQeDgVbFAOohpX0KrZ60RL5iqOj60YKEinUfKmetXqgNM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:29 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 05 Jul 2021 18:48:29 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJFhJCx6pkfmYLfdcq6ezxQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame EF1A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YONT.uuebcUg9L1Ytyx5NQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJFhJCx6pkfmYLfdcq6ezxQ&google_cver=1&google_hm=2

43 B
894 B

124ms
123ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJFhJCx6pkfmYLfdcq6ezxQ&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNUZRZe-5Nnbg7qQQ5nr_n8fhcp4-bJsTtwo5wd-PBiUkkggTHMKp20WNePHYzG943ORJAY-EClMTcJk7A2RCTtvJjZ_coZrG3S4u-blwooRE2QLfJm_PnmiK4zuK4-MMHDRvoVQeDgVbFAOohpX0KrZ60RL5iqOj60YKEinUfKmetXqgNM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:29 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 05 Jul 2021 18:48:29 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJFhJCx6pkfmYLfdcq6ezxQ&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame EF1A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESECOwjJ8VW47rOfj7U3_kgN0&google_cver=1

43 B
1004 B

19ms
19ms

Image
image/gif

37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESECOwjJ8VW47rOfj7U3_kgN0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNUZRZe-5Nnbg7qQQ5nr_n8fhcp4-bJsTtwo5wd-PBiUkkggTHMKp20WNePHYzG943ORJAY-EClMTcJk7A2RCTtvJjZ_coZrG3S4u-blwooRE2QLfJm_PnmiK4zuK4-MMHDRvoVQeDgVbFAOohpX0KrZ60RL5iqOj60YKEinUfKmetXqgNM

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:29 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: b0039bd7-bc0e-4a4b-92e0-68fdb49c50ff
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESECOwjJ8VW47rOfj7U3_kgN0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame EF1A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

170 B
188 B

16ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:29 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 71a379d1-9ec3-407e-8ce0-6912da89c666
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D074 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 05 Jul 2021 11:22:34 GMT
expires: Tue, 05 Jul 2022 11:22:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 26755
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK 4727t6qteyti Show response
hal9000.redintelligence.net/zone/ Frame E756 11 KB
4 KB 38ms
13ms Script
text/html 144.76.104.53
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/4727t6qteyti?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLh3__FPjYJL6IvyL7_UPkuWi2AO1zfmDV_zYuavlDPAuEAEgjpyOf2CV-vCBjAfIAQmpAoG0hkHc5rM-qAMBqgTTAU_QUNh_J-m_vjxf7ZyOtyfabjg67cTrDHyWOahhHKrZ1yLpg4uiFZcJxtgLpY7kntVZutrfAjWS9ivK7Co2FH3LodUKnoui4b5tvFruE9_chbef34U_u8YZ46i_UOFRi9FSeDHxVE54JZL3o7Td1ZmQGWiP6ihYdFnD9cttCJsyR357stGTJLkZMIRXDc0AcPbsCXfOGhshe3ZQthidiF-9xqYOy71RFNGio9vCWx-UJMJ1mg8QSkt34H5sqksVdsyiMHLz-6eVWgbJBXEGZETy3cDABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHYAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRoyQzlf-JIujcLcl26zhckBA%26sig%3DAOD64_0UwZrNx0qfTgRKJ01CrT2mkqyupg%26client%3Dca-pub-3056569219636903%26dbm_c%3DAKAmf-AYWhRAI5X5d23FWgkFrj7a9cF8pXio4Dp13v_832aqLNQzsgxHaowrnx1NTcmyfSK1nzYPcs2q7yfdxCjNOzyVN9325I3R6vlY8o5g002HiflGwVRQ1VCWmjnZL24sGbr2DfG4rlG2rWgQenrIBc66pRcZ6Q%26cry%3D1%26dbm_d%3DAKAmf-D2_MZFcrM_Q9CdpGa4mL0djSvs7Uzk5fJTqhF0Cx1lZH9qDFrnmcsIHVkhIJOs8Y57xgp6m1hTmFoGI5RZHV7FZJDGWTXcoqs8nJYZB9X4gQ_th47w7eCVCKzrFqd_21UtU2wsLeN48mzj-MhncgqmLvt2JGivUkQ_nHT0G_-djKeEhcXaTFFfdrN-RojUphaFrebBsjCMac06rLXxO5O-NgL4Yiqt65iVmAOn8l6Pj3j07vraIeIOJ6Ih5WEzuQugQHzf2FBa9sWpeFuqzcMXo21JfAx-ZvSJZx08YIINA6dahqci2ieKb7EetEoojmv3OxDTSABB6JfWOS7K46EI6WhB8rEMvLaADZXpveOCoCI7MebCFZmPn3NNWaiNgxwXNlhG2CRspPWEjuFcIQ1cXG6cApKmYSIH4SbGt9Mzr1w4Dgouh9ry8EwPY6RwurZ6uFaOnVH753ihzP16oF6vwgbMV29-IiznOT-AU4hXpEFyO5LZaQg1pprOUBRw2YM1KUJgrlk02OGKKIzavA02NHConpOASSuOfkasIdEyTOyMJP0%26adurl%3D
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.104.53 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: f5cd56b7b5523512e14bdd16622285d24db39fe957b58d9b64a91ec5da00a8a0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:29 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3962
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2 200 preload.jpg
c.bannerflow.net/accounts/sportwetten/609109bdc2248e94211da756/published/788072/996572/ Frame 04F7 14 KB
15 KB 22ms
21ms Image
image/jpeg 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/sportwetten/609109bdc2248e94211da756/published/788072/996572/preload.jpg
Requested by: Host: smarttag.rubiconproject.com
URL: https://smarttag.rubiconproject.com/a/23502/379250/2098550-15.html?&cb=0.9273429485836502&tk_st=1&rf=https%3A//mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=379250_15&rp_secure=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2d2052ca8b6e5c12505acd6ee7a3b597e5ea581257c12677920e146f23c3bba

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Jul 2021 18:48:29 GMT
cf-cache-status: HIT
age: 2351990
content-length: 14842
x-ms-lease-status: unlocked
last-modified: Tue, 08 Jun 2021 12:43:45 GMT
server: cloudflare
etag: 0x8D92A7B0DEACA3E
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-ms-request-id: c9309d74-401e-0001-566a-5cb2fa000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 66a2c48eaabf4e5c-FRA
cf-bgj: h2pri

GET
H2 200 document.aa20970bb5.js Show response
c.bannerflow.net/accounts/sportwetten/609109bdc2248e94211da756/published/788072/996572/ Frame 04F7 17 KB
3 KB 19ms
18ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/accounts/sportwetten/609109bdc2248e94211da756/published/788072/996572/document.aa20970bb5.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/60bf65e70304680efd5a2e25?did=5ced02fe0fd60d000186f5ac&deeplink=on&redirecturl=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D46799729%3Bcrtbwp%3D771C5C6841B9C874%3Bcrtbdata%3DyQacwFaTChz7JQOvIXtm1JSi-YWQriluwydsPWvTQxHJ73-5ielt14MGL7IBijxRq6lPm1ilwF_MUlsgBNM1Xhg5hQNiVK-sarAh5yHarYS9VRUcrbXgC2DhJpdbqQl3ikSyMY6XAlyEqANAZr5aTc2cTbBdtR0p3AuG3h2pUs8Uo2oS7_29Ud9mJtS7Ii0vQn5tLvPdHChnQGF6Gk19RJzEdDvpo8-A5snpuFlrP8pLgddP9ypfMaH9Fosdtl0ty5fNXt1l12e6E_vMQHAgF56rpxm003OG2DNdriwde5nGM5emh6eZ2ht-h5LT-bpGCImUfIqzziNtGh4rdcOntBbvyzVAp4U6mpuJwIBdd7mAiMRMx8y_nw2%3Badfibeg%3D0%3Bcdata%3DQRRpgGmaRY1Nkoim8y32RgwRZGuFuL6pEx14g_hcwfpYBRXMc3-0AkKr1ztCzqheMrfXzzOMYt6ZEcL4IGxjG_mSa-dPaMJBpYEU1paOco2MqXOOM3TjWshx9mcYMzVG0GASrjXBs9YIW9lQwlg6ow-XPvhmcx4bJrU2oJ30vQyFQDTbhOXDhcT58pXKErdKktbN0X8qgHnB81ifIhuSCY3scUm5kCP3S5QNXFy9YSU8OFX3fdSv1ZwKegl6sCKGVkRNjvxIbFHHoFEk39kKgMN4iOtIBxgX0%3B%3BCREFURL%3Dhttps%253a%252f%252fmobilesyrup.com%3BC%3D1%3Bcpdir%3D&targetwindow=_blank
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5d3e27577125d62437f5c0c48577df8fab777c773bd34c910ddc8a7163e8e2c

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: qiCXC7UD6urnZRQJRzIGCw==
age: 2351990
cf-polished: origSize=19577
x-ms-lease-status: unlocked
last-modified: Tue, 08 Jun 2021 12:43:46 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 0858fab5-101e-008a-546a-5cb697000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
cf-ray: 66a2c48ebade4e5c-FRA
cf-bgj: minify

GET
H2 200 animated-creative.984395ed73d644b32d01.js Show response
c.bannerflow.net/scripts/ Frame 04F7 128 KB
41 KB 22ms
21ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/animated-creative.984395ed73d644b32d01.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/60bf65e70304680efd5a2e25?did=5ced02fe0fd60d000186f5ac&deeplink=on&redirecturl=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D46799729%3Bcrtbwp%3D771C5C6841B9C874%3Bcrtbdata%3DyQacwFaTChz7JQOvIXtm1JSi-YWQriluwydsPWvTQxHJ73-5ielt14MGL7IBijxRq6lPm1ilwF_MUlsgBNM1Xhg5hQNiVK-sarAh5yHarYS9VRUcrbXgC2DhJpdbqQl3ikSyMY6XAlyEqANAZr5aTc2cTbBdtR0p3AuG3h2pUs8Uo2oS7_29Ud9mJtS7Ii0vQn5tLvPdHChnQGF6Gk19RJzEdDvpo8-A5snpuFlrP8pLgddP9ypfMaH9Fosdtl0ty5fNXt1l12e6E_vMQHAgF56rpxm003OG2DNdriwde5nGM5emh6eZ2ht-h5LT-bpGCImUfIqzziNtGh4rdcOntBbvyzVAp4U6mpuJwIBdd7mAiMRMx8y_nw2%3Badfibeg%3D0%3Bcdata%3DQRRpgGmaRY1Nkoim8y32RgwRZGuFuL6pEx14g_hcwfpYBRXMc3-0AkKr1ztCzqheMrfXzzOMYt6ZEcL4IGxjG_mSa-dPaMJBpYEU1paOco2MqXOOM3TjWshx9mcYMzVG0GASrjXBs9YIW9lQwlg6ow-XPvhmcx4bJrU2oJ30vQyFQDTbhOXDhcT58pXKErdKktbN0X8qgHnB81ifIhuSCY3scUm5kCP3S5QNXFy9YSU8OFX3fdSv1ZwKegl6sCKGVkRNjvxIbFHHoFEk39kKgMN4iOtIBxgX0%3B%3BCREFURL%3Dhttps%253a%252f%252fmobilesyrup.com%3BC%3D1%3Bcpdir%3D&targetwindow=_blank
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9128a1bebd9c88ae5fe185a1280258457e8c2c24576fcc928233ed0585590741

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: g8FRWFhPAAEcFn+IhkTS8g==
age: 2787452
cf-polished: origSize=131500
x-ms-lease-status: unlocked
last-modified: Thu, 03 Jun 2021 11:56:56 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 5fd2a8f2-701e-0025-0c74-58445a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
cf-ray: 66a2c48ebae34e5c-FRA
cf-bgj: minify

GET
H3-29 200 yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js Show response
pagead2.googlesyndication.com/bg/ Frame D074 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c971ec4829376335946d1beaa191f2c64a48e8954b422dea372c2d9029177b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 10:29:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29912
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5747
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 10:29:57 GMT

GET
H/1.1

200
OK

request.php Show response
hal900020.redintelligence.net/ Frame E756
Redirect Chain

https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=4e775e7643&subid=&uid=551be20ab2a21a60&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=4e775e7643&subid=&uid=551be20ab2a21a60&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

