heromc.net Open in urlscan Pro
2606:4700:3034::ac43:b1b3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://heromc.net/
Effective URL:
https://heromc.net/
Submission: On February 09 via api (February 9th 2024, 2:43:44 pm UTC) from US — Scanned from DE

Summary HTTP 222 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 28 IPs in 4 countries across 20 domains to perform 222 HTTP transactions. The main IP is 2606:4700:3034::ac43:b1b3, located in United States and belongs to CLOUDFLARENET, US. The main domain is heromc.net.
TLS certificate: Issued by GTS CA 1P5 on January 20th 2024. Valid for: 3 months.

This is the only time heromc.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 53	2606:4700:303... 2606:4700:3034::ac43:b1b3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
3	103.142.218.245 103.142.218.245	135987 (INDRA-REL...) (INDRA-RELOAD-AS-VN Reload Company Limited)
3	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42::649 2a04:4e42::649	54113 (FASTLY) (FASTLY)
3	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:303... 2606:4700:3030::6815:5794	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
16	2a03:2880:f08... 2a03:2880:f083:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2606:4700::68... 2606:4700::6812:d73b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
37	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
2 4	2a00:1450:400... 2a00:1450:4001:830::2004	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
3 15	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f17... 2a03:2880:f176:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
28	2a00:1450:400... 2a00:1450:4001:828::2001	15169 (GOOGLE) (GOOGLE)
6	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
18	2a00:1450:400... 2a00:1450:4001:808::2006	15169 (GOOGLE) (GOOGLE)
3 4	172.217.18.2 172.217.18.2	15169 (GOOGLE) (GOOGLE)
2 4	172.64.151.101 172.64.151.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 4	185.89.210.244 185.89.210.244	29990 (ASN-APPNEX) (ASN-APPNEX)
2	142.250.185.70 142.250.185.70	15169 (GOOGLE) (GOOGLE)
222	28

53 2606:4700:3034::ac43:b1b3 (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

heromc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 103.142.218.245 (Viet Nam)

ASN135987 (INDRA-RELOAD-AS-VN Reload Company Limited, VN)

id.heromc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3030::6815:5794 (United States)

ASN13335 (CLOUDFLARENET, US)

mc-heads.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
scontent.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:d73b (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

37 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:830::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f176:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:808::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.18.2 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.64.151.101 (San Francisco, United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.89.210.244 (Frankfurt am Main, Germany) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.70 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
65	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 114 tpc.googlesyndication.com — Cisco Umbrella Rank: 160	987 KB
56	heromc.net 3 redirects heromc.net id.heromc.net	3 MB
22	doubleclick.net 6 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 35 stats.g.doubleclick.net — Cisco Umbrella Rank: 80 cm.g.doubleclick.net — Cisco Umbrella Rank: 258 ad.doubleclick.net — Cisco Umbrella Rank: 157	238 KB
19	gstatic.com fonts.gstatic.com www.gstatic.com	888 KB
18	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 321	166 KB
14	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 1048 scontent.xx.fbcdn.net — Cisco Umbrella Rank: 473	320 KB
6	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 139
6	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31 ajax.googleapis.com — Cisco Umbrella Rank: 366	99 KB
5	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 2 region1.analytics.google.com — Cisco Umbrella Rank: 2720	2 KB
4	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 252	4 KB
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 627	2 KB
3	onesignal.com cdn.onesignal.com — Cisco Umbrella Rank: 4439 onesignal.com — Cisco Umbrella Rank: 1408	73 KB
3	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1103	33 KB
3	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 223	88 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 102	21 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 171	90 KB
1	google.de www.google.de — Cisco Umbrella Rank: 6562	408 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	90 KB
1	mc-heads.net mc-heads.net — Cisco Umbrella Rank: 807588	9 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 761	94 KB
222	20

	Domain	Requested by
53	heromc.net	3 redirects heromc.net ajax.googleapis.com
37	pagead2.googlesyndication.com	heromc.net pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net www.gstatic.com
28	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net heromc.net
18	s0.2mdn.net	heromc.net s0.2mdn.net
15	googleads.g.doubleclick.net	3 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net heromc.net
12	static.xx.fbcdn.net	www.facebook.com static.xx.fbcdn.net
11	www.gstatic.com	www.google.com googleads.g.doubleclick.net
8	fonts.gstatic.com	fonts.googleapis.com
6	www.googleadservices.com
5	fonts.googleapis.com	heromc.net googleads.g.doubleclick.net
4	ib.adnxs.com	3 redirects googleads.g.doubleclick.net
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net
4	www.google.com	2 redirects heromc.net tpc.googlesyndication.com
3	maxcdn.bootstrapcdn.com	id.heromc.net
3	cdnjs.cloudflare.com	id.heromc.net cdnjs.cloudflare.com
3	id.heromc.net	heromc.net id.heromc.net
2	ad.doubleclick.net	heromc.net
2	scontent.xx.fbcdn.net	www.facebook.com
2	www.facebook.com	connect.facebook.net
2	cdn.onesignal.com	heromc.net cdn.onesignal.com
2	connect.facebook.net	heromc.net connect.facebook.net
1	onesignal.com	cdn.onesignal.com
1	www.google.de
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	ajax.googleapis.com	heromc.net
1	www.googletagmanager.com	heromc.net
1	mc-heads.net	id.heromc.net
1	code.jquery.com	id.heromc.net
222	30

This site contains links to these domains. Also see Links.

Domain
id.heromc.net
www.facebook.com
earth.heromc.net
minefc.com

Subject Issuer	Validity	Valid
heromc.net GTS CA 1P5	`2024-01-20` - `2024-04-19`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
id.heromc.net R3	`2024-01-25` - `2024-04-24`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
bootstrapcdn.com GTS CA 1P5	`2024-01-28` - `2024-04-27`	3 months	crt.sh
mc-heads.net E1	`2024-01-30` - `2024-04-29`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-11-18` - `2024-02-16`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh

This page contains 24 frames:

Primary Page: https://heromc.net/
Frame ID: 409652CEB7BA5A8292809576F39D8BF1
Requests: 75 HTTP requests in this frame

Frame: https://id.heromc.net/member/top/head-top.php
Frame ID: 5568ACC6841085B83403385EB0ECB057
Requests: 11 HTTP requests in this frame

Frame: https://heromc.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js
Frame ID: 34EA726CD32BD9EE6CACE01449462463
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20190131/zrt_lookup_fy2021.html
Frame ID: B85BD4C193E7987E1095BC9F06AB4B4E
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v17.0/plugins/page.php?adapt_container_width=true&app_id=737463590128289&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfb998dbd1de720c2d%26domain%3Dheromc.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fheromc.net%252Ff3861c9b316657417%26relation%3Dparent.parent&container_width=205&height=250&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fheromc.net%2F&locale=vi_VN&sdk=joey&show_facepile=true&small_header=false&width=235
Frame ID: 4F145327A5C7D21350E4922A01BE421A
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5905678404304295&output=html&adk=1812271804&adf=3025194257&lmt=1707337638&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=308x945_l%7C308x945_r&format=0x0&url=https%3A%2F%2Fheromc.net%2F&pra=5&wgl=1&easpi=1&asro=0&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6~9~15&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707489818077&bpp=3&bdt=3645&idt=362&shv=r20240207&mjsv=m202402010101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2653707993091&frm=20&pv=2&ga_vid=794529133.1707489818&ga_sid=1707489818&ga_hid=1471790896&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44808397%2C31080780%2C44795921%2C31080932%2C95320869%2C95324154%2C95324160%2C95324267&oid=2&pvsid=4143772374498493&tmod=1660664628&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=374
Frame ID: 7B6F684EB469D07B8DEE1A1534174C9E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5905678404304295&output=html&h=280&slotname=5270923614&adk=2616852592&adf=2704279354&pi=t.ma~as.5270923614&w=702&fwrn=4&fwrnh=100&lmt=1707337638&rafmt=1&format=702x280&url=https%3A%2F%2Fheromc.net%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707489818080&bpp=1&bdt=3648&idt=375&shv=r20240207&mjsv=m202402010101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2653707993091&frm=20&pv=1&ga_vid=794529133.1707489818&ga_sid=1707489818&ga_hid=1471790896&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=325&ady=588&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44808397%2C31080780%2C44795921%2C31080932%2C95320869%2C95324154%2C95324160%2C95324267&oid=2&pvsid=4143772374498493&tmod=1660664628&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=377
Frame ID: 65B10564AE5D997E52705B8419472875
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 974204CD40CD9B8844043AD764FF1813
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 91195F0E9E3182016C93AFB5BE3ED3D4
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 245E2D1A305A0D2B0CD593885C17FA26
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js
Frame ID: 6A014A6BFD96A6D2B1E102598597E8FA
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: B9716871F12317A8CB16BDD367D89423
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 5FE7CDF27176BE8F1FBDCA64E5E613BE
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 6FCFEE342E827269A94268F1BE5AFE7B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: F51AEF6645BE7F732EABD6F136166C09
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhi4-fODAjAB&v=APEucNUiCzduNvfkY4uBOayWnMSr2KzpTmDbWe7XDMuv3iiKdxYKWO08jhxNAm1n0PNAK_tE6iTk7VXyFdb-kalLI7SZwl8DWsAvMEtvudorv1OPwXTTc7Onp63F58COipp5FsOzQhL6_nLS5IPFUr7hbnCgmVkCD8aJMtqQ2TuPrOCnyQWQNL0
Frame ID: 0B2A42C64E2A899BBAC60B6100CF6A20
Requests: 5 HTTP requests in this frame

Frame: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Frame ID: 04C0C9D8ABE56843FBE24757E28169FA
Requests: 12 HTTP requests in this frame

Frame: https://www.gstatic.com/mysidia/73134fbfa16854d24caf7cd541ab86d9.js?tag=client_fast_engine_2019
Frame ID: 62D5DD8C367237087E4E80BE6AA0B93C
Requests: 21 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: F662C66538741BC10EA5E3D473B29466
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 2810987E647F1CB8FC8D4190512F344A
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js
Frame ID: 1609A74EB5D300896B0EAE1886D49F32
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/index.html?ev=01_250
Frame ID: 8D7EF53F3ED4ACB40153E1AF7431CE04
Requests: 17 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js
Frame ID: C88CA1FB03815D43989DC6DCC2D222EC
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js
Frame ID: 607895D812D57CF48D944D3FAE20DAAE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

HeroMC.NET - Minecraft Việt Nam

Page URL History Show full URLs

http://heromc.net/ HTTP 301
https://heromc.net/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

OneSignal (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

cdn\.onesignal\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

222
Requests

95 %
HTTPS

78 %
IPv6

20
Domains

30
Subdomains

28
IPs

4
Countries

6114 kB
Transfer

10769 kB
Size

19
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://id.heromc.net/member/
Title: ĐĂNG NHẬP

Search URL Search Domain Scan URL

URL: https://www.facebook.com/groups/heromcvn/
Title: CỘNG ĐỒNG MINECRAFT

Search URL Search Domain Scan URL

URL: https://www.facebook.com/groups/497439987620397
Title: LỆNH-BUILD-ADDON

Search URL Search Domain Scan URL

URL: https://www.facebook.com/groups/200256224755516
Title: TỐ CÁO HACH/CHEAT

Search URL Search Domain Scan URL

URL: https://www.facebook.com/groups/heromc/
Title: NHÓM SERVER HEROMC

Search URL Search Domain Scan URL

URL: https://id.heromc.net/vi-pham/index.php
Title: DANH SÁCH VI PHẠM

Search URL Search Domain Scan URL

URL: https://earth.heromc.net/#earth;flat;23280,64,-1546;0
Title: MAP EARTH

Search URL Search Domain Scan URL

URL: https://minefc.com/tai-game/
Title: minecraft

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://heromc.net/ HTTP 301
https://heromc.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 67

https://heromc.net/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://heromc.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js

Request Chain 77

https://heromc.net/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://heromc.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js