3 KB
2 KB

103ms
80ms

Script
application/x-javascript

178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=4e775e7643&subid=&uid=551be20ab2a21a60&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLh3__FPjYJL6IvyL7_UPkuWi2AO1zfmDV_zYuavlDPAuEAEgjpyOf2CV-vCBjAfIAQmpAoG0hkHc5rM-qAMBqgTTAU_QUNh_J-m_vjxf7ZyOtyfabjg67cTrDHyWOahhHKrZ1yLpg4uiFZcJxtgLpY7kntVZutrfAjWS9ivK7Co2FH3LodUKnoui4b5tvFruE9_chbef34U_u8YZ46i_UOFRi9FSeDHxVE54JZL3o7Td1ZmQGWiP6ihYdFnD9cttCJsyR357stGTJLkZMIRXDc0AcPbsCXfOGhshe3ZQthidiF-9xqYOy71RFNGio9vCWx-UJMJ1mg8QSkt34H5sqksVdsyiMHLz-6eVWgbJBXEGZETy3cDABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHYAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRoyQzlf-JIujcLcl26zhckBA%26sig%3DAOD64_0UwZrNx0qfTgRKJ01CrT2mkqyupg%26client%3Dca-pub-3056569219636903%26dbm_c%3DAKAmf-AYWhRAI5X5d23FWgkFrj7a9cF8pXio4Dp13v_832aqLNQzsgxHaowrnx1NTcmyfSK1nzYPcs2q7yfdxCjNOzyVN9325I3R6vlY8o5g002HiflGwVRQ1VCWmjnZL24sGbr2DfG4rlG2rWgQenrIBc66pRcZ6Q%26cry%3D1%26dbm_d%3DAKAmf-D2_MZFcrM_Q9CdpGa4mL0djSvs7Uzk5fJTqhF0Cx1lZH9qDFrnmcsIHVkhIJOs8Y57xgp6m1hTmFoGI5RZHV7FZJDGWTXcoqs8nJYZB9X4gQ_th47w7eCVCKzrFqd_21UtU2wsLeN48mzj-MhncgqmLvt2JGivUkQ_nHT0G_-djKeEhcXaTFFfdrN-RojUphaFrebBsjCMac06rLXxO5O-NgL4Yiqt65iVmAOn8l6Pj3j07vraIeIOJ6Ih5WEzuQugQHzf2FBa9sWpeFuqzcMXo21JfAx-ZvSJZx08YIINA6dahqci2ieKb7EetEoojmv3OxDTSABB6JfWOS7K46EI6WhB8rEMvLaADZXpveOCoCI7MebCFZmPn3NNWaiNgxwXNlhG2CRspPWEjuFcIQ1cXG6cApKmYSIH4SbGt9Mzr1w4Dgouh9ry8EwPY6RwurZ6uFaOnVH753ihzP16oF6vwgbMV29-IiznOT-AU4hXpEFyO5LZaQg1pprOUBRw2YM1KUJgrlk02OGKKIzavA02NHConpOASSuOfkasIdEyTOyMJP0%26adurl%3D&documentReferer=https%3A%2F%2Fmobilesyrup.com%2F&ancestorOrigins=https%3A%2F%2Fmobilesyrup.com&random=5818784217050&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: fd22ff4a0baf2c21d2dbddba96d26d1e7acfe7ab330ea967fc3fd46398559ead

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:29 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 10083600184413200710612011646020
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1214
Expires: Mon, 05 Jul 2021 19:48:29 +0200

Redirect headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:29 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=4e775e7643&subid=&uid=551be20ab2a21a60&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLh3__FPjYJL6IvyL7_UPkuWi2AO1zfmDV_zYuavlDPAuEAEgjpyOf2CV-vCBjAfIAQmpAoG0hkHc5rM-qAMBqgTTAU_QUNh_J-m_vjxf7ZyOtyfabjg67cTrDHyWOahhHKrZ1yLpg4uiFZcJxtgLpY7kntVZutrfAjWS9ivK7Co2FH3LodUKnoui4b5tvFruE9_chbef34U_u8YZ46i_UOFRi9FSeDHxVE54JZL3o7Td1ZmQGWiP6ihYdFnD9cttCJsyR357stGTJLkZMIRXDc0AcPbsCXfOGhshe3ZQthidiF-9xqYOy71RFNGio9vCWx-UJMJ1mg8QSkt34H5sqksVdsyiMHLz-6eVWgbJBXEGZETy3cDABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHYAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRoyQzlf-JIujcLcl26zhckBA%26sig%3DAOD64_0UwZrNx0qfTgRKJ01CrT2mkqyupg%26client%3Dca-pub-3056569219636903%26dbm_c%3DAKAmf-AYWhRAI5X5d23FWgkFrj7a9cF8pXio4Dp13v_832aqLNQzsgxHaowrnx1NTcmyfSK1nzYPcs2q7yfdxCjNOzyVN9325I3R6vlY8o5g002HiflGwVRQ1VCWmjnZL24sGbr2DfG4rlG2rWgQenrIBc66pRcZ6Q%26cry%3D1%26dbm_d%3DAKAmf-D2_MZFcrM_Q9CdpGa4mL0djSvs7Uzk5fJTqhF0Cx1lZH9qDFrnmcsIHVkhIJOs8Y57xgp6m1hTmFoGI5RZHV7FZJDGWTXcoqs8nJYZB9X4gQ_th47w7eCVCKzrFqd_21UtU2wsLeN48mzj-MhncgqmLvt2JGivUkQ_nHT0G_-djKeEhcXaTFFfdrN-RojUphaFrebBsjCMac06rLXxO5O-NgL4Yiqt65iVmAOn8l6Pj3j07vraIeIOJ6Ih5WEzuQugQHzf2FBa9sWpeFuqzcMXo21JfAx-ZvSJZx08YIINA6dahqci2ieKb7EetEoojmv3OxDTSABB6JfWOS7K46EI6WhB8rEMvLaADZXpveOCoCI7MebCFZmPn3NNWaiNgxwXNlhG2CRspPWEjuFcIQ1cXG6cApKmYSIH4SbGt9Mzr1w4Dgouh9ry8EwPY6RwurZ6uFaOnVH753ihzP16oF6vwgbMV29-IiznOT-AU4hXpEFyO5LZaQg1pprOUBRw2YM1KUJgrlk02OGKKIzavA02NHConpOASSuOfkasIdEyTOyMJP0%26adurl%3D&documentReferer=https%3A%2F%2Fmobilesyrup.com%2F&ancestorOrigins=https%3A%2F%2Fmobilesyrup.com&random=5818784217050&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Mon, 05 Jul 2021 19:48:29 +0200

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D074 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BINwi_VPjYOjQBofX3gOcuJWYAQAAAAA4AeAEAg&bg=!ERKlElbNAAYo4NJEKOA7ACkAdvg8WghK2Oe4tSU9WpiwW01uDX83SFTaEAgoAGpO3bt7bpe4uALSEAIAAAB-UgAAAA1oAQcKANjNPN8xC3CvLb0Ze-mfEZ_Nrw6WBZV5LYdYsMc5_o03ZV72R1ksqBhFJNfiN-C-O7QnZRCwlYE81tWW6vB5Uuu8a1f44XOTPAvMWHMg3zXsyxw0vbGzAC7ws5hGatxEL4y2KiMgxrik11TdUjzyn4rsQ0TqpBBWN6soU_749ubZylE-CjJFSmSs7tisyxsnkwhL3fGQVAok3Ly9awVOGhKe5vOhOYlAHdyTkFrgpb-0KH_PUcKwGf7NMGd6nu3UyevHnCOb-xiV7FECMwE9eUehTdmXnZyE1KWZArwUJ2RfAmEGHfHTeGSrs8XYXlpO-iNbL19Po1og4ClDoFu0M2qr3U1dkPn4WQ4FgfRTkiC5L-DTvD2A0R-whLCjpm9Vq5GX4GUZS6-BN3hNb9PyFgN4oX8HTTNYT1ipp3W8vWvDDBg2CmTBeTcgjpHnOTH4B82FSzv0Ep8ighkElxYz6Hmmfo2G1YwnuLBhcKtfYcLfCGDPxtRe1ojuzn25mTKCBFRBnWYraLGjtUmD3Boo7dkFVOaNpd1S13E-pfacBIHUlYPWqiz9o6wWFsu2PbNTBNbM2N6TpQalJsJSLOTNKzGu8DKbBvahSgU2rcBneb1bTunabQZQktSyeC8iHhSQOw6eAVtCQdRih6jbE7KnWqqkF6eSucNhiZKw3cGaD-PpDXZhS02CRWhGjrT09B9KUEP7NCcJfVq6OEUHebKqhGKooDmWMSSqlb1URjYZt-OGDZl5d8W9rH8Wbsa0nJsjme7y7SOkhgmwdRD5RcD96443OEVgEedlLm6K3pxfMpojLHy_Tm8AQimkzcfuVfcuc-wkAbA8q3VvRWg8JGv8EslLdf9lYcvNdtK8SorYOFW5rzjb1ZY136xEf_b3xIbezjHuYS1pEBP9LOByVhHqJMHDa4LrerZ0eFfHFNr3erF3EQ9fqfzoD3Uh8gIKi_MfaP9x-FjhZI5ylme1mHgxKflpu47IbW5mVYlLPYs7Cl5v8g-QZHsqyvh0LNx0QfxnN1OjA_J-0ehP1ZorDjBApeFTcV5G64UanQRhmbg9HUjxaHs5Yirwo4X7_tnOxkGeln84Q8-zI0f0XWQ9HqcfXOsCNYYyJNXtolyCRAJffId9oVZvWAMwK6VDCdZcmqFklqCdYaBmDmNcZ1pHtyGd8-wx1OOoUrBseuxEKpIPcDwzfnQwuvlpowsB6w65OoGTzI2VpFC5z7dk

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 04F7 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/webp

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 04F7 7 KB
7 KB 157ms
20ms Font
font/woff 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F609109bdda7efd391f535b9d%2F2f075e60-50fc-4580-991b-5f9ca55a8d89.woff&t=%20%21%2B15%3FABDEFGHILNORSTUVZ%E2%82%AC
Requested by: Host: smarttag.rubiconproject.com
URL: https://smarttag.rubiconproject.com/a/23502/379250/2098550-15.html?&cb=0.9273429485836502&tk_st=1&rf=https%3A//mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=379250_15&rp_secure=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ac6fb22183debb63c41f332b6f20a0296f652cb125bf4d314084e366ce6503aa

Request headers

Origin: https://smarttag.rubiconproject.com
Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
cf-cache-status: HIT
server: cloudflare
age: 2354863
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=2f075e60-50fc-4580-991b-5f9ca55a8d89-subset.woff
cf-ray: 66a2c490cb1405d4-FRA
expires: Wed, 08 Jun 2022 12:40:46 GMT

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 04F7 7 KB
7 KB 159ms
22ms Font
font/woff 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F609109bdda7efd391f535b9d%2Fb16d136b-70ba-40a4-96a8-3b1bafc255f9.woff&t=%20%2503BNOSU
Requested by: Host: smarttag.rubiconproject.com
URL: https://smarttag.rubiconproject.com/a/23502/379250/2098550-15.html?&cb=0.9273429485836502&tk_st=1&rf=https%3A//mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=379250_15&rp_secure=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 910cc27942266e7bde2fb1fed633a21b8226758cdca2f61cb975c03b7c2c14bf

Request headers

Origin: https://smarttag.rubiconproject.com
Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
cf-cache-status: HIT
server: cloudflare
age: 2354664
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=b16d136b-70ba-40a4-96a8-3b1bafc255f9-subset.woff
cf-ray: 66a2c490cb1905d4-FRA
expires: Wed, 08 Jun 2022 12:44:05 GMT

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 04F7 6 KB
6 KB 196ms
59ms Font
font/woff 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F609109bdda7efd391f535b9d%2Ff155fcd2-c893-49c0-b615-c33c94a032d5.woff&t=EIKLMNOSW
Requested by: Host: smarttag.rubiconproject.com
URL: https://smarttag.rubiconproject.com/a/23502/379250/2098550-15.html?&cb=0.9273429485836502&tk_st=1&rf=https%3A//mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=379250_15&rp_secure=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c7f7355a208a43e9ac381db8e37b96133ee06214dbc7c896c80bc90430480ef

Request headers

Origin: https://smarttag.rubiconproject.com
Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
cf-cache-status: HIT
server: cloudflare
age: 266607
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=f155fcd2-c893-49c0-b615-c33c94a032d5-subset.woff
cf-ray: 66a2c490cb1805d4-FRA
expires: Sat, 02 Jul 2022 16:45:02 GMT

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 04F7 9 KB
9 KB 168ms
32ms Font
font/woff 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F609109bdda7efd391f535b9d%2F4e29237b-b8b7-4d81-af25-d6f2df77caba.woff&t=%20%26.%3AGHISabcdefghiklnoprstuz%C3%BC
Requested by: Host: smarttag.rubiconproject.com
URL: https://smarttag.rubiconproject.com/a/23502/379250/2098550-15.html?&cb=0.9273429485836502&tk_st=1&rf=https%3A//mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=379250_15&rp_secure=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a14fb5cb9b793fb3f0d7e86b8ca31332f7fad120170442290742bdb61ed77833

Request headers

Origin: https://smarttag.rubiconproject.com
Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
cf-cache-status: HIT
server: cloudflare
age: 2354863
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=4e29237b-b8b7-4d81-af25-d6f2df77caba-subset.woff
cf-ray: 66a2c490cb1b05d4-FRA
expires: Wed, 08 Jun 2022 12:40:46 GMT

GET
H3-29 200 container.html Show response
8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 5309 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021063001.js?31061750

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mobilesyrup.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://mobilesyrup.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 05 Jul 2021 18:48:25 GMT
expires: Tue, 05 Jul 2022 18:48:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame BA11 6 KB
6 KB 45ms
45ms Image
image/webp 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fsportwetten%2F609109bdc2248e94211da756%2Fimages%2F18c20fd4-76e9-4462-94e1-9e8a4adeb47e.jpg&w=921&h=721&q=90&f=webp&rt=contain
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e35346eb81bf8a730319ae7a7100c03f954d63ced62340f9f71994eb6e03f24

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
cf-cache-status: HIT
api-supported-versions: 2.0
age: 21752
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 66a2c4915ab24e5c-FRA
content-length: 6254
server: cloudflare
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 d194aa07-2ab9-4d74-ac47-2a3ee5f54f32.svg
c.bannerflow.net/accounts/sportwetten/609109bdc2248e94211da756/images/ Frame BA11 564 B
588 B 28ms
28ms Image
image/svg+xml 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/sportwetten/609109bdc2248e94211da756/images/d194aa07-2ab9-4d74-ac47-2a3ee5f54f32.svg
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad6f640a14aa06c375dd330502420af190776b9ff26ef754173101d43aab9190