Request Chain 119

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 120

https://googleads.g.doubleclick.net/pagead/adview?ai=CXvCnGjrGZeKqINztxtYP6PGfiAWLk8HmdcrjnujxEbCQHxABIOOZhxxglYKAgJQHoAH34pu0KMgBAqgDAcgDyQSqBMYBT9CDLrvZf99936zCJOBwRCUt-CHsua8tr_PaKyCp4jhNJRezIdnlXZ0FK9WSfrDWnVLPBKvGZCOm8MxS0afFJS_3PgjQIdEp0RJlRU9MfdtwsXFFkCkcCyKqD1nwlEYb-hhhFFLVPnIrYmBIvvNKO2LgI7Z9hm5QZ6oQKhYqw5QNTM473czJXT-DDStxrRahxaB57L1jzc-MGQqnCHA-Xs0T1Pwq9TAcX8yOofcltGLaVTqR98uyHIFg-qs43UOcKrFmJENgwATwot6pogSIBZ3NgI5EkgUECAQYAZIFBAgFGASgBgKAB_ea7JMDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwUQiPzHA9IIJgiA4YAQEAEYHzICqgI6CYBAgICEgICECEi9_cE6WOry2aC_noQDmgk9aHR0cHM6Ly9mcmVlLndlYmNvbXBhbmlvbi5jb20vbWluaW1lL2RlLz9jYW1wYWlnbj0xODI4Mjk4MTAyMYAKAcgLAdgTDdAVAYAXAbIXHAoaCAASFHB1Yi01OTA1Njc4NDA0MzA0Mjk1GAA&sigh=7CkIDmTHPBo&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgAvHhf_2f0VFh0_XOa60iLwkKIqjxVS0BxfePl1gDXUz0S1eHX8FVRrj0xaKD9x1oFoOOoUISDSWK8mIMNq-2dLQ5utR-wVnkYxLQ0DnBgB&cbvp=2&vis=1&nis=5 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%222304072450376908536%22,%22debug_reporting%22:true,%22destination%22:%22https://webcompanion.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210846925175%22],%2222%22:[%22true%22],%224%22:[%2202-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2213084884110994329873%22}&andc=true

Request Chain 179

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6VmNOlF496RFNrZ7LBAww&google_cver=1

Request Chain 180

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZcY6HFVbLb4AACmNABzz0gAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6VmNOlF496RFNrZ7LBAww&google_cver=1

Request Chain 181

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESECs1ynfH1Z3C2E-HWq8vBio&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECs1ynfH1Z3C2E-HWq8vBio%26google_cver%3D1

Request Chain 182

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjI1ODMzNTMyNzMyOTY3MTg5Mw%3D%3D

Request Chain 193

https://googleads.g.doubleclick.net/pagead/adview?ai=C2B2YGjrGZY-kIbzsn88PjJiv4AGb9MridejYs8bIEr_hHhABIOOZhxxglYKAgJQHoAHd8KrAKsgBCagDAcgDy4SAgASqBMkBT9Bi2S5gdeBZC6F4QdmXeKTZyOnrSYulHJmRKzbEI04XQlDXIZhPb0uPUvhbfddi6nsbi6gvPpSFRQ1Lge32dXqlutg3SU98udTbNf7BCsCtTdckX_xAbQAJJlWD0hFWH-DBpV2w4yHisRTd2pm2IYpRaZ0At9Uw2viqTIZPQP73Z5mjW8E-wAApRBSgn8rTq37kwyZWa62-Sb4Hc-WdH5qiF8r3lLXhojmeAhSmNDpdwMXxKTBb4B2EwnL1LvicdAKZ0A0WBHLNwATZ4fH82QSIBbbb8YtOkgUECAQYAZIFBAgFGASgBi6AB92o-58FqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQgIUS0ggmCIDhgBAQARgfMgKqAjoJgECAgISAgIQISL39wTpYk7_ZoL-ehAOaCYcBaHR0cHM6Ly9wZGZpeGVycy5jb20vZG93bmxvYWRQYWdlLmh0bWw_Y2FtcGFpZ25faWQ9MjA5NjI4OTczMzQmYWRncm91cF9pZD0xNjE1OTE2MTk4MDEmcGxhY2VtZW50X2lkPWhlcm9tYy5uZXQmY3JlYXRpdmVfaWQ9Njg4NjA0NTk2NDkwgAoByAsB2BMM0BUBmBYBgBcBshccChoIABIUcHViLTU5MDU2Nzg0MDQzMDQyOTUYAA&sigh=ROHNyAmYi5U&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgAvHhf_uT0XfFmUW9utaDYQKI6rPv-JBzTV_W2nVkwZMSVrGqrOP0fRVbinoUlnL1Xtgto0GjUMzoGDMRwsa2Fk-tXk2sAgud8EppkiwBgB&template_id=5000&cbvp=2&vis=1&nis=5 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2211189878034008156955%22,%22debug_reporting%22:true,%22destination%22:%22https://pdfixers.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211409209437%22],%2222%22:[%22true%22],%224%22:[%2202-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2217278254528365340977%22}&andc=true

Request Chain 201

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 204

https://googleads.g.doubleclick.net/pagead/adview?ai=CLUmkGjrGZZGkIbzsn88PjJiv4AGb9MridZjTs8bIEmQQASDjmYccYJWCgICUB6AB3fCqwCrIAQGoAwHIA8uEgIAEqgTKAU_QLcO4YiiGno0oo68rS38vLEVqt247zoDAazevo4f9NODnz0afNScJDftsK4oU228uXWuxPCrS2P8uTOH9w8yxZEdLx8y7S65rgJcA643d_goSp2r2QPtnBN1ntL3eMAkhYA5V4j8u2ahtBiLq_Kusklmu2IUhZg6rvfQ4Ezno02iBbbaZL9vA82-FMClvLRz5Uq8ef2KYpKpX1YIMLs-PjuOD8UIO9yuFFTIPeSHPjUpQcCSoCbT8Cg7g4gDMC_WT2_r3Shx22KvABLHh8fzZBIgFttvxi06SBQQIBBgBkgUECAUYBIAH3aj7nwWoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBC_mBbSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliTv9mgv56EA5oJhgFodHRwczovL3BkZml4ZXJzLmNvbS9kb3dubG9hZFBkZi5odG1sP2NhbXBhaWduX2lkPTIwOTYyODk3MzM0JmFkZ3JvdXBfaWQ9MTYxNTkxNjE5NzYxJnBsYWNlbWVudF9pZD1oZXJvbWMubmV0JmNyZWF0aXZlX2lkPTY4ODYwNDU5NjQ2M4AKAcgLAdgTDNAVAZgWAYAXAbIXHAoaCAASFHB1Yi01OTA1Njc4NDA0MzA0Mjk1GAA&sigh=BuXOZHITIMA&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgAvHhf_uT0XfFmUW9utaDYQKI6rPv-JBzTV_W2nVkwZMSVrGqrOP0fRVbinoUlnL1Xtgto0GjUMzoGDMRwsa2Fk-tXk2sAgud8EppkiwBgB&template_id=5001&cbvp=2&vis=1&nis=5 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228621838118255296098%22,%22debug_reporting%22:true,%22destination%22:%22https://pdfixers.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211409209437%22],%2222%22:[%22true%22],%224%22:[%2202-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%223764426634068378881%22}&andc=true

222 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
heromc.net/
Redirect Chain

http://heromc.net/
https://heromc.net/

58 KB
14 KB

512ms
489ms

Document
text/html

2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://heromc.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b758b78b503482036d130f6f2efadca53a9d944661f1f6589515d50704c8e270

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=1800
cf-cache-status: EXPIRED
cf-ray: 852ce2a92ac82beb-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 09 Feb 2024 14:43:34 GMT
last-modified: Wed, 07 Feb 2024 20:27:18 GMT
link: <https://heromc.net/wp-json/>; rel="https://api.w.org/"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mkDzVpOJdJ1r9m%2FqUuY9TTnpC9KqvXdZZ6gE%2FgP6DrQyh2RGtM1ETELAdYjWD6xque8Uz4Q8g8ub5Nhjppq7mSOKuIyp5850MN87ciFYVfAQnBNrMuMaHZvIX4DvjtxaUikyTvhCn68T"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

CF-RAY: 852ce2a81e235d92-FRA
Cache-Control: max-age=3600
Connection: keep-alive
Date: Fri, 09 Feb 2024 14:43:33 GMT
Expires: Fri, 09 Feb 2024 15:43:33 GMT
Location: https://heromc.net/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fMXSNy1HxuF%2BOmGg14V23U77G2cRZo5cGpN6u0AxUAW82ExWGp46mz8ttongY27JMDlQOmAB9TYBq4KvW8KhmsCSG8SU6aDS2vOUKdPzvuPhU3IHUrtDAR3HBJTcAMMcdeKesMEweabg"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400

GET
H2 200 style.min.css
heromc.net/wp-includes/css/dist/block-library/ 52 KB
8 KB 1356ms
1355ms Stylesheet
text/css 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heromc.net/wp-includes/css/dist/block-library/style.min.css
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: public
date: Fri, 09 Feb 2024 14:43:35 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 22 Oct 2021 05:21:10 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"61724a46-d159"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zAWJEGAaIIs3uMCpp0UJ1iIz873ZASP6CH0I%2FzB9HhKrLXg5ozRg6WticmqgGWeas98%2BqpL8kBPSuE5ztCnGsGn77BLZcpMA7GtZWX7tIOim%2B8Tubb8nu8GrB%2FgSHVcgHmyn%2BWZWd%2Fik"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
cf-ray: 852ce2ac3f0c2beb-FRA
alt-svc: h3=":443"; ma=86400
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H2 200 kk-star-ratings.min.css
heromc.net/wp-content/plugins/kk-star-ratings/src/core/public/css/ 2 KB
993 B 369ms
368ms Stylesheet
text/css 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heromc.net/wp-content/plugins/kk-star-ratings/src/core/public/css/kk-star-ratings.min.css
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1cd6396792d7bfdd898dcb9f2ee195387179b30fb4cc2cdc0c57575fab655230

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: public
date: Fri, 09 Feb 2024 14:43:34 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 25 Oct 2023 14:45:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"653929ff-8d3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F%2FjWXtvHtV4hYh2Ju2SVd61cHwTuctYSnhdY%2BjtPQ7oUuiaFbAJhksf1uUZuKYq0k%2F7fwZdQFbiYVj%2FFtfOsHNA%2BLGtbVuKk2vHE75nBHe%2FdZXOiMoaWv4VCqNKu65Uboo5%2FS3Xc6QZy"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
cf-ray: 852ce2ac3f0e2beb-FRA
alt-svc: h3=":443"; ma=86400
expires: Sun, 10 Mar 2024 14:43:34 GMT

GET
H2 200 style.css
heromc.net/wp-content/themes/magicraft/library/css/ 24 KB
6 KB 380ms
380ms Stylesheet
text/css 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heromc.net/wp-content/themes/magicraft/library/css/style.css
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0801f6ec47b1ab4ef329fe4fc69d014b3ee974869550e69db360f35e298bed8d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: public
date: Fri, 09 Feb 2024 14:43:34 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"61724a44-6031"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f3CjH7toFGxatuPb4mftwA3YdUdal29YW2HxQzEG%2FgB7WfkbHHxuSGmIckgwjRxBuchRvtRdlowbSOdxwtKD3pfF3JkIVMWvgL7Da%2BRWxn1x4J%2BTkxRiz9D7YQ6vdfelatL%2FjYLYIxK5"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
cf-ray: 852ce2ac3f102beb-FRA
alt-svc: h3=":443"; ma=86400
expires: Sun, 10 Mar 2024 14:43:34 GMT

GET
H2 200 css
fonts.googleapis.com/ 33 KB
2 KB 38ms
16ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C700italic%2C400%2C300%2C700&subset=latin%2Clatin-ext

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a60d4f8cc0e1ec57d2574653a779b41406c419a8e1a0fc49d6d0a45f73491370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 09 Feb 2024 14:43:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 14:39:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 09 Feb 2024 14:43:34 GMT

GET
H2 200 Hero_title_small.png
heromc.net/wp-content/uploads/2019/11/ 35 KB
36 KB 1611ms
1611ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2019/11/Hero_title_small.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8e576a8f256c2b656af1b055b329775a8cd7b4a9ac80ab18034006821cc76c7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:36 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 35990
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-8c96"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cyu9%2FMjpn1PW0pKBolS5Ok30kvwZLFj2VwxErta56u3TM3nGhKWDOmK7BQIa7h6VXgTYxs0OfxN%2BzJGIGzxZoiyTaGrjO7imoiwj3dTSkjER2MtmsLdN1A1D%2F1QPf5WFnzhf3JyY8s9J"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2ac3f132beb-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H2 200 Artboard-5TNTWAR-224x162.jpg
heromc.net/wp-content/uploads/2023/12/ 15 KB
16 KB 540ms
539ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2023/12/Artboard-5TNTWAR-224x162.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4fc1a7b001c24a83334ea65a710c1e3922b14a14ff06bdd71919b4aae3c85c16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:34 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 15836
pragma: public
last-modified: Tue, 26 Dec 2023 16:28:40 GMT
server: cloudflare
etag: "658aff38-3ddc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4f1S4soGPNAgMgVJeWvqAXAfp2Bd8ubVRNS8tFtxKBKh5CIiZt9vPjN7IHkgzF%2Fz8VK7vpm6%2BBIJZa%2FHkzAa1l6WkxDCYbmG17FshiNrnOWQ6ncgecN1O73zi2Zjd5XCShVnhOVlLVvI"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2ac3f162beb-FRA
expires: Sun, 10 Mar 2024 14:43:34 GMT