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: wqFmHWuO0V4VKmGALVO3hw==
age: 5604
x-ms-lease-status: unlocked
last-modified: Wed, 02 Jun 2021 16:11:13 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: c667e037-101e-000c-328c-5b7a2e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
cf-ray: 66a2c4915ab44e5c-FRA

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame BA11 19 KB
20 KB 22ms
21ms Image
image/webp 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fsportwetten%2F609109bdc2248e94211da756%2Fimages%2Ff180ec0c-2237-4b68-b424-d31ab9a95e86.png&w=276&h=406&q=90&f=webp&rt=contain
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c8ca9e8f34f79eee0d158f23937b7131473b272e0b0941a96b76e622a8f4df3

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
cf-cache-status: HIT
api-supported-versions: 2.0
age: 21752
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 66a2c4917ae94e5c-FRA
content-length: 19892
server: cloudflare
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 2d8cdd70-d0d0-4f08-910c-9d6d000a6913.svg
c.bannerflow.net/accounts/sportwetten/609109bdc2248e94211da756/images/ Frame BA11 1 KB
759 B 26ms
26ms Image
image/svg+xml 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/sportwetten/609109bdc2248e94211da756/images/2d8cdd70-d0d0-4f08-910c-9d6d000a6913.svg
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3d28a5de495412aab1a674b92af621776580a32d278a7979928c9a38c5fc5b3e

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: YUpoG5Rq/dbyTf5gV87mGQ==
age: 7071
x-ms-lease-status: unlocked
last-modified: Sat, 05 Jun 2021 16:40:36 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: a0ce1867-701e-000a-6663-5c4991000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
cf-ray: 66a2c4917af44e5c-FRA

GET
H2 200 a4100cb7-e5a9-49e5-8daa-b18f49359351.svg
c.bannerflow.net/accounts/sportwetten/609109bdc2248e94211da756/images/ Frame BA11 21 KB
5 KB 20ms
19ms Image
image/svg+xml 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/sportwetten/609109bdc2248e94211da756/images/a4100cb7-e5a9-49e5-8daa-b18f49359351.svg
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f144aeecd94296d562b6e514c1e65fdf574cdf9f3b03c2d2b6a1d6cd6a440dc

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: OoDzwFH1jzcH6vhrrHkg6g==
age: 6605
x-ms-lease-status: unlocked
last-modified: Wed, 02 Jun 2021 16:14:01 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: f6ec6424-901e-004f-3c8c-5b9c72000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
cf-ray: 66a2c4917af64e5c-FRA

GET
H2 200 4eb020a4-32e3-4758-a06d-2c91901d159c.svg
c.bannerflow.net/accounts/sportwetten/609109bdc2248e94211da756/images/ Frame BA11 21 KB
5 KB 22ms
22ms Image
image/svg+xml 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/sportwetten/609109bdc2248e94211da756/images/4eb020a4-32e3-4758-a06d-2c91901d159c.svg
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f144aeecd94296d562b6e514c1e65fdf574cdf9f3b03c2d2b6a1d6cd6a440dc

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: OoDzwFH1jzcH6vhrrHkg6g==
age: 4836
x-ms-lease-status: unlocked
last-modified: Mon, 07 Jun 2021 10:35:51 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: a1b1559c-701e-008c-0863-5c8528000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
cf-ray: 66a2c4917af94e5c-FRA

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2E62 624 B
297 B 18ms
18ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARion4SZATAB&v=APEucNV4KxnZtxprZ1HbkFJQ0CJE6hzJO1l6bZXxFkQjg4omK-UVyT0QuzLm-H5FC_YH65NSRd646EJsMe-4k_oQQawg2xa0bq-jxL_lms1SzLdW0Gt_VAONmgwbiFNGLhPtpKCMcTFiMFD77aUchZzcVkHVdkZdVtunZ2qZkqNyDLeHOHiQP2s

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CPvjgQEQlL6EARion4SZATAB&v=APEucNV4KxnZtxprZ1HbkFJQ0CJE6hzJO1l6bZXxFkQjg4omK-UVyT0QuzLm-H5FC_YH65NSRd646EJsMe-4k_oQQawg2xa0bq-jxL_lms1SzLdW0Gt_VAONmgwbiFNGLhPtpKCMcTFiMFD77aUchZzcVkHVdkZdVtunZ2qZkqNyDLeHOHiQP2s
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlBF1w0qEMqvWGERQnnjp1h6WI0J2BIlC17SJrT4Hj-6vC5PEFSrZQQ4vQtOyQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 05 Jul 2021 18:48:29 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 5309 65 KB
25 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AADmuLWbUP1fZb5KqLzg6zdoT937n4nYipLUsNGNcKN5OzoIEdkzjx3mqNGRDuIEYg8-CcPzC4Bt0rjv9bsgnaerLmLDSVjhOokX35uIwLyqDyV__eh6pnkKVvMWtzUbFCpqxUbYVObgUdhDw4S89WOmNDhg&dbm_d=AKAmf-CYDw2hIun81T6uE46o0brX1UFSz0fAGMegEC94-AwgiQfDAedyJ6t2mV8_XKxGNVyJHI6jhP4I4DC8zy-_YB0rbYFxA4QyJTmOKmlXHh8TK78VaYXkYBuJHGVQl79Y9Wb-k3eVOTjtPTtq_9EXNlZwy_HD4Jjrf66JLOjeTMWdaiML5qKzHMVAimdQ1ppe1Nd-k4rja6PgymhYA9UssnIuSogfF7KzuG571QlYQFd-XzvKUN0T1p8RrGTlsykuemPtUTYf_Saf3kL7sZQiFbNQ_7qLsWIPYjSoE89GQf3tv57MNsNDe79V5yIKpY29wLq-ExZtKQNquXcas9QH6AJ1O-61Wb7VGUrj4gGLVe9ctkO6KN_JniVCMAxFDwG6JHkbH57i0C9S8gaFccDKtxpjlPbwF-rLZZz64qBtVOHxPZDuVyEmC21XvlIv5g16Mog0k8d1J6Czzv20_P4dbKjyrh37uYtO2vtJMpbSJ2HXWkG9cq_Z6mlMFx0awNXTKEujp2ECbwjF7WMTAVj_GKe9IL1P52aWSlNQNAjp-_oyQWygHgyNMxdNS43oBnx8dyik9cWGYbEn3-7MhfkC5-PblbNVJ84tnibEXzfSt8DfJFdp_AkYzT4Fac-SuOouSUM8ChpoNUBSqHlM6iBTjj-z9czdfb5EAjV9sZvnKRBQm7jda8Rjy6xXWdr8edLX-NV4QPRx0Y0p6KcqMJH5LheWiy8Rn-z9GGt1i-f9EPN0o-HSW9mzyTvB6_CbksyRJ8oF0JsjyY9gAZNqlw3nLygMy8A8ZeTEegh2TbFZHgAL_CqZSwMydS6VOWq2hHoYZub9RLty8E2qfGAFyO9ryaw1WDnk5mOZbl4jDE3-1PjQU2mNe0MxnHQGXxclAvQdbTTT5K3xXCN18GjBY0-TTgWuSNhEkf7DRdHh9wRwOgdEs-4gxnJuc_RgnfAA2czuKEK17AmX_gc52UOBwTKScGRkg5GywqRJ9EBlb0bXGkrdXJNd0GB038KjGU14onWI7B9GCpyBB3aSrSju71Pa9o3GbNUDrhIeaOnN0R5IetOnaXKrEcq5TRJ9Wkw7hynVd4-weYgunnvRy5FrycXXthLxnFpE-0Cmy9yRxEMTxPZrlyLQ9acJj6ZvZU65FZUQkVVSYH1zNZc_oe-Pdk0A4RdOaEX-VYJS2sOCEL97V4mvi4eywRw4lxegpVNIyh-opJrjLuDBVZGirpKv48lOtru7MtEixoMfQod5z5XRllMc-jVcX_UDUiOnrDfZ0COhGSHRdwcUd21KvW_dy_otZQS0gKSIPbB4uDW_qhQh-z53IO-xf1G99H5U5kGAPaqxeWxHc71eos0qSA5Mc5OWW6jR8NP9ksFuhtn6PMoIrtN5USLvKtA3kFQ5zZE7Oco44uFsk733fQ9ynPesKqFguf-xRA4GNLhdaLC_lcLW5IYZ4L5G_XnfZHvqRbXi6XJY9mrF9S8earTX5LWiWhhkkps_2McZW5TJdRaBjX_DLARBsAmWunIdqRiXJ2lALrcBY3XKt-E_4bKyTosI9tEshdX8vWoswwNJhJcRtiMg94JhuZne4tyO8shM0CRf8eN61KEAOZVqt-fombPj6ru0o55wmY8UaofDhDhomIT2nbDx7UsKnHRp38-FCzpULu5Vr1c8kUm_TKrY_8qdL1wyHXYNdmcq1dDHe90iDlf-vRSXNmi1uOq7agS-wHd9b8B4lbPnWjEV9xicgbkhehpYogY8HkKE7kGVfQrLDCP8pfcDldEfDYIf8lqXPdonL1J37AGOcv0OR-XMU2knoEVuGBwtMTqRkzBEMBwPxg2ak7tEUboYXCopEa5Fq5TkgQU8DRGOAJ_vZ5vXREjHdHuN0ClPjJi9yoJF9ipCSl3Jjaz5SyVyXFJgRDx4mPpxIQ6Z_P7zNve7wPqp3FIOjUVLjUqjfjrExtxRPubu1KJ3jNWBjqeAMtsNqsxV_T9tJF6sLjZVDUfdS1qs0lF_cPMXAxnKbt4bNmlQohHIh6W6cYhBtTwSDwsWDkjNEibc5I27OPlZWY2ZflRusLQIfaW11Wz8mEniS8FYluq95e3idRTHSZETG-pomJxhDoh5osdmBg-D5v1f-tI6FIDGxeInjMQqNq81fVe7WX3KN3xHqN_YimUz3adnDtDvqXwEGZD2kM7S78866tcJfriT-8rLJwuZTLguccDMu07H33oTG9RWCcGCs0tsrGiJ0bM3d8j9lOTPVcNyCUw8E-z8IeGvL9txq_gZZVbEaee92XrGRN8l2UkljKh8pAZj0trtc37Q9GJyDqAGQN6wdrbdm8fPT3T1jkM6pvRBaByx7r7kuZxiWJbbF8zovwxKKL8Ds8XjHsWOH6TxjhC7QOoCh9Q4aE4OJBa4uSGZSuFmUxjOZFk4m86aXTuo7W6yTCjv_IJVlSo0uM0Dco37HKxY6sGt_G6XaOteKJ2Y26_7uMysI6_IoOKflcgeulWBHD_7mkWvNRt0YDdcgIXcz_A7KIAX2RGjfdztNS3fFGF0mIGL62g8w-ZG-zmZ7FnfBCAkcO4650CX2NuFKxjmkZJPU43GR4PnemneYSoXu2q637OruWHNodLAxx68vbF9_vQOkyXAyK94VSmuWwyPnZohfJXuFJCR924dvKoG5vOgCjqsnuUTnGQnc8FLlUo38NKL4Zu5fkZwLs1INmQ0cb2smjMaCXvcMnUhPpIZ1wY45IkR4wsdRFrS-CeALnywWtGVociUdMvoUqF00n_MRP3XBuXU0xfa3SXRdgycV9YfQuhezGMriUZRVLHj6ump5UULyjFzeJqqVYa4secDbeHRZ42VQC_HV8MTnppN67YbGQlAO1PbU9kAGwFBEsPicX67n9m9B9-cWP597OJIFC98xLIKX8OBCwzmYM7mkXbCzY323kse9kiO5d7P3PEMEtFKH1fVTGIHeFlYmmvslLoRFzVD5JbjPEnyq96MRu_CcJzeHE34c0yPpggNR7uGS5k5PpoFIidUCMYeefadVHFJAGvY8Qy7fKQ_Ly0SyvaZ5yZYwzkL2Pqm53dRSEf8qtlgjzh677x3qapadsK6r6pB15qTDX4bRYwVYwCOiNgiTfs9PYifHyEUB7o&cid=CAASEuRo8sd-20E3Zfnx0TqEH4Ll0Q&rfl=1%2Chttps%253A%252F%252Fmobilesyrup.com%252F%240

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ada0ca66467b58c560a95f35a585d84c37be05bf6370053db07ad53de7b8a7aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25620
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5309 42 B
63 B 39ms
38ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CegORA5s0OocQ0muZPqD_gpCVbkF7dNc_hxxfduriTr9QJIdXTlvV_Nq5MMULv_Nimv0iamzauXWZxhlwnd618cKbzDW8R9scJkFcL-JS297Q6FtI

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 5309 3 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:46:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 105
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:46:44 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5309 123 KB
37 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225346277716"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:29 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 5309 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:48:16 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 5309 0
0 16ms
16ms Image
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSdNvXoE5KXC9_NKGaJeOVIIvLvQtYvWs28SJ6vLfYKtBx_Lu_5eXdOlpTFJvgJELs2CTWdt46uactmYMBiO6FUgoNF6A
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