GET
H2 200 KHUYENMAI2SINHNHAT-224x162.jpg
heromc.net/wp-content/uploads/2023/11/ 16 KB
17 KB 1090ms
1088ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2023/11/KHUYENMAI2SINHNHAT-224x162.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27e5b4965c653999189b434b89a50cca4db1249ed4e872af8b6d52e2f1d9a93e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 16677
pragma: public
last-modified: Tue, 28 Nov 2023 10:19:26 GMT
server: cloudflare
etag: "6565beae-4125"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zYkgXWQ4G28uY49WYXoA0TqyQQLIvtCd51OSSZeC6TJ5M7sZjKYRHNHMaTMcPmAVthZO2Ug3Heh3h%2FvJC0EsFSY2X%2FQVdgLdui%2FElyMDY4RnMFu05V6x%2F7MYpFkFYBLqi21LG6pVvoIs"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2ac4f192beb-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H2 200 Artboard-2thepitalpha-224x162.jpg
heromc.net/wp-content/uploads/2023/10/ 13 KB
13 KB 1403ms
1402ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2023/10/Artboard-2thepitalpha-224x162.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b185a9830d7d96a41b584c62bf222ad8d690662bf83ffd57eb758a4b268a1e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 13367
pragma: public
last-modified: Fri, 27 Oct 2023 02:32:56 GMT
server: cloudflare
etag: "653b2158-3437"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=deRvqBuvx1Q%2FN%2FXKccffD2pncpHxgduxCBNOaABy%2F8NNj3Spr6mryTfJjXaD4LhIJxJioZt5d1uuADefbzGrI6XdbJkL2%2B103oWpxu8DoEpsCCecOgmA0nxqcIgQNW7Qmoe47LAYDt4H"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2ac4f1a2beb-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H2 200 demonwall-224x162.jpg
heromc.net/wp-content/uploads/2023/10/ 15 KB
15 KB 3557ms
3556ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2023/10/demonwall-224x162.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 646a10a1c9bee960c646e77ab3a05131407eeab2514b284ddd0e151ae2bbf170

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:37 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 15153
pragma: public
last-modified: Fri, 06 Oct 2023 13:16:35 GMT
server: cloudflare
etag: "652008b3-3b31"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pPeVryVqOhyetv3w1WwZSAtPs8dCTo5XS9YCrEMcu0uglmKH3y9yK2uWbNkn6xce9%2BJT4Wm1C9K11hittaK7BnX8iHw%2F635P4T9TVGgONWKeZhLS%2B3i1iCEGX1Fi0EcH3sJg6sGnc9pT"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2ac4f202beb-FRA
expires: Sun, 10 Mar 2024 14:43:37 GMT

GET
H2 200 Artboard-7Cohon-224x162.jpg
heromc.net/wp-content/uploads/2023/09/ 13 KB
14 KB 355ms
354ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2023/09/Artboard-7Cohon-224x162.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f82a032adfd1bcaee3925567c2beb50794f288fa5d463e0f408307bcae0ac9eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:34 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 13435
pragma: public
last-modified: Thu, 07 Sep 2023 10:49:50 GMT
server: cloudflare
etag: "64f9aace-347b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o61Bpis170DUKXVnCmZeQkkXwP%2FUGKay1509sNKS5XS%2FkhmiyPG%2BZMB%2BTnStBhOrx3yXocFcAuI8kEyrwQEGBp%2FxjdgLMm%2FjohTm%2FnDC7Btk5%2F7PUQfG2zYSUU3jkpgv%2BFnh9%2BPyNcdC"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2ac4f242beb-FRA
expires: Sun, 10 Mar 2024 14:43:34 GMT

GET
H2 200 Artboard-5-224x162.jpg
heromc.net/wp-content/uploads/2023/09/ 15 KB
16 KB 550ms
549ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2023/09/Artboard-5-224x162.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e0b72b78bec4f1081b52f4730340a419a2231fc15fac8c8913e04e98b497f38

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:34 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 15716
pragma: public
last-modified: Wed, 06 Sep 2023 14:27:42 GMT
server: cloudflare
etag: "64f88c5e-3d64"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L9HoWHtM9izN1P%2FxWcGSOxmQ%2FCy73I2KHUXP5ciORpF7QoRhPMz9EJeLkWJq5F0v3wnGhy3eMxZd5hrTdqSg%2BFoZxKYvPz1Snlb2olyOXWkhyereY8BjbbHGel%2BDoPvqvfeLuz8RURuo"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2ac4f282beb-FRA
expires: Sun, 10 Mar 2024 14:43:34 GMT

GET
H2 200 bw-224x162.jpg
heromc.net/wp-content/uploads/2023/08/ 10 KB
10 KB 356ms
355ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2023/08/bw-224x162.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 433887067acdaaac4ae8e03d31282a32a1193658b7966ebad92748e5b80f6d6d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:34 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 9895
pragma: public
last-modified: Thu, 17 Aug 2023 13:40:04 GMT
server: cloudflare
etag: "64de2334-26a7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D4PVrv%2FwHljrFWE2iiDb9vZg4IR%2FbnwlteSghu6vlCYttd16sfTfg2NuFplroAS8caM8z1ODN%2BjgSimVDGyEZ8Gu1Tna%2BG%2Bq3RPMl3V0rjc2sPtnYRkPTupXAIdiypQn0UR85SvfEb2g"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2ac4f2b2beb-FRA
expires: Sun, 10 Mar 2024 14:43:34 GMT

GET
H2 200 avt-1-224x162.jpg
heromc.net/wp-content/uploads/2023/08/ 11 KB
11 KB 356ms
356ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2023/08/avt-1-224x162.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45868cb1249416d0231c8b874f58a12f6f93b38a7b1986f0a56c53a46dc110d2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:34 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 11194
pragma: public
last-modified: Mon, 07 Aug 2023 08:05:46 GMT
server: cloudflare
etag: "64d0a5da-2bba"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=95PRkMIL9qqYVk3%2F8XCbLdrpXkGxiNn9plTFDC8kqksWkdIlOFvoqxA4E8m21FI%2BzUwuc6KffFZu8rYTPioEj01W3rn4H%2F9x4Boldg%2BlyDHgXqBVgjsSvB7FlQDnu4uOVl8q30YuRT1r"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2ac4f2c2beb-FRA
expires: Sun, 10 Mar 2024 14:43:34 GMT

GET
H2 200 Artboard-1-copy-2-224x162.png
heromc.net/wp-content/uploads/2023/08/ 32 KB
33 KB 904ms
904ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2023/08/Artboard-1-copy-2-224x162.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f119abf2c4c2158022eb6bfb873733ee03023f8ffcd4de8a04295655676e528