POST
H2 200 pixel
c.bannerflow.net/tr/v2/ Frame 04F7 0
82 B 41ms
41ms Ping
text/plain 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/tr/v2/pixel
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/60bf65e70304680efd5a2e25?did=5ced02fe0fd60d000186f5ac&deeplink=on&redirecturl=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D46799729%3Bcrtbwp%3D771C5C6841B9C874%3Bcrtbdata%3DyQacwFaTChz7JQOvIXtm1JSi-YWQriluwydsPWvTQxHJ73-5ielt14MGL7IBijxRq6lPm1ilwF_MUlsgBNM1Xhg5hQNiVK-sarAh5yHarYS9VRUcrbXgC2DhJpdbqQl3ikSyMY6XAlyEqANAZr5aTc2cTbBdtR0p3AuG3h2pUs8Uo2oS7_29Ud9mJtS7Ii0vQn5tLvPdHChnQGF6Gk19RJzEdDvpo8-A5snpuFlrP8pLgddP9ypfMaH9Fosdtl0ty5fNXt1l12e6E_vMQHAgF56rpxm003OG2DNdriwde5nGM5emh6eZ2ht-h5LT-bpGCImUfIqzziNtGh4rdcOntBbvyzVAp4U6mpuJwIBdd7mAiMRMx8y_nw2%3Badfibeg%3D0%3Bcdata%3DQRRpgGmaRY1Nkoim8y32RgwRZGuFuL6pEx14g_hcwfpYBRXMc3-0AkKr1ztCzqheMrfXzzOMYt6ZEcL4IGxjG_mSa-dPaMJBpYEU1paOco2MqXOOM3TjWshx9mcYMzVG0GASrjXBs9YIW9lQwlg6ow-XPvhmcx4bJrU2oJ30vQyFQDTbhOXDhcT58pXKErdKktbN0X8qgHnB81ifIhuSCY3scUm5kCP3S5QNXFy9YSU8OFX3fdSv1ZwKegl6sCKGVkRNjvxIbFHHoFEk39kKgMN4iOtIBxgX0%3B%3BCREFURL%3Dhttps%253a%252f%252fmobilesyrup.com%3BC%3D1%3Bcpdir%3D&targetwindow=_blank
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 66a2c491ab7b4e5c-FRA
content-length: 0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
request-context: appId=cid-v1:1d9bcaa3-5ddc-4e5d-973c-949d7ceab63e

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2E62
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGH55P7kiUAD1aS9u5thjS0&google_cver=1

43 B
894 B

152ms
152ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGH55P7kiUAD1aS9u5thjS0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARion4SZATAB&v=APEucNV4KxnZtxprZ1HbkFJQ0CJE6hzJO1l6bZXxFkQjg4omK-UVyT0QuzLm-H5FC_YH65NSRd646EJsMe-4k_oQQawg2xa0bq-jxL_lms1SzLdW0Gt_VAONmgwbiFNGLhPtpKCMcTFiMFD77aUchZzcVkHVdkZdVtunZ2qZkqNyDLeHOHiQP2s
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:29 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 05 Jul 2021 18:48:29 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGH55P7kiUAD1aS9u5thjS0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2E62
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YONT.uuebcUg9L1Ytyx5NQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGH55P7kiUAD1aS9u5thjS0&google_cver=1&google_hm=2

43 B
894 B

78ms
77ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGH55P7kiUAD1aS9u5thjS0&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARion4SZATAB&v=APEucNV4KxnZtxprZ1HbkFJQ0CJE6hzJO1l6bZXxFkQjg4omK-UVyT0QuzLm-H5FC_YH65NSRd646EJsMe-4k_oQQawg2xa0bq-jxL_lms1SzLdW0Gt_VAONmgwbiFNGLhPtpKCMcTFiMFD77aUchZzcVkHVdkZdVtunZ2qZkqNyDLeHOHiQP2s
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:29 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 05 Jul 2021 18:48:29 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGH55P7kiUAD1aS9u5thjS0&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 2E62
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPdvnfF-eVoaS6L10EPeLHY&google_cver=1

43 B
1004 B

18ms
17ms

Image
image/gif

37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPdvnfF-eVoaS6L10EPeLHY&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARion4SZATAB&v=APEucNV4KxnZtxprZ1HbkFJQ0CJE6hzJO1l6bZXxFkQjg4omK-UVyT0QuzLm-H5FC_YH65NSRd646EJsMe-4k_oQQawg2xa0bq-jxL_lms1SzLdW0Gt_VAONmgwbiFNGLhPtpKCMcTFiMFD77aUchZzcVkHVdkZdVtunZ2qZkqNyDLeHOHiQP2s

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:29 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 6978145e-c674-4251-a0bf-4fda3c1a1aeb
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPdvnfF-eVoaS6L10EPeLHY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2E62
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:29 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 801798ef-abcf-43d7-9cbb-57099fc1b40c
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDE1MDg2NzE2OTI2MDk5OTU2Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 5309 176 KB
61 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2f126a8957c32db99e94d1bf7c9ed09fcd38ba99bd632ebd048f01f9c5f9c9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 16:18:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9003
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62241
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:47 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jul 2021 16:18:26 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/ Frame 5309 8 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AADmuLWbUP1fZb5KqLzg6zdoT937n4nYipLUsNGNcKN5OzoIEdkzjx3mqNGRDuIEYg8-CcPzC4Bt0rjv9bsgnaerLmLDSVjhOokX35uIwLyqDyV__eh6pnkKVvMWtzUbFCpqxUbYVObgUdhDw4S89WOmNDhg&dbm_d=AKAmf-CYDw2hIun81T6uE46o0brX1UFSz0fAGMegEC94-AwgiQfDAedyJ6t2mV8_XKxGNVyJHI6jhP4I4DC8zy-_YB0rbYFxA4QyJTmOKmlXHh8TK78VaYXkYBuJHGVQl79Y9Wb-k3eVOTjtPTtq_9EXNlZwy_HD4Jjrf66JLOjeTMWdaiML5qKzHMVAimdQ1ppe1Nd-k4rja6PgymhYA9UssnIuSogfF7KzuG571QlYQFd-XzvKUN0T1p8RrGTlsykuemPtUTYf_Saf3kL7sZQiFbNQ_7qLsWIPYjSoE89GQf3tv57MNsNDe79V5yIKpY29wLq-ExZtKQNquXcas9QH6AJ1O-61Wb7VGUrj4gGLVe9ctkO6KN_JniVCMAxFDwG6JHkbH57i0C9S8gaFccDKtxpjlPbwF-rLZZz64qBtVOHxPZDuVyEmC21XvlIv5g16Mog0k8d1J6Czzv20_P4dbKjyrh37uYtO2vtJMpbSJ2HXWkG9cq_Z6mlMFx0awNXTKEujp2ECbwjF7WMTAVj_GKe9IL1P52aWSlNQNAjp-_oyQWygHgyNMxdNS43oBnx8dyik9cWGYbEn3-7MhfkC5-PblbNVJ84tnibEXzfSt8DfJFdp_AkYzT4Fac-SuOouSUM8ChpoNUBSqHlM6iBTjj-z9czdfb5EAjV9sZvnKRBQm7jda8Rjy6xXWdr8edLX-NV4QPRx0Y0p6KcqMJH5LheWiy8Rn-z9GGt1i-f9EPN0o-HSW9mzyTvB6_CbksyRJ8oF0JsjyY9gAZNqlw3nLygMy8A8ZeTEegh2TbFZHgAL_CqZSwMydS6VOWq2hHoYZub9RLty8E2qfGAFyO9ryaw1WDnk5mOZbl4jDE3-1PjQU2mNe0MxnHQGXxclAvQdbTTT5K3xXCN18GjBY0-TTgWuSNhEkf7DRdHh9wRwOgdEs-4gxnJuc_RgnfAA2czuKEK17AmX_gc52UOBwTKScGRkg5GywqRJ9EBlb0bXGkrdXJNd0GB038KjGU14onWI7B9GCpyBB3aSrSju71Pa9o3GbNUDrhIeaOnN0R5IetOnaXKrEcq5TRJ9Wkw7hynVd4-weYgunnvRy5FrycXXthLxnFpE-0Cmy9yRxEMTxPZrlyLQ9acJj6ZvZU65FZUQkVVSYH1zNZc_oe-Pdk0A4RdOaEX-VYJS2sOCEL97V4mvi4eywRw4lxegpVNIyh-opJrjLuDBVZGirpKv48lOtru7MtEixoMfQod5z5XRllMc-jVcX_UDUiOnrDfZ0COhGSHRdwcUd21KvW_dy_otZQS0gKSIPbB4uDW_qhQh-z53IO-xf1G99H5U5kGAPaqxeWxHc71eos0qSA5Mc5OWW6jR8NP9ksFuhtn6PMoIrtN5USLvKtA3kFQ5zZE7Oco44uFsk733fQ9ynPesKqFguf-xRA4GNLhdaLC_lcLW5IYZ4L5G_XnfZHvqRbXi6XJY9mrF9S8earTX5LWiWhhkkps_2McZW5TJdRaBjX_DLARBsAmWunIdqRiXJ2lALrcBY3XKt-E_4bKyTosI9tEshdX8vWoswwNJhJcRtiMg94JhuZne4tyO8shM0CRf8eN61KEAOZVqt-fombPj6ru0o55wmY8UaofDhDhomIT2nbDx7UsKnHRp38-FCzpULu5Vr1c8kUm_TKrY_8qdL1wyHXYNdmcq1dDHe90iDlf-vRSXNmi1uOq7agS-wHd9b8B4lbPnWjEV9xicgbkhehpYogY8HkKE7kGVfQrLDCP8pfcDldEfDYIf8lqXPdonL1J37AGOcv0OR-XMU2knoEVuGBwtMTqRkzBEMBwPxg2ak7tEUboYXCopEa5Fq5TkgQU8DRGOAJ_vZ5vXREjHdHuN0ClPjJi9yoJF9ipCSl3Jjaz5SyVyXFJgRDx4mPpxIQ6Z_P7zNve7wPqp3FIOjUVLjUqjfjrExtxRPubu1KJ3jNWBjqeAMtsNqsxV_T9tJF6sLjZVDUfdS1qs0lF_cPMXAxnKbt4bNmlQohHIh6W6cYhBtTwSDwsWDkjNEibc5I27OPlZWY2ZflRusLQIfaW11Wz8mEniS8FYluq95e3idRTHSZETG-pomJxhDoh5osdmBg-D5v1f-tI6FIDGxeInjMQqNq81fVe7WX3KN3xHqN_YimUz3adnDtDvqXwEGZD2kM7S78866tcJfriT-8rLJwuZTLguccDMu07H33oTG9RWCcGCs0tsrGiJ0bM3d8j9lOTPVcNyCUw8E-z8IeGvL9txq_gZZVbEaee92XrGRN8l2UkljKh8pAZj0trtc37Q9GJyDqAGQN6wdrbdm8fPT3T1jkM6pvRBaByx7r7kuZxiWJbbF8zovwxKKL8Ds8XjHsWOH6TxjhC7QOoCh9Q4aE4OJBa4uSGZSuFmUxjOZFk4m86aXTuo7W6yTCjv_IJVlSo0uM0Dco37HKxY6sGt_G6XaOteKJ2Y26_7uMysI6_IoOKflcgeulWBHD_7mkWvNRt0YDdcgIXcz_A7KIAX2RGjfdztNS3fFGF0mIGL62g8w-ZG-zmZ7FnfBCAkcO4650CX2NuFKxjmkZJPU43GR4PnemneYSoXu2q637OruWHNodLAxx68vbF9_vQOkyXAyK94VSmuWwyPnZohfJXuFJCR924dvKoG5vOgCjqsnuUTnGQnc8FLlUo38NKL4Zu5fkZwLs1INmQ0cb2smjMaCXvcMnUhPpIZ1wY45IkR4wsdRFrS-CeALnywWtGVociUdMvoUqF00n_MRP3XBuXU0xfa3SXRdgycV9YfQuhezGMriUZRVLHj6ump5UULyjFzeJqqVYa4secDbeHRZ42VQC_HV8MTnppN67YbGQlAO1PbU9kAGwFBEsPicX67n9m9B9-cWP597OJIFC98xLIKX8OBCwzmYM7mkXbCzY323kse9kiO5d7P3PEMEtFKH1fVTGIHeFlYmmvslLoRFzVD5JbjPEnyq96MRu_CcJzeHE34c0yPpggNR7uGS5k5PpoFIidUCMYeefadVHFJAGvY8Qy7fKQ_Ly0SyvaZ5yZYwzkL2Pqm53dRSEf8qtlgjzh677x3qapadsK6r6pB15qTDX4bRYwVYwCOiNgiTfs9PYifHyEUB7o&cid=CAASEuRo8sd-20E3Zfnx0TqEH4Ll0Q&rfl=1%2Chttps%253A%252F%252Fmobilesyrup.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:46:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 94
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:46:55 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 5309 22 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

598a6c545ec2b27cf7388041cb424a0f4ecc1884dc06e37781b927fbd3cd58fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 313
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8676
x-xss-protection: 0
server: cafe
etag: 11618055936852703379
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 18:43:16 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 5309 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 09:09:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34712
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Jul 2022 09:09:57 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9273 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 05 Jul 2021 08:59:18 GMT
expires: Tue, 06 Jul 2021 08:59:18 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 35351
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK Cookie set cshow.php Show response
www.awin1.com/ Frame 2C8C 43 B
705 B 66ms
24ms Document
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.awin1.com/cshow.php?s=2329635&v=16160&q=356171&r=296283&pref1=10083600184413200710612011646020&pv=1