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 33150
pragma: public
last-modified: Sun, 06 Aug 2023 15:51:49 GMT
server: cloudflare
etag: "64cfc195-817e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PMZTvRSFuV4JvnBY77fSc61AsCVTDRJHQhSTaOSgFvs5N8bX4KyMR6Ns5aJCJ2Ch%2BKey9E5UI2UkQwbaDxOII9bvylugI4QU96Kg8r5%2FvpTh0N5oHTbCEaBPUxkNlvY1QnhZ%2Bwqq2dBT"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2ac4f2d2beb-FRA
expires: Sun, 10 Mar 2024 14:43:34 GMT

GET
H2 200 khuyenmai8-224x162.jpg
heromc.net/wp-content/uploads/2023/08/ 13 KB
13 KB 403ms
402ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2023/08/khuyenmai8-224x162.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8189432d711c5dd842c5f878396d95d1fc45cee6fda836f3aa4a208143c0b96c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:34 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 12939
pragma: public
last-modified: Thu, 03 Aug 2023 08:02:19 GMT
server: cloudflare
etag: "64cb5f0b-328b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8zZrQWIJs4KppeD%2FXmTnFQyZFyUuqtbSuFlthZVamG0ZEjaTvAA1EndaU8LWvVUR66Rki0O8nbbBA%2B1Gjuw7Y0vDZhP2J%2FO8zegq9i9qwP5RVVlPAPBxu0aBxWfOjmSVM%2FckFW7x990o"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2ac4f2e2beb-FRA
expires: Sun, 10 Mar 2024 14:43:34 GMT

GET
H2 200 email-decode.min.js Show response
heromc.net/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 14ms
13ms Script
application/javascript 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://heromc.net/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 02 Feb 2024 15:36:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65bd0be2-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ytmrFEdD9f%2BDxHc2d647W9b6dSVyrxtMC4iTYUbPUoGXO9auvSPIK9YioNWMRjHXqw5gAdwbK4Hl8x1NpsL9P05MhdSos1LxNX3q6%2BwA%2FmpCyjponn3y2wpGmlaMcPR7gLGbBgwR0e8O"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 852ce2ac4f212beb-FRA
expires: Sun, 11 Feb 2024 14:43:34 GMT

GET
H2 200 rocket-loader.min.js Show response
heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 16ms
16ms Script
application/javascript 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 02 Feb 2024 15:36:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65bd0be2-302c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fCyMzi4fiuHArlelFJbyvYF4zXl8aT64vhTKg2WasXu%2FLSFMNkoV%2FnyUMixt0I3Tkae6bVKVySCMbqqTwTsyL4x4ExnVdtjyOF%2FiJwz2yQR%2FfrzQ8PLuTHaA6avPjJORuWfg4GhMuFkA"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 852ce2ac4f2f2beb-FRA
expires: Sun, 11 Feb 2024 14:43:34 GMT

GET
H/1.1 200
OK head-top.php Show response
id.heromc.net/member/top/ Frame 5568 3 KB
2 KB 765ms
311ms Document
text/html 103.142.218.245
INDRA-RELOAD-AS-V...

General

Check archive.org

Show headers Download Go to

Full URL: https://id.heromc.net/member/top/head-top.php
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.142.218.245 , Viet Nam, ASN135987 (INDRA-RELOAD-AS-VN Reload Company Limited, VN),
Reverse DNS
Software: nginx / PHP/5.6.40
Resource Hash: e75709116f5ac6ef2240abfcdf4baec23290e385e3157804499d145ffb213fed

Request headers

Referer: https://heromc.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Fri, 09 Feb 2024 14:43:16 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: PHP/5.6.40

GET
H2 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ Frame 5568 30 KB
6 KB 43ms
24ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: id.heromc.net
URL: https://id.heromc.net/member/top/head-top.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://id.heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 6353782
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5631
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-7918"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5CacLD0kXNtCVy92PvNP6hWgf5Yt1dJe%2FOJq5QwiNd03MgJM%2FpzA3Fq3y0iGdLBA%2FqBBMHkSSrN2vvEqgNptq7zuDZZ4MSowWhI7xVvnFJk8Ip3AtQpGybXjILtgQpCWohKLvukfHLHFvleVCKMKKkcw"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 852ce2b12f474dc5-FRA
expires: Wed, 29 Jan 2025 14:43:35 GMT

GET
H2 200 jquery-1.11.3.min.js Show response
code.jquery.com/ Frame 5568 94 KB
94 KB 27ms
7ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.11.3.min.js
Requested by: Host: id.heromc.net
URL: https://id.heromc.net/member/top/head-top.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://id.heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
via: 1.1 varnish, 1.1 varnish
age: 12687616
x-cache: HIT, HIT
content-length: 95957
x-served-by: cache-lga21975-LGA, cache-fra-etou8220113-FRA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1707489815.230532,VS0,VE0
etag: "28feccc0-176d5"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 8, 34911

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/ Frame 5568 118 KB
20 KB 58ms
40ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css

Requested by

Host: id.heromc.net
URL: https://id.heromc.net/member/top/head-top.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://id.heromc.net/
Origin: https://id.heromc.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 755
cdn-cachedat: 10/31/2023 18:48:20
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"2f624089c65f12185e79925bc5a7fc42"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 1d12a2a7f997cc41bbda888833929979
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 852ce2b12f4691dd-FRA
cdn-requestpullsuccess: True

GET
H2 200 bootstrap-theme.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/ Frame 5568 23 KB
3 KB 48ms
29ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap-theme.min.css

Requested by

Host: id.heromc.net
URL: https://id.heromc.net/member/top/head-top.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3c6ccd19e5c16faefbef429d042458b82c80af040f450b1ee208dba88d5b0df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://id.heromc.net/
Origin: https://id.heromc.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 860
cdn-cachedat: 09/10/2023 08:26:28
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"46d96593303e4c8666f497bb7602c999"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 9ba4d448d958f6b155a07b7de8908a14
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 852ce2b12f4891dd-FRA
cdn-requestpullsuccess: True

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/ Frame 5568 36 KB
10 KB 53ms
35ms Script
application/javascript 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js

Requested by

Host: id.heromc.net
URL: https://id.heromc.net/member/top/head-top.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://id.heromc.net/
Origin: https://id.heromc.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 874
cdn-cachedat: 10/31/2023 18:51:17
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"c5b5b2fa19bd66ff23211d9f844e0131"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 50d78e9aceee152917f196ba323be6b1
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 852ce2b12f4991dd-FRA
cdn-requestpullsuccess: True

GET
H2 200 jquery.form.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.form/4.2.1/ Frame 5568 16 KB
6 KB 60ms
42ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.form/4.2.1/jquery.form.min.js