Requested by

Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=4e775e7643&subid=&uid=551be20ab2a21a60&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLh3__FPjYJL6IvyL7_UPkuWi2AO1zfmDV_zYuavlDPAuEAEgjpyOf2CV-vCBjAfIAQmpAoG0hkHc5rM-qAMBqgTTAU_QUNh_J-m_vjxf7ZyOtyfabjg67cTrDHyWOahhHKrZ1yLpg4uiFZcJxtgLpY7kntVZutrfAjWS9ivK7Co2FH3LodUKnoui4b5tvFruE9_chbef34U_u8YZ46i_UOFRi9FSeDHxVE54JZL3o7Td1ZmQGWiP6ihYdFnD9cttCJsyR357stGTJLkZMIRXDc0AcPbsCXfOGhshe3ZQthidiF-9xqYOy71RFNGio9vCWx-UJMJ1mg8QSkt34H5sqksVdsyiMHLz-6eVWgbJBXEGZETy3cDABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHYAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRoyQzlf-JIujcLcl26zhckBA%26sig%3DAOD64_0UwZrNx0qfTgRKJ01CrT2mkqyupg%26client%3Dca-pub-3056569219636903%26dbm_c%3DAKAmf-AYWhRAI5X5d23FWgkFrj7a9cF8pXio4Dp13v_832aqLNQzsgxHaowrnx1NTcmyfSK1nzYPcs2q7yfdxCjNOzyVN9325I3R6vlY8o5g002HiflGwVRQ1VCWmjnZL24sGbr2DfG4rlG2rWgQenrIBc66pRcZ6Q%26cry%3D1%26dbm_d%3DAKAmf-D2_MZFcrM_Q9CdpGa4mL0djSvs7Uzk5fJTqhF0Cx1lZH9qDFrnmcsIHVkhIJOs8Y57xgp6m1hTmFoGI5RZHV7FZJDGWTXcoqs8nJYZB9X4gQ_th47w7eCVCKzrFqd_21UtU2wsLeN48mzj-MhncgqmLvt2JGivUkQ_nHT0G_-djKeEhcXaTFFfdrN-RojUphaFrebBsjCMac06rLXxO5O-NgL4Yiqt65iVmAOn8l6Pj3j07vraIeIOJ6Ih5WEzuQugQHzf2FBa9sWpeFuqzcMXo21JfAx-ZvSJZx08YIINA6dahqci2ieKb7EetEoojmv3OxDTSABB6JfWOS7K46EI6WhB8rEMvLaADZXpveOCoCI7MebCFZmPn3NNWaiNgxwXNlhG2CRspPWEjuFcIQ1cXG6cApKmYSIH4SbGt9Mzr1w4Dgouh9ry8EwPY6RwurZ6uFaOnVH753ihzP16oF6vwgbMV29-IiznOT-AU4hXpEFyO5LZaQg1pprOUBRw2YM1KUJgrlk02OGKKIzavA02NHConpOASSuOfkasIdEyTOyMJP0%26adurl%3D&documentReferer=https%3A%2F%2Fmobilesyrup.com%2F&ancestorOrigins=https%3A%2F%2Fmobilesyrup.com&random=5818784217050&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Host: www.awin1.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Content-Type: image/gif
Expires: 0
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Pragma: no-cache
Content-Length: 43
Date: Mon, 05 Jul 2021 18:48:29 GMT
Connection: keep-alive
Set-Cookie: awpv16160=296283|1625510909|97173801-ddc1-11eb-962f-692d0326f1d6;domain=.awin1.com;path=/;expires=Wednesday, 07-Jul-2021 18:48:29 UTC;Secure;SameSite=None AWSESS=356171:2329635;domain=.awin1.com;path=/;Secure;SameSite=None
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

GET
H2

200

htlp Show response
futalis.de/ Frame 74EC
Redirect Chain

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=10083600184413200710612011646020
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=739274653

350 B
409 B

43ms
9ms

Document
text/html

49.12.16.151
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=739274653
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=4e775e7643&subid=&uid=551be20ab2a21a60&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLh3__FPjYJL6IvyL7_UPkuWi2AO1zfmDV_zYuavlDPAuEAEgjpyOf2CV-vCBjAfIAQmpAoG0hkHc5rM-qAMBqgTTAU_QUNh_J-m_vjxf7ZyOtyfabjg67cTrDHyWOahhHKrZ1yLpg4uiFZcJxtgLpY7kntVZutrfAjWS9ivK7Co2FH3LodUKnoui4b5tvFruE9_chbef34U_u8YZ46i_UOFRi9FSeDHxVE54JZL3o7Td1ZmQGWiP6ihYdFnD9cttCJsyR357stGTJLkZMIRXDc0AcPbsCXfOGhshe3ZQthidiF-9xqYOy71RFNGio9vCWx-UJMJ1mg8QSkt34H5sqksVdsyiMHLz-6eVWgbJBXEGZETy3cDABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHYAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRoyQzlf-JIujcLcl26zhckBA%26sig%3DAOD64_0UwZrNx0qfTgRKJ01CrT2mkqyupg%26client%3Dca-pub-3056569219636903%26dbm_c%3DAKAmf-AYWhRAI5X5d23FWgkFrj7a9cF8pXio4Dp13v_832aqLNQzsgxHaowrnx1NTcmyfSK1nzYPcs2q7yfdxCjNOzyVN9325I3R6vlY8o5g002HiflGwVRQ1VCWmjnZL24sGbr2DfG4rlG2rWgQenrIBc66pRcZ6Q%26cry%3D1%26dbm_d%3DAKAmf-D2_MZFcrM_Q9CdpGa4mL0djSvs7Uzk5fJTqhF0Cx1lZH9qDFrnmcsIHVkhIJOs8Y57xgp6m1hTmFoGI5RZHV7FZJDGWTXcoqs8nJYZB9X4gQ_th47w7eCVCKzrFqd_21UtU2wsLeN48mzj-MhncgqmLvt2JGivUkQ_nHT0G_-djKeEhcXaTFFfdrN-RojUphaFrebBsjCMac06rLXxO5O-NgL4Yiqt65iVmAOn8l6Pj3j07vraIeIOJ6Ih5WEzuQugQHzf2FBa9sWpeFuqzcMXo21JfAx-ZvSJZx08YIINA6dahqci2ieKb7EetEoojmv3OxDTSABB6JfWOS7K46EI6WhB8rEMvLaADZXpveOCoCI7MebCFZmPn3NNWaiNgxwXNlhG2CRspPWEjuFcIQ1cXG6cApKmYSIH4SbGt9Mzr1w4Dgouh9ry8EwPY6RwurZ6uFaOnVH753ihzP16oF6vwgbMV29-IiznOT-AU4hXpEFyO5LZaQg1pprOUBRw2YM1KUJgrlk02OGKKIzavA02NHConpOASSuOfkasIdEyTOyMJP0%26adurl%3D&documentReferer=https%3A%2F%2Fmobilesyrup.com%2F&ancestorOrigins=https%3A%2F%2Fmobilesyrup.com&random=5818784217050&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 49.12.16.151 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: /
Resource Hash: 582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

:method: GET
:authority: futalis.de
:scheme: https
:path: /htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=739274653
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

content-length: 350
content-type: text/html; charset=utf-8

Redirect headers

date: Mon, 05 Jul 2021 18:48:29 GMT
server: Apache
p3p: policyref="https://www.retailads.net//w3c/p3p.xml",CP="NOI CUR OUR STP"
set-cookie: pp2172=739274653; expires=Wed, 04-Aug-2021 18:48:29 GMT; Max-Age=2592000; path=/; domain=.retailads.net ppb2172=739274653; expires=Wed, 04-Aug-2021 18:48:29 GMT; Max-Age=2592000; path=/; domain=.retailads.net; samesite=none; secure
location: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=739274653
content-length: 0
content-type: text/html; charset=utf-8

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame E756 12 KB
12 KB 174ms
97ms Script
text/html 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3432245&wgcampaignid=99582&viewref=10083600184413200710612011646020&js=1&nw=1
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: e8c6ac2dce65313c8c8773f2c28696378d41919a1c60368e345ebf0d785a53fd

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:29 GMT
Last-Modified: Mon, 05 Jul 2021 18:48:29 GMT
Server: Apache
Transfer-Encoding: chunked
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3-29

200

activityi;dc_pre=CLmz_YLMzPECFa4UBgAdIUAH5A;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2365766942013.8716 Show response
5994599.fls.doubleclick.net/ Frame 45DC
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2365766942013.8716?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CLmz_YLMzPECFa4UBgAdIUAH5A;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2365766942013.8716?

392 B
346 B

38ms
24ms

Document
text/html

142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CLmz_YLMzPECFa4UBgAdIUAH5A;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2365766942013.8716?

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f6.1e100.net

Software

cafe /

Resource Hash

9a2c39c5187e5e2fd32c5e93e075e7f1919945d85e320219aee91981f49f3f2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5994599.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CLmz_YLMzPECFa4UBgAdIUAH5A;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2365766942013.8716?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUk-bdPDdID7VNjiN8G6IrGgT5e-RKqVRRPhbOqxRg1LQNls5o92jCQJnofkqeo
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jul 2021 18:48:30 GMT
expires: Mon, 05 Jul 2021 18:48:30 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 323
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jul 2021 18:48:30 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CLmz_YLMzPECFa4UBgAdIUAH5A;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2365766942013.8716?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK request_content.php Show response
hal900020.redintelligence.net/ Frame B46B 7 KB
2 KB 511ms
11ms Document
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/request_content.php?s=10083600184413200710612011646020&a=437de341
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=4e775e7643&subid=&uid=551be20ab2a21a60&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLh3__FPjYJL6IvyL7_UPkuWi2AO1zfmDV_zYuavlDPAuEAEgjpyOf2CV-vCBjAfIAQmpAoG0hkHc5rM-qAMBqgTTAU_QUNh_J-m_vjxf7ZyOtyfabjg67cTrDHyWOahhHKrZ1yLpg4uiFZcJxtgLpY7kntVZutrfAjWS9ivK7Co2FH3LodUKnoui4b5tvFruE9_chbef34U_u8YZ46i_UOFRi9FSeDHxVE54JZL3o7Td1ZmQGWiP6ihYdFnD9cttCJsyR357stGTJLkZMIRXDc0AcPbsCXfOGhshe3ZQthidiF-9xqYOy71RFNGio9vCWx-UJMJ1mg8QSkt34H5sqksVdsyiMHLz-6eVWgbJBXEGZETy3cDABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHYAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRoyQzlf-JIujcLcl26zhckBA%26sig%3DAOD64_0UwZrNx0qfTgRKJ01CrT2mkqyupg%26client%3Dca-pub-3056569219636903%26dbm_c%3DAKAmf-AYWhRAI5X5d23FWgkFrj7a9cF8pXio4Dp13v_832aqLNQzsgxHaowrnx1NTcmyfSK1nzYPcs2q7yfdxCjNOzyVN9325I3R6vlY8o5g002HiflGwVRQ1VCWmjnZL24sGbr2DfG4rlG2rWgQenrIBc66pRcZ6Q%26cry%3D1%26dbm_d%3DAKAmf-D2_MZFcrM_Q9CdpGa4mL0djSvs7Uzk5fJTqhF0Cx1lZH9qDFrnmcsIHVkhIJOs8Y57xgp6m1hTmFoGI5RZHV7FZJDGWTXcoqs8nJYZB9X4gQ_th47w7eCVCKzrFqd_21UtU2wsLeN48mzj-MhncgqmLvt2JGivUkQ_nHT0G_-djKeEhcXaTFFfdrN-RojUphaFrebBsjCMac06rLXxO5O-NgL4Yiqt65iVmAOn8l6Pj3j07vraIeIOJ6Ih5WEzuQugQHzf2FBa9sWpeFuqzcMXo21JfAx-ZvSJZx08YIINA6dahqci2ieKb7EetEoojmv3OxDTSABB6JfWOS7K46EI6WhB8rEMvLaADZXpveOCoCI7MebCFZmPn3NNWaiNgxwXNlhG2CRspPWEjuFcIQ1cXG6cApKmYSIH4SbGt9Mzr1w4Dgouh9ry8EwPY6RwurZ6uFaOnVH753ihzP16oF6vwgbMV29-IiznOT-AU4hXpEFyO5LZaQg1pprOUBRw2YM1KUJgrlk02OGKKIzavA02NHConpOASSuOfkasIdEyTOyMJP0%26adurl%3D&documentReferer=https%3A%2F%2Fmobilesyrup.com%2F&ancestorOrigins=https%3A%2F%2Fmobilesyrup.com&random=5818784217050&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: d5b95bee14fd3e79522a06af2d791b2052a228d174a0d2e8a7e7c38a287cc82a

Request headers

Host: hal900020.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=91442d24afcb9b48
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

Date: Mon, 05 Jul 2021 18:48:30 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Mon, 05 Jul 2021 19:48:30 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2100
Connection: close
Content-Type: text/html; charset=utf-8

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D769 1 KB
749 B 6ms
5ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 05 Jul 2021 08:59:18 GMT
expires: Tue, 06 Jul 2021 08:59:18 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 35351
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame E756 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 69036411436c8c6ae24d372d7900f1778554a98dbe18a9fa315df5690405062e

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 300x250.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/60669678/20210618051901288/ Frame CBC1 42 KB
10 KB 14ms
14ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/60669678/20210618051901288/300x250.html?e=69&leftOffset=0&topOffset=0&c=0QVTLmJlT9&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb59c7822bd2136e74cfdb7c53ea4ad82672a84c7fb8ad1ff7ea27b7ecacaa38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/60669678/20210618051901288/300x250.html?e=69&leftOffset=0&topOffset=0&c=0QVTLmJlT9&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9971
date: Mon, 05 Jul 2021 18:48:29 GMT
expires: Tue, 06 Jul 2021 18:48:29 GMT
cache-control: public, max-age=86400
last-modified: Fri, 18 Jun 2021 12:19:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5309 0
24 B 51ms
51ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuFyiW8GNNY7D0qeBd5Nlg7KNg6tOI99N6QuYYhwnaJLxEmOTPlJfFK7ssi2NbY8m12hlENsVDu955dW-FHB0W5IQb5IihRi4JaB_3GnZHrffpGfBsFjKx-S0jOOirE3u_yI6RzaJHi0HfqSMQt2fX9dEWr7lzlimXLQeumY_cChRKKwnqLTkNO0QNqn7-uyBBF5SNWUIsHmEm7VifhR4By1EN-OOZUvnK9e1iM1DCHkvWH9xiIW5TVSRKrMug5LIuJApDl4VP_PzvmIGndxi0nZ2-9hxVw8Kv_Dw4su4lXD3BSfGs_u8j9POVdHrB7dnfbzTDgXBsAeJ_d3gHY8YTEwDLqhkOIkX1HxevJsQ2Cd-r33WwGbq7IGzHotGQ3vSZmD-K3Us1UJQ6ZQYNsHsJLYNdmHqo_g-Y72956jtBZzrl5n1kpuf7hBHYyhWOcfmpHvgPQG8hSN3FK6xarHsQ4HiWbAHlUqC5x6RcznX9dSB2sePDwNzQfbHE6s7MngGG4H7nA4axhQmv1__tKvwH0jI8cyFDGN3frB8I_DJThpzP9z29GzYQcnQgH6GijYa-jIqHRQ3LCBdC0paMi_VdAI8YPoOltsWqctecxq-3tjWhyp719wkNxqLhZ99j_P7VPolubC9aEab15okg718bXDgLdH9xFv9VgTeAOo0kuEJDtFmydxRl0QrhiztZY9Uf2eL6VJVfweP8tAAHdlyl21PG5OFJYzqaeOdG8eAJmRdI8UfUUm--ToQ47i7GAcT6fPGNEdtigk_QItkxnJR_Fn8vJaf6wCweaqFUTyU52Aj-UZYDcuVinrCzW2NiKADHLv2SwB1mKb10PCLQgq19AxlvAQZWRGXIatBOIrcc4jEuUJGZcIQlQE3ze50ChYWXJV9ajbV7gipXwaUU0ktaY27-APxo3Bv0bfRsnLOWUOiAJTxJ92l84c9JGJPZDJbsSe-vrfBT50oucN2UHj9Sk7qPLVz0rMSeX1yGenNQO8BJP20oQ_VBrFmGCgppQmh_DrwotCxF7ofvkI5U2MCa3O-rmp_VyD1fhL6djQu_x7f6nL2IhQ40cLI9fvNH-_orcotmCPR7V9rUwR7tV5sXoD2kW3GUXWb_O61OIhdugbd1i81-bcP0xHVCF0t8jVAsUtCk29hS0F0_l9Zxwxawfc8d3r1wpxlI6YFp0FYsBhsKaKySWRh2h&sai=AMfl-YQlyEOXzwynlCslpY_8gEP5PdsZrcRJjHu6WQkwcFChrOZsdIWPCF0_pbIZfjaVWhFmZLx8Ntl0JEudO15jAvTiQLbYjEKkOAeR-e1T8sEhMhBQxmE-vRNgTv6cNDmHuJ0tLRHVya_xR6as_IHZu3esftNVDQ&sig=Cg0ArKJSzLgxe6gkMFCYEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=72&cbvp=1&cstd=69&cisv=r20210624.25704&adurl=

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 05 Jul 2021 18:48:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C88B 22 KB
8 KB 8ms
7ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 05 Jul 2021 11:22:34 GMT
expires: Tue, 05 Jul 2022 11:22:34 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 26755
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 9273
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEIMo2L53CbYnYVuXTYsbug0&google_cver=1&google_push=AYg5qPJsgvlYf6FF4gzvO00ND98wLOMrOogdN0Bj4OkIURKx9dweT_udzD9OizBXBSlCfbGmfd76bC03OhFuoEzuV1-XeJFQoCM
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjQwMDYwMjE2NDc0Njg1Mjg5Nw==
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESED6GtT1LXoFDyjEZpCIzhxg&google_cver=1

43 B
407 B

15ms
13ms

Image
image/gif

2001:678:cb4:bbbb::11
TURN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESED6GtT1LXoFDyjEZpCIzhxg&google_cver=1
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESED6GtT1LXoFDyjEZpCIzhxg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 i.match
a.tribalfusion.com/ Frame 9273 43 B
749 B 177ms
166ms Image
image/gif 2606:4700::6812:d05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEP1AKAoFXVRNE8ckMfWjQBU&google_cver=1&google_push=AYg5qPIenB10t3zSt6C6k6Rv1vGdQBA6rEWHF6gZPigoYghuzcGxsGdVz1PByUAEaWqaAKM7FzQMehYpHI1Ayp_IxHRzV5DKoos&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPIenB10t3zSt6C6k6Rv1vGdQBA6rEWHF6gZPigoYghuzcGxsGdVz1PByUAEaWqaAKM7FzQMehYpHI1Ayp_IxHRzV5DKoos%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 66a2c4927d2cd6e9-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 9273 0
191 B 897ms
31ms Image
text/plain 66.155.71.149
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESENMqDKm5TaIKsQJuvKUyhCw&google_cver=1&google_push=AYg5qPIgAixhQHNvyLw0InNkmDqeOYwnDQvftYey5K5zut8ctNnDhgvZTk9YQZ9136ItrFmrQ4oPciwl1w3Mz1HTN0mEWRcDGhw
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.149 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:30 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9273
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEF4KV6V0ztxgjBasaqoZWGQ&google_cver=1&google_push=AYg5qPLpmgcZPeeYWylDcp-7IfQ9x4iQokV-Iz9QJgFdnXhQIOdaMZsHX-7LHd_6kW9lJpqgbuZJtQzSreZvJdv8hlMR...
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=37594a23-b057-4349-9674-37a036757204
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=37594a23-b057-4349-9674-37a036757204
https://x.bidswitch.net/sync?dsp_id=4&user_id=e944c7aa-02d2-4d61-ac35-136b00b0cca2&ssp=google&expires=30&user_group=5&bsw_param=37594a23-b057-4349-9674-37a036757204
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPLpmgcZPeeYWylDcp-7IfQ9x4iQokV-Iz9QJgFdnXhQIOdaMZsHX-7LHd_6kW9lJpqgbuZJtQzSreZvJdv8hlMRsyyCTNk&google_hm=N1lKI7BXQ0mWdDegNnVyBA==

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPLpmgcZPeeYWylDcp-7IfQ9x4iQokV-Iz9QJgFdnXhQIOdaMZsHX-7LHd_6kW9lJpqgbuZJtQzSreZvJdv8hlMRsyyCTNk&google_hm=N1lKI7BXQ0mWdDegNnVyBA==

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPLpmgcZPeeYWylDcp-7IfQ9x4iQokV-Iz9QJgFdnXhQIOdaMZsHX-7LHd_6kW9lJpqgbuZJtQzSreZvJdv8hlMRsyyCTNk&google_hm=N1lKI7BXQ0mWdDegNnVyBA==
date: Mon, 05 Jul 2021 18:48:30 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9273
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEGGeLEtZIcK8HSsaUMwXqMg&google_cver=1&google_push=AYg5qPILE7xw6FSaa5UlfkmXUwWt9hSztO6cqnoQw-XMu1VbTx85esR9Tu7Jw831YsouG0cP5LcqX2QJYWZqrvEylcioOpXLQA
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEGGeLEtZIcK8HSsaUMwXqMg&google_cver=1&google_push=AYg5qPILE7xw6FSaa5UlfkmXUwWt9hSztO6cqnoQw-XMu1VbTx85esR9Tu7Jw831YsouG0cP5LcqX2QJYWZqrvEylcioO...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPILE7xw6FSaa5UlfkmXUwWt9hSztO6cqnoQw-XMu1VbTx85esR9Tu7Jw831YsouG0cP5LcqX2QJYWZqrvEylcioOpXLQA

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPILE7xw6FSaa5UlfkmXUwWt9hSztO6cqnoQw-XMu1VbTx85esR9Tu7Jw831YsouG0cP5LcqX2QJYWZqrvEylcioOpXLQA

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPILE7xw6FSaa5UlfkmXUwWt9hSztO6cqnoQw-XMu1VbTx85esR9Tu7Jw831YsouG0cP5LcqX2QJYWZqrvEylcioOpXLQA
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET

pixel
cm.g.doubleclick.net/ Frame 9273
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YONT-uuebcUg9L1Ytyx5NQAABLQAAAAB&google_gid=CAESEGOCAzr-WTM0AF3SXcQY7yo&google_push=AYg5qPIXxFDF889u6mEIIMT-UYyGYOwVN3m1dFMJqWGjFRO3Iae...

0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9273
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEBM0Lx34g27g8V5Zityf5Yk&google_cver=1&google_push=AYg5qPJY4UmjxZzq27uOiCSI88tUmKW5WevbWI6sfVo67IA3UALjqAiYJoyS9DFfLWVpjWJSph...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1HTTNfeC5aRTJ1RmtTb0VwQ0RucUIyMFBnaXNTbkp5Wn5B&google_push=AYg5qPJY4UmjxZzq27uOiCSI88tUmKW5WevbWI6sfVo67IA3UALjqAiYJ...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1HTTNfeC5aRTJ1RmtTb0VwQ0RucUIyMFBnaXNTbkp5Wn5B&google_push=AYg5qPJY4UmjxZzq27uOiCSI88tUmKW5WevbWI6sfVo67IA3UALjqAiYJ...

170 B
188 B

21ms
21ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1HTTNfeC5aRTJ1RmtTb0VwQ0RucUIyMFBnaXNTbkp5Wn5B&google_push=AYg5qPJY4UmjxZzq27uOiCSI88tUmKW5WevbWI6sfVo67IA3UALjqAiYJoyS9DFfLWVpjWJSphSQxbfvHdGGK7n45WxHK1_PW2yD&google_tc=

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:37 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1HTTNfeC5aRTJ1RmtTb0VwQ0RucUIyMFBnaXNTbkp5Wn5B&google_push=AYg5qPJY4UmjxZzq27uOiCSI88tUmKW5WevbWI6sfVo67IA3UALjqAiYJoyS9DFfLWVpjWJSphSQxbfvHdGGK7n45WxHK1_PW2yD&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 460
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 9273 0
12 B 17ms
14ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K6gp4uYkPMi0IbCeN6I2593ZCByD4Hwt5ZHNsq3OcVDIA9aQ0QyvqRB2RvP6m5nfTCzRqBlw

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET /
google2waycm.netmng.com/cm/ Frame D769 0
0

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame D769 70 B
264 B 39ms
32ms Image
image/gif 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEOdsMruf5wSLZmexcJZwo9o&google_cver=1&google_push=AYg5qPJzIGdEVy6xuMgzb2-RTH9yWcwLeVBpBkmW3sNdcAmTKproWml65aGdAUUU4yNELLN701WQouC5gmeip7HNhSKY2oMCLJ0
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D769
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEPTYBuwrokFqwhxBKwrURIY&google_cver=1&google_push=AYg5qPLdqfmxXkMKosxaBKj2O9fU8spXkDmHncHEGo5OC3OmMzNBsE1nOAwTYV9gtUzaFoZqSWELWUgETYgi1c...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk4MTUxNjIyNzgwNjI5NjIxNw%3D%3D&google_push=AYg5qPLdqfmxXkMKosxaBKj2O9fU8spXkDmHncHEGo5OC3OmMzNBsE1nOAwTYV9gtUzaFoZqSWELWUgETYgi1c833m...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk4MTUxNjIyNzgwNjI5NjIxNw%3D%3D&google_push=AYg5qPLdqfmxXkMKosxaBKj2O9fU8spXkDmHncHEGo5OC3OmMzNBsE1nOAwTYV9gtUzaFoZqSWELWUgETYgi1c833m...