Requested by

Host: id.heromc.net
URL: https://id.heromc.net/member/top/head-top.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f06fc176d714316c3773a8f99c1bd5b736a88f7b2afe45fac4d376150d30d0c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://id.heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1427524
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5537
last-modified: Mon, 04 May 2020 16:11:47 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec3-40d6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3JxAFqDPY4bEuEmyc4tabdVvXOATB5TkGiyQg4lK%2BUGT%2BV6Q3gCXSTO%2BKQSpNKWXwUisi0INxp9C74mNTYXKXZr4hnNdTkfK%2B5BG%2Bn2fjCgzNN%2BFE8TN%2BTXfjtFm1JBDW9SIA5pa8iVl8yJPkjLXNndd"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 852ce2b12f4f4dc5-FRA
expires: Wed, 29 Jan 2025 14:43:35 GMT

GET
H2 200 left
mc-heads.net/body/BanhMeow/80/ Frame 5568 9 KB
9 KB 160ms
126ms Image
image/png 2606:4700:3030::6815:5794
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc-heads.net/body/BanhMeow/80/left

Requested by

Host: id.heromc.net
URL: https://id.heromc.net/member/top/head-top.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:5794 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7a87da2e349a1220d8264616fc9d571288c01e28ee1cfe4ed4554e15c6c5e53

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://id.heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Fri, 09 Feb 2024 11:52:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BSFanHyrRCgb8BgS8JQkwzZYmFIVCh0wT8c5Z21v%2BOy2TQdG6SE87hgQI%2FJcAl3u5Ue%2FGFaAotovu%2FFcgiifyb%2F2uQ4aPHdCx7WIrV9q2dM%2BU4078DY1xaqhiODuC9qRH%2B5E4%2FmZbzCtuX4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=21600
cf-ray: 852ce2b1497e904c-FRA
alt-svc: h3=":443"; ma=86400
expires: Fri, 09 Feb 2024 17:52:12 GMT

GET
H3 200 hinhcuoicung2.png
heromc.net/wp-content/uploads/2019/10/ 1 MB
1 MB 780ms
779ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2019/10/hinhcuoicung2.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f5939a71235a5ecc94eefbfc0c1268640f275ac73dae18819fb52674ad5e9fe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:36 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 1233192
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-12d128"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vwZW573V1K6xCZ70gM%2FtI3OUTkd4pBTh7pnPPbjHw1uUMCkfOdYFu0UMiOFPSHa6FgRxhj2ZBcuHt870Xu8QMUcjWS0aTCXRXOFrA9iAS2ZCgYoxJRYgT1r6vms96pMdoonGiuebBeTS"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17bed2bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 wooden_m.jpg
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 72 KB
73 KB 761ms
760ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_m.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83db76383f24cb38e3dfd720ca1d2e3369d5bffb76f48945afbfcf8489e1b236

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:36 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 73760
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-12020"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tnui8cdE%2Bko%2BBZzee38CzJM02T9%2BHqNJ54ynzScKZbIrz8EXvWMZglhW%2BlkdjnUKU%2FyI9Ie0CECDZxBpUzhSMQi1PxaydopWPnUtWRqVtB%2BPf8RU0L%2FlGDmSkS8ai99Vf2Ph2w4jArUo"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17bf12bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 wooden_menu_texture.jpg
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 8 KB
9 KB 217ms
215ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_menu_texture.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b4d0e26b6ecf4af2fab46cc147ffc30da39f350a8974ada7c8419b2ebe5d1962

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 8654
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-21ce"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wMHIDgxpZMVaagYEONBCfEFHTF0aiOEoaUQTopon%2F8S6pYx2YxBNK45Y6%2Fly%2B2%2BF6mebzFbSfbTNQp%2FASqZEFiPkMwpljMPNwmUNnmlsSjZM2xSGaOKINUhbwDVJhebPDkgagb%2BQgBiO"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17bf62bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 wooden_main_left.png
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 1 KB
2 KB 345ms
344ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_main_left.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f40cec8ae340480f6945bc09b31d4dd293496d1b15ad990c06dcbb4c726e6935

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 1036
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-40c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pBgZWl8UTYwPcOaenkWNkpUG4xRa9K2N0cFnhHmsi8Gb6CKwcNUp3CxWPAOBPSjS6kAiyRTDgpPoLSfeYNcHewcxoCByyye2f2YGDvMGxf59kLV90DeNKDab768sX4VPX8cz3kKNuiuX"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17bf82bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 wooden_main_right.png
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 1 KB
2 KB 1314ms
1313ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_main_right.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64cd96ff9eb0a950d6000c6b22490b168ab4d7a98eb754bfe79078b40c7bb8a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:36 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 1026
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-402"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v4Lvf371L%2BLyK6HhNGi3RGnzvqzzZFTevBayWO2hYKKFsnP8yqglAE4ghgUfnBrFyeOV3KKvoRIX%2FeB%2BW%2Fduz8JU2jROgb0Fini4vRWtfDRgKRbMZGZPBsitJHUA%2Fg7TJ1SGSE%2BQjCRG"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17bfa2bc1-FRA
expires: Sun, 10 Mar 2024 14:43:36 GMT

GET
H3 200 wooden_text.jpg
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 15 KB
15 KB 560ms
558ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_text.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a924472052d51b8dd1864b2acf707d7fb09580456e59dbe58818faf61efbbe8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 15194
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-3b5a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AzCXGaP2uC41ly4Ce45NFLgNFhhoWjSb1Ar0PUCSD8HkQhDv9tB9e9oJlklFdkju8XJLBdpV6AkEAsfq4Kq96NzWNRdyWWOa%2FmMFGNo%2F5dwmp8tyBFvhBO45796rBEUhotyoMupjOBEI"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17bfd2bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 wooden_bg.jpg
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 9 KB
10 KB 1874ms
1872ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_bg.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6f311082cddc0aac08827ff6c04fd13f597640635f83227faf99213b40bb1c7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:37 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 9600
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-2580"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0O62UAXAfIxd8ewYU57a0nPPKKT9JZEc2dKr46Y0%2F%2BFuS2FvA0aICB%2F%2B4RcIMhZlEDgQVg%2BbsU262s20dqnafJuYu6fejnqlW1ws8ET7rrgo3K%2Fl2WAWE4RIaPIHSLARWyfZfKUHAzwe"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17bff2bc1-FRA
expires: Sun, 10 Mar 2024 14:43:37 GMT

GET
H3 200 hero-1.png
heromc.net/wp-content/uploads/2019/10/ 492 KB
492 KB 781ms
779ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2019/10/hero-1.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6311d55c34c7c52cbe18fbbf75f8f54a89cc407a5c1e189f894c6b9b83133c04