170 B
188 B

18ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk4MTUxNjIyNzgwNjI5NjIxNw%3D%3D&google_push=AYg5qPLdqfmxXkMKosxaBKj2O9fU8spXkDmHncHEGo5OC3OmMzNBsE1nOAwTYV9gtUzaFoZqSWELWUgETYgi1c833muBIN2evjM&google_tc=

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:37 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk4MTUxNjIyNzgwNjI5NjIxNw%3D%3D&google_push=AYg5qPLdqfmxXkMKosxaBKj2O9fU8spXkDmHncHEGo5OC3OmMzNBsE1nOAwTYV9gtUzaFoZqSWELWUgETYgi1c833muBIN2evjM&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 426
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D769
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESED9wnwP-RHALrwUnyuQpLqo&google_cver=1&google_push=AYg5qPK_fa-NJ5C3XFqkQtO25abtr4XCSRIgnmNvVXM-VgQE_tLAP_PU3BvfhAEeqvwJt6CM0C79MMZtPgNXR3jwqVxPemRM9A
https://d5p.de17a.com/cookies/google;c?google_gid=CAESED9wnwP-RHALrwUnyuQpLqo&google_cver=1&google_push=AYg5qPK_fa-NJ5C3XFqkQtO25abtr4XCSRIgnmNvVXM-VgQE_tLAP_PU3BvfhAEeqvwJt6CM0C79MMZtPgNXR3jwqVxPe...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPK_fa-NJ5C3XFqkQtO25abtr4XCSRIgnmNvVXM-VgQE_tLAP_PU3BvfhAEeqvwJt6CM0C79MMZtPgNXR3jwqVxPemRM9A

170 B
188 B

17ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPK_fa-NJ5C3XFqkQtO25abtr4XCSRIgnmNvVXM-VgQE_tLAP_PU3BvfhAEeqvwJt6CM0C79MMZtPgNXR3jwqVxPemRM9A

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPK_fa-NJ5C3XFqkQtO25abtr4XCSRIgnmNvVXM-VgQE_tLAP_PU3BvfhAEeqvwJt6CM0C79MMZtPgNXR3jwqVxPemRM9A
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D769
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEOXk8cJGM1163edwyDSk6xk&google_cver=1&google_push=AYg5qPKWZSRz2PBtjOkjtqdCBjfwv9blRajqi31si-dd5kCW22NuVXo2yoH05i6aj1UvahUksSaL_n4xj5UebDnyFN8Y_LcxYdk
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKWZSRz2PBtjOkjtqdCBjfwv9blRajqi31si-dd5kCW22NuVXo2yoH05i6aj1UvahUksSaL_n4xj5UebDnyFN8Y_LcxYdk&google_hm=SxVaEfrqwb0tZH_BgJv4Gg==

170 B
188 B

20ms
20ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKWZSRz2PBtjOkjtqdCBjfwv9blRajqi31si-dd5kCW22NuVXo2yoH05i6aj1UvahUksSaL_n4xj5UebDnyFN8Y_LcxYdk&google_hm=SxVaEfrqwb0tZH_BgJv4Gg==

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKWZSRz2PBtjOkjtqdCBjfwv9blRajqi31si-dd5kCW22NuVXo2yoH05i6aj1UvahUksSaL_n4xj5UebDnyFN8Y_LcxYdk&google_hm=SxVaEfrqwb0tZH_BgJv4Gg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: ji2bhg8n9muf4jckiq1v5fc9l5nog8vk

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D769
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEFra5rBHb6TOcwJKmfQ8QPg&google_cver=1&google_push=AYg5qPIIGEUSd_L3_dLGGdyWv-HN3NUcipwDt8SQpPjNAMawM7vu-xSOhs_Qg-d7lNGzS71RVjohZEz1s7YaYW8cl...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEFra5rBHb6TOcwJKmfQ8QPg&google_cver=1&google_push=AYg5qPIIGEUSd_L3_dLGGdyWv-HN3NUcipwDt8SQpPjNAMawM7vu-xSOhs_Qg-d7lNGzS71RVjohZEz1s7YaYW8cl...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIIGEUSd_L3_dLGGdyWv-HN3NUcipwDt8SQpPjNAMawM7vu-xSOhs_Qg-d7lNGzS71RVjohZEz1s7YaYW8clSvYLOD1wEU&google_hm=52192cf610b163185d99b45b

170 B
188 B

18ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIIGEUSd_L3_dLGGdyWv-HN3NUcipwDt8SQpPjNAMawM7vu-xSOhs_Qg-d7lNGzS71RVjohZEz1s7YaYW8clSvYLOD1wEU&google_hm=52192cf610b163185d99b45b

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 05 Jul 2021 18:48:30 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIIGEUSd_L3_dLGGdyWv-HN3NUcipwDt8SQpPjNAMawM7vu-xSOhs_Qg-d7lNGzS71RVjohZEz1s7YaYW8clSvYLOD1wEU&google_hm=52192cf610b163185d99b45b
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D769
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEK_MI3pmJDuSOjJR82H4dqc&google_cver=1&google_push=AYg5qPJM8P1eGXMIEZzKKuLfHbcvkuSZ1XbKQ1coEBUcrvDV-L1cMIA6B5Gh9AyLGQOlK__rXwLRvfSw6ZMxxOx9DovMNXULz9g
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzc1NTc0MDMwNTMwNTUwMjY0OQ%3D%3D&google_push=AYg5qPJM8P1eGXMIEZzKKuLfHbcvkuSZ1XbKQ1coEBUcrvDV-L1cMIA6B5Gh...

170 B
188 B

20ms
19ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzc1NTc0MDMwNTMwNTUwMjY0OQ%3D%3D&google_push=AYg5qPJM8P1eGXMIEZzKKuLfHbcvkuSZ1XbKQ1coEBUcrvDV-L1cMIA6B5Gh9AyLGQOlK__rXwLRvfSw6ZMxxOx9DovMNXULz9g

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzc1NTc0MDMwNTMwNTUwMjY0OQ%3D%3D&google_push=AYg5qPJM8P1eGXMIEZzKKuLfHbcvkuSZ1XbKQ1coEBUcrvDV-L1cMIA6B5Gh9AyLGQOlK__rXwLRvfSw6ZMxxOx9DovMNXULz9g
date: Mon, 05 Jul 2021 18:48:29 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame D769 0
12 B 22ms
16ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IS2VZRmAIMAlLWr9CEmaTLuLF-xqcS_JgqQBQOAJN-AGYkflBBZYFSNV2JmOFt_yp2NgdR

Requested by

Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame CBC1 110 KB
38 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/60669678/20210618051901288/300x250.html?e=69&leftOffset=0&topOffset=0&c=0QVTLmJlT9&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60669678/20210618051901288/300x250.html?e=69&leftOffset=0&topOffset=0&c=0QVTLmJlT9&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 16:18:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9002
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Jul 2021 16:18:27 GMT

GET
H3-29 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame CBC1 60 KB
24 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/60669678/20210618051901288/300x250.html?e=69&leftOffset=0&topOffset=0&c=0QVTLmJlT9&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60669678/20210618051901288/300x250.html?e=69&leftOffset=0&topOffset=0&c=0QVTLmJlT9&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Jul 2021 18:48:29 GMT

GET
H3-29 200 yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js Show response
pagead2.googlesyndication.com/bg/ Frame C88B 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c971ec4829376335946d1beaa191f2c64a48e8954b422dea372c2d9029177b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 10:29:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29912
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5747
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 10:29:57 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5309 0
23 B 43ms
43ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 18:48:29 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 ts.js Show response
cdn.retailads.net/ Frame 74EC 5 KB
5 KB 4ms
3ms Script
application/javascript 2a01:4f8:d0a:2321::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.retailads.net/ts.js
Requested by: Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=739274653
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 2a01:4f8:d0a:2321::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 06a1b5afc54f03b03f1ec1d55390a43b7d0bea926033263e0988e33a8db55d19

Request headers

Referer: https://futalis.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:29 GMT
last-modified: Thu, 17 Jun 2021 11:09:56 GMT
server: Apache
accept-ranges: bytes
etag: "13e5-5c4f43f50991d"
content-length: 5093
content-type: application/javascript

GET
H3-29 200 CodeProLCW05-Regular.woff
s0.2mdn.net/creatives/assets/2560291/ Frame CBC1 52 KB
52 KB 8ms
8ms Font
font/woff 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/2560291/CodeProLCW05-Regular.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/60669678/20210618051901288/300x250.html?e=69&leftOffset=0&topOffset=0&c=0QVTLmJlT9&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65ec5e0481c4ceacde8c5e8fab9d5305fc68496b8c75d7d58fb0e91feaf7f598

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60669678/20210618051901288/300x250.html?e=69&leftOffset=0&topOffset=0&c=0QVTLmJlT9&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:44:25 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 12:12:00 GMT
server: sffe
age: 244
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52901
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:59:25 GMT

GET
H3-29 200 CodeProBoldLCW05-Regular.woff
s0.2mdn.net/creatives/assets/2560291/ Frame CBC1 48 KB
48 KB 9ms
8ms Font
font/woff 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/2560291/CodeProBoldLCW05-Regular.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/60669678/20210618051901288/300x250.html?e=69&leftOffset=0&topOffset=0&c=0QVTLmJlT9&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92426eb5437b357b9046670556ba89baa8384edcc8734f56b813745bdb9e1cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60669678/20210618051901288/300x250.html?e=69&leftOffset=0&topOffset=0&c=0QVTLmJlT9&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:39:26 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 12:11:57 GMT
server: sffe
age: 543
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49198
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:54:26 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame CBC1 5 KB
4 KB 16ms
16ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3e9b1d10ede83f6766a54c519654b9b00bcd4f6653f7f7a266b37505c40d18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 18:48:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4264
x-xss-protection: 0

GET
H3-29 200 60005582_20210618072504034_SIM-Only_Allnet-L-3GB_ASSET.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame CBC1 8 KB
8 KB 7ms
6ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210618072504034_SIM-Only_Allnet-L-3GB_ASSET.png

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06d56e52ce514b06050eecdf6354e560988b84ed578e6f1dfc505c735768e3be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/60669678/20210618051901288/300x250.html?e=69&leftOffset=0&topOffset=0&c=0QVTLmJlT9&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 04 Jul 2021 23:48:02 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Jun 2021 14:25:04 GMT
server: sffe
age: 68427
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7749
x-xss-protection: 0
expires: Mon, 05 Jul 2021 23:48:02 GMT

GET
H/1.1 200
OK postview.gif
portal.blau.de/nws/img/ Frame CBC1 43 B
562 B 29ms
9ms Image
image/gif 82.113.101.236
TDDE-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.blau.de/nws/img/postview.gif?partnerId=BLU_DSP_TRA_HAV_34114_PV&mediacode=25093339_4307561_290728453_101070526_-0
Requested by: Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 82.113.101.236 Offenbach, Germany, ASN6805 (TDDE-ASN1, DE),
Reverse DNS: portal.blau.de
Software: Apache /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:29 GMT
Last-Modified: Wed, 26 Aug 2020 10:11:24 GMT
Server: Apache
ETag: "2b-5adc50abeeb00"
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame E756 59 KB
60 KB 300ms
20ms Script
application/javascript 13.225.87.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3432245&wgcampaignid=99582&viewref=10083600184413200710612011646020&js=1&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-52.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a91a21b8a5843a8d8fac4d3916d5eb926ea4917b7d27dbee00ae068f4dd9d07e

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 05:47:49 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Mon, 28 Jun 2021 16:00:47 GMT
server: AmazonS3
age: 46842
etag: "edfa65aada7c65cbe3a78f39f8444ab3"
x-cache: Hit from cloudfront
x-amz-version-id: 9gxRQLkEbSwlqYx89yHTPWBPBM9yYdWx
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-type: application/javascript
content-length: 60765
x-amz-cf-id: QyxO7p7AL27wk-gmcQUjOTGIqMlPsQMuGD4Y1UAEpSuPUEA7eSz8kQ==

GET
H/1.1 200
OK hit Show response
diapi.webgains.com/2.0/ Frame E756 79 B
374 B 3383ms
32ms Script
text/javascript 81.29.72.47
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://diapi.webgains.com/2.0/hit?callback=hitCallback&wgpayload=Fta44iFBBNlY5Du4UXuKrnZ2CI9XkPrwVL6tqAhbrmQmkqlE4Ww.GEFF0Yz3ccbbJYMLgiPFU77qZoOSix5ezdstlYysrhsui6STpjB9TjQDKMhO3f9p_nH1u_eH3BhxUC550ialT0iakiEocEcEJ1w.CxUC541jlS7spjt.gEngMQEjZr_WhXTA2s.XTVV26y8GGEDd5ihORoVyFGh8cmvSuCKzIlnY6xljQlpRDuxfTNJxTqRejPm8LKfAaZ4ySy.aPjftckxOqJCFmJtHWIEkIwBzeI_OFev0tp.fgMaQDJztEqwhMBxEYYdtt_xvtqpI92PIbJlpMpwoNSUC56MnGWpwoNN5uQ32SCVc45BL6h2qvH_iLs2dI_AIQjvEodUW2vqCRc7L1eLY6Rpw.5B0KBHb5DK1civyfwEKyfhvqCSFQ_01kKJA237lY5BSmxQpw.64U&wgcookie=%7B%22wgifp268155%22%3A%5B%2299582%22%2C%22268155%22%2C%223432245%22%2C%22%22%2C%221625510909%22%2C%22https%253A%252F%252F8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com%252F%22%2C%22%22%2C%22%22%2C%221633286909%22%2C%2210083600184413200710612011646020%22%5D%7D&wgchecksum=7779b8ce89d14246f376b650df92a57b&userIP=89.249.64.203&doAffectv=1&wgtime=1625510909
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3432245&wgcampaignid=99582&viewref=10083600184413200710612011646020&js=1&nw=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.29.72.47 Brixton, United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 81-29-72-47.servers.dedipower.net
Software: Apache /
Resource Hash: d1e797c515a409448d82f20dc32e107fdaa19937330cfa859b6233e82cb2312a

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 05 Jul 2021 18:48:33 GMT
Server: Apache
Connection: close
Content-Length: 79
Content-Type: text/javascript;charset=utf-8

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame E756 667 B
1 KB 1340ms
23ms Image
image/jpeg 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=99582&viewref=32743100174323900951425011646012&wglinkid=3432245
Requested by: Host: 8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
URL: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 9ea21905a7edfa4ceda705f977891d5e100f9709318836cfacbab47ad3321ff1

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:31 GMT
Last-Modified: Mon, 05 Jul 2021 18:48:31 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/jpeg
Content-Length: 667
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame CBC1 17 KB
6 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 18:48:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Mon, 05 Jul 2021 18:48:30 GMT