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:36 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 503641
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-7af59"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cfv3gGxmhpgOtXQQRm2wsb65Nn9BwN4HSUHVhi%2B44883iZCw5miuJhmdl0fB6%2F5jxQFQA5BzqGxSCVL35l%2BeWFn8tHTgEOmLHMX41GoiWwSJiruR6diz%2BavdeHxpABQL74Z4goWL%2Fz%2Fv"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c012bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 hero-2.jpg
heromc.net/wp-content/uploads/2019/10/ 98 KB
99 KB 789ms
788ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2019/10/hero-2.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cad1003180db5ef47e5ee3cfd628073e6411543ab77c34de59b19cecada87391

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:36 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 100744
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-18988"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9BYz8C91Zsl7haimOtS37RE50PXMqSbCzmX7NUvqXw8Iu5nTZGfoNcY7zcXXwx%2F5d0VKrC0ieTPnxa%2BaYeFLIGP6YHqtxRBuP3FN%2Be9%2F%2FMun3NDW7SIBvCQFCHCzGUExRg84a%2FORrpY4"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c062bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 4-1.png
heromc.net/wp-content/uploads/2019/10/ 479 KB
480 KB 1845ms
1843ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2019/10/4-1.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5c87467e95e7b28294c11944b7bf6680fbdc8e34c1205f2f9a298fa0a340e2b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:37 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 490455
pragma: public
last-modified: Wed, 19 Jan 2022 09:04:59 GMT
server: cloudflare
etag: "61e7d43b-77bd7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jaxZ4NSqSiBfklgvFpDBfbk4Cz6%2F2WvBY0ruxrNsu5jPMG0CMHL6R8Ph6FWNe5liICv5RxEp%2F9z0xCIWyOM4NuMpkxYXRRGYcKSUGYzc6J5GP0sIy3yHEDaE7InXxixEXM2zM%2Flv4Jn%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c0b2bc1-FRA
expires: Sun, 10 Mar 2024 14:43:36 GMT

GET
H3 200 321913490_576572560567751_4925022898315639986_n-690x332.jpg
heromc.net/wp-content/uploads/2023/01/ 67 KB
68 KB 852ms
851ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/uploads/2023/01/321913490_576572560567751_4925022898315639986_n-690x332.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f49422f7d897ed35d8b3b4f54c7cf5aa5ac3e9eb3306575ca0d67cdcecd1dc51

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:36 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 68712
pragma: public
last-modified: Thu, 19 Jan 2023 19:13:29 GMT
server: cloudflare
etag: "63c99659-10c68"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xb8WWQYvOwTJj7lX%2BojTM2sVfIjERdg%2BXqFmeEqUonXk5Y1dCYtSFX%2B%2BYG%2BH9fw9fDtaNNk2byrc3SEMBWF6%2BqYPk3nDD%2F6ULXx%2FvvS3H4MasJXxVK%2FyhVD028crOgz8PUFfC4zFxnGj"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c0d2bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 wooden_content_left.png
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 1 KB
2 KB 347ms
345ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_content_left.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1475f02e12f6760867a0278efb22588e93ac3e903f51391c40e867722a02bd8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 1040
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-410"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F6g%2BVxZbGBS3xgR71k48qsCA7%2B7MCg74dxTVEVz%2FuP87XtdzLnTTTw3ubD4CQlo%2BrmzAmLfQRt1Mn%2BgTK4hMR6N9d4EeULklPWfev9RaDuAKCPAVDx7OcD3BLkYyG9uh07ATK5G0id2v"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c0f2bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 wooden_content_right.png
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 1 KB
2 KB 1833ms
1832ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_content_right.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b9f58e1ce0e8c00ba91dbc86959c933e0be416b2941b5da01a885622440233c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:37 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 1033
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-409"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B8taWRoORqSsBix4Au3IfGgLN%2BNhdzs2%2BkkfZ0GzqFCiJglgNpbYM5ZAZXuSAArh3CJPVZ3uzIwZxaiEwh1o5hF6fFqNphpav5U1Wa2C9MrdzOLHrPVQxsoH7jEFhJ67bHxg6EpKywFF"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c112bc1-FRA
expires: Sun, 10 Mar 2024 14:43:37 GMT

GET
H3 200 wooden_side_bg.png
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 80 KB
81 KB 781ms
780ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_side_bg.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50733810a6ea64ddeef0bbfcc5635e6b6a367975dcb07ae60254fe06029f5e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:36 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 82270
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-1415e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AchOjp%2BrzuNFO37knvIRbFyLkn0k4uzaGh61WUwsXVZ2%2FTx4zwkfoZNIK32R1ox5xROKTRiwLAQq6013zTelBbV9aOC3LETJTY0RborFIsvqnHoyj0gvQMJ%2BUK2WSM4f0Fo3YA0eXtT0"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c132bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 wooden_author.png
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 1 KB
2 KB 1395ms
1393ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_author.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 640ad21533a77d5363965122b215b73ecd3b5c3c56d7c211c110f3234c8bfdba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:36 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 1193
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-4a9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vHqSK8DWLEnwMMM2959Fca6FnQOd9S%2BZJZn3w4r3eqP0E1mc%2BOFvY8nH6VZh0M5hGaGzrwlk8%2FGmqLI3hq46XBSAkWkHmH4FXeFVjPtKZ0t%2BDN8ukG9K3EMbiTXEH8exBxs%2FAJ778ufW"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c152bc1-FRA
expires: Sun, 10 Mar 2024 14:43:36 GMT

GET
H3 200 wooden_online.png
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 19 KB
20 KB 1008ms
1006ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_online.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 412799abf50c06820691d6af4da49c9189e9c4e9c2a4ddc77e750f643360aae1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:36 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 19532
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-4c4c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tJ7Z6qlDlGttFXP0pr8XVNRR6YHSE7Tcrz%2Fu6chtOveOpHFD6Eg3LwkXy1yboHEfDWooGEUm6Cd%2BydlGAocG%2F5Y99mE7CgdfA2vpExiwm%2BDG5suZHQzXNaR72SQUzDLKwFGVkE9SHhKQ"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c162bc1-FRA
expires: Sun, 10 Mar 2024 14:43:36 GMT

GET
H3 200 online-players.png
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 1 KB
2 KB 345ms
343ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/online-players.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5506eaabff3eeec0d33bc777d52ab390a6519ab4b57a5ba0da93f9519fba8b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 1397
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-575"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jvo3nefFF8Agb2A%2BxnHqgQ6XtisYZmdwIwkzUI1MQdCB4D48m4qwFdgI6PlmpUFQvfF9AFwAdaMTk%2Fj