GET
H3-29 200 u5qa6Bce0_JDlbgkcQuMCffbH_LjsHWDv7QaTzlh7sk.js Show response
pagead2.googlesyndication.com/bg/ Frame 2E0C 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/u5qa6Bce0_JDlbgkcQuMCffbH_LjsHWDv7QaTzlh7sk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb9a9ae8171ed3f24395b824710b8c09f7db1ff2e3b07583bfb41a4f3961eec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 13:52:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17788
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13289
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 16:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 13:52:02 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C88B 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B-v21_VPjYM6zKsnk7_UP1viFiA0AAAAAOAHgBAI&bg=!CwilCEzNAAYo4NJEKOA7ACkAdvg8Wl6MedpGHfFzWKxJuDsPPXh6KH-2JVJ0mp0xCo6NX2Ri5rVLuwIAAACMUgAAABVoAQeZAsTn5t9yPGh6LIbaqrMf7tVGNxnMNcDSNmIBqeTqk5Qhz3nQCOIX8xDSBqqNd5T3cahzjlGzWd6Lzl7vYYs2kTtNMuyAoUa8otiyeWLXsQw9IphWZQsTZJilRaxs0zpb_SyJUsiUJjHSuSFRhCnyFnZ5_3usTtJQGd81IWWHA-SlmI-FfiVSGCcIvbi5Ulxy-s9TLtVaKbEYZMTLrDjC7YrRLY9C37DLbM1Rq-hPY34QzFbb68XMwlrKV2lRY36kZ-VvMeWbbb-7m3V5QmSyl-Cn9QScdsMqG6u-wVjew3EMHN-qH2ZBo8ap6R6yYB4Y4ApInwtULVLR0iiudjKFu-f7Y0_vzv0fOFDRNcpBEbgaZAAu-bfRO3360kc6BSf3fHaCnUZ8ajKm1QqNMtG38rxyebbpTb-_yPHH2qG8QsCqpx3H3sddQWxPDbAlLBMHzAwxvxhw4o04bUOPtkojB1qIcZKI0PL9YhRV3x_5kQyJMsC-KRt5iWVPVKEeJ_eZh4JDz0XPq8tS8EJrfdkijcRc500kgvvZofSDPbnw-KwgfNLiEHG7aomg-SIMdjuhEeQ_0ObyFhz8RitBW-D8HsH49uMBLf966N6byehjTGi0rVtRVhDcU2AVR7Ov-p_qeYiR5xrMjTjFY6kzQld2DF85JG7ND3yFpST-xFephL9HSHaH2gyeOj4g5Wl_gA2gPHms8YaN_K_oCpBSPNkiuD-uO6LUsGt_pbB1Zfq99dc6stYrU9i3NtR-z657AOrQGJTezwSPNjdYBl3nY-_NyfcZ92m90v-5NjZhJfEdKrjNRsemvQClQypSjEJBLFJr6kzXONI2LjDgmQahpXS3jgCUvR81cpqYYdf31j7A-7haxTq_FufdmNKGQgRQ7oZ4Pyeeoaj-sDE_QrBimKGyCTsDTJBRs9TTJS9oFp_cAZXq7L7C_Kg

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 dc_pre=CLmz_YLMzPECFa4UBgAdIUAH5A;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2365766942013.8716
adservice.google.com/ddm/fls/z/ Frame 45DC 42 B
63 B 41ms
41ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CLmz_YLMzPECFa4UBgAdIUAH5A;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2365766942013.8716

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CLmz_YLMzPECFa4UBgAdIUAH5A;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2365766942013.8716?

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK fp_decode.html Show response
track.webgains.com/ Frame E756 63 B
270 B 355ms
32ms Fetch
application/json 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/fp_decode.html?wgpayload=Fta44iFBBNlY5Du4UXuKrnZ2CI9XkPrwVL6tqAhbrmQmkqlE4Ww.GEFF0Yz3ccbbJYMLgiPFU77qZoOSix5ezdstlYysrhsui6STpjB9TjQDKMhO3f9p_nH1u_eH3BhxUC550ialT0iakiEocEcEJ1w.CxUC541jlS7spjt.gEngMQEjZr_WhXTA2s.XTVV26y8GGEDd5ihORoVyFGh8cmvSuCKzIlnY6xljQlpRDuxfTNJxTqRejPm8LKfAaZ4ySy.aPjftckxOqJCFmJtHWIEkIwBzeI_OFev0tp.fgMaQDJztEqwhMBxEYYdtt_xvtqpI92PIbJlpMpwoNSUC56MnGWpwoNN5uQ32SCVc45BL6gL4MKKmr.S9RdPQSzOy_Aw7UTlf_01kKHoNv_jV.lV9dXJslmcK4rUpUWujokyxYMJ5tFFg4K1kl1BNlY6RjLxU..CKN
Requested by: Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 84f8704bdc07ab2809b5a9dd028ef0c9e0001bd0b21c32fc06c18231069a581e

Request headers

Accept: application/json
Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 05 Jul 2021 18:48:30 GMT
Server: Apache
Connection: close
Keep-Alive: timeout=1, max=100
Content-Length: 63
Content-Type: application/json

GET
H3-29 200 css
fonts.googleapis.com/ Frame B46B 1 KB
418 B 25ms
22ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=10083600184413200710612011646020&a=437de341

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9c1521286e7dd2d6f8c2262b15bca8867bcae973a83879accdd00e1cb9831e5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 17:42:25 GMT
server: ESF
date: Mon, 05 Jul 2021 18:48:30 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Jul 2021 18:48:30 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame B46B 14 KB
14 KB 346ms
73ms Image
image/png 144.76.104.53
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/49107/creativesup/forever_young_strunz_reachgroup_1200x627.jpg
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=10083600184413200710612011646020&a=437de341
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.104.53 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: b47755212bb09d7e9bef7d15a9b86181aaa567ad255f8098f37f663cb183cc1c

Request headers

Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:30 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 14281
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame B46B 15 KB
15 KB 3157ms
104ms Image
image/png 144.76.104.53
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/52113/creativesup/TRG-star-wars-marvel-comics-panini-banner-1200x627.jpg
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=10083600184413200710612011646020&a=437de341
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.104.53 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 517160645f80c22d4ab4b8b7a1a591a57ea16b8cdd5e9847dd1f9c483a9bf86a

Request headers

Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:33 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 15043
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame B46B 13 KB
13 KB 7228ms
13ms Image
image/png 144.76.104.53
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/1200x627.jpg
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=10083600184413200710612011646020&a=437de341
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.104.53 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 5e22c0f8ba63719bd7774a21627e83b591b02e3a2a6682b40145a954b3844044

Request headers

Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:37 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12988
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal900020.redintelligence.net/ Frame B46B 0
150 B 36ms
12ms Script
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/viewability?s=10083600184413200710612011646020&a=95995e04&vb=m
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=10083600184413200710612011646020&a=437de341
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal900020.redintelligence.net/request_content.php?s=10083600184413200710612011646020&a=437de341
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 18:48:30 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame E756 16 B
232 B 69ms
68ms Fetch
application/json 54.72.233.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.72.233.75 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/7.4.19

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 05 Jul 2021 18:48:31 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.19
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 342ms
30ms Preflight 54.72.233.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Server: 54.72.233.75 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 05 Jul 2021 18:48:31 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS

POST
H/1.1 200
OK attention-event Show response
sr.studiostack.com/track/ 0
396 B 136ms
136ms XHR
text/plain 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Requested by: Host: sr.studiostack.com
URL: https://sr.studiostack.com/v3/services
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:30 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Access-Control-Allow-Origin: *
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 0
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

OPTIONS
H/1.1 200
OK attention-event
sr.studiostack.com/track/ Frame 0
0 106ms
105ms Preflight
text/html 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Protocol: HTTP/1.1
Server: 20.49.104.19 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://mobilesyrup.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Allow: POST
Content-Length: 4
Content-Type: text/html; charset=utf-8
Expires: 0
ETag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Date: Mon, 05 Jul 2021 18:48:30 GMT

POST
H2 200 /
track.adform.net/serving/unload/ Frame C1DB 35 B
477 B 29ms
29ms Ping
image/gif 37.157.2.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/serving/unload/?version=15&unload=3571236432544479231@@46799729,4907929422387495783,0|0|0|0|0|0|0|0|0||0|1|31|6db451c165e0f1a4d35dff141f2251f79fb8a391_1|||1|0|0|ynFHM9im_k248M5tcwHHbdLZDlReV91cbZnvBbSZKb4KHauOHX6SiMkllzAqADQrA7z_uuw_WOM1|||11|

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://smarttag.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:33 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://smarttag.rubiconproject.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

POST
H/1.1 200
OK attention-event Show response
sr.studiostack.com/track/ 0
396 B 98ms
97ms XHR
text/plain 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Requested by: Host: sr.studiostack.com
URL: https://sr.studiostack.com/v3/services
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:35 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Access-Control-Allow-Origin: *
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 0
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

OPTIONS
H/1.1 200
OK attention-event
sr.studiostack.com/track/ Frame 0
0 98ms
97ms Preflight
text/html 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Protocol: HTTP/1.1
Server: 20.49.104.19 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://mobilesyrup.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Allow: POST
Content-Length: 4
Content-Type: text/html; charset=utf-8
Expires: 0
ETag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Date: Mon, 05 Jul 2021 18:48:35 GMT

GET
H2 200 dc_oe=ChMIm4yngczM8QIVLor9Bx2DAQZbEAAYACCCpfY-QhMI25PrgMzM8QIVPeG7CB1KSwd2;met=1;&timestamp=1625510917283;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 9D65 42 B
515 B 65ms
42ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIm4yngczM8QIVLor9Bx2DAQZbEAAYACCCpfY-QhMI25PrgMzM8QIVPeG7CB1KSwd2;met=1;&timestamp=1625510917283;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 dc_oe=ChMI-JLmgczM8QIVLor9Bx2DAQZbEAAYACDihtg-QhMI2svGgczM8QIV3OS7CB2KNAwA;met=1;&timestamp=1625510917896;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 6C4C 42 B
63 B 55ms
41ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI-JLmgczM8QIVLor9Bx2DAQZbEAAYACDihtg-QhMI2svGgczM8QIV3OS7CB2KNAwA;met=1;&timestamp=1625510917896;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 dc_oe=ChMIgeOlgszM8QIVbVjlCh0llw5hEAAYACDd_-AxQhMIvaX9gczM8QIVaNe7CB3FWQnZ;met=1;&timestamp=1625510918898;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 8996 42 B
63 B 42ms
42ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIgeOlgszM8QIVbVjlCh0llw5hEAAYACDd_-AxQhMIvaX9gczM8QIVaNe7CB3FWQnZ;met=1;&timestamp=1625510918898;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 dc_oe=ChMIjqbngszM8QIVSfK7CB1WfAHREAAYACC-7ZgwQhMIssm_gszM8QIVDei7CB39Hga2;met=1;&timestamp=1625510919961;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 5309 42 B
63 B 42ms
42ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIjqbngszM8QIVSfK7CB1WfAHREAAYACC-7ZgwQhMIssm_gszM8QIVDei7CB39Hga2;met=1;&timestamp=1625510919961;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK attention-event Show response
sr.studiostack.com/track/ 0
396 B 97ms
96ms XHR
text/plain 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Requested by: Host: sr.studiostack.com
URL: https://sr.studiostack.com/v3/services
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mobilesyrup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 18:48:40 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Access-Control-Allow-Origin: *
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 0
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

OPTIONS
H/1.1 200
OK attention-event
sr.studiostack.com/track/ Frame 0
0 104ms
103ms Preflight
text/html 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Protocol: HTTP/1.1
Server: 20.49.104.19 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://mobilesyrup.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Allow: POST
Content-Length: 4
Content-Type: text/html; charset=utf-8
Expires: 0
ETag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Date: Mon, 05 Jul 2021 18:48:40 GMT

GET
H2 200 dc_oe=ChMIm4yngczM8QIVLor9Bx2DAQZbEAAYACCCpfY-QhMI25PrgMzM8QIVPeG7CB1KSwd2;met=1;&timestamp=1625510927282;eid1=2;ecn1=0;etm1=10;
ade.googlesyndication.com/ddm/activity/ Frame 9D65 42 B
107 B 44ms
44ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIm4yngczM8QIVLor9Bx2DAQZbEAAYACCCpfY-QhMI25PrgMzM8QIVPeG7CB1KSwd2;met=1;&timestamp=1625510927282;eid1=2;ecn1=0;etm1=10;

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMI-JLmgczM8QIVLor9Bx2DAQZbEAAYACDihtg-QhMI2svGgczM8QIV3OS7CB2KNAwA;met=1;&timestamp=1625510927896;eid1=2;ecn1=0;etm1=10;
ade.googlesyndication.com/ddm/activity/ Frame 6C4C 42 B
107 B 42ms
42ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI-JLmgczM8QIVLor9Bx2DAQZbEAAYACDihtg-QhMI2svGgczM8QIV3OS7CB2KNAwA;met=1;&timestamp=1625510927896;eid1=2;ecn1=0;etm1=10;

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 dc_oe=ChMIgeOlgszM8QIVbVjlCh0llw5hEAAYACDd_-AxQhMIvaX9gczM8QIVaNe7CB3FWQnZ;met=1;&timestamp=1625510928898;eid1=2;ecn1=0;etm1=10;
ade.googlesyndication.com/ddm/activity/ Frame 8996 42 B
63 B 43ms
42ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIgeOlgszM8QIVbVjlCh0llw5hEAAYACDd_-AxQhMIvaX9gczM8QIVaNe7CB3FWQnZ;met=1;&timestamp=1625510928898;eid1=2;ecn1=0;etm1=10;

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8da0c533a743f6f4fcd2a0294e86291e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 18:48:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 dc_oe=ChMIjqbngszM8QIVSfK7CB1WfAHREAAYACC-7ZgwQhMIssm_gszM8QIVDei7CB39Hga2;met=1;&timestamp=1625510929961;eid1=2;ecn1=0;etm1=10;
ade.googlesyndication.com/ddm/activity/ Frame 5309 42 B
63 B 41ms
41ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIjqbngszM8QIVSfK7CB1WfAHREAAYACC-7ZgwQhMIssm_gszM8QIVDei7CB39Hga2;met=1;&timestamp=1625510929961;eid1=2;ecn1=0;etm1=10;

Requested by

Host: mobilesyrup.com
URL: https://mobilesyrup.com/2021/07/05/google-removes-nine-popular-apps-that-stole-users-facebook-passwords/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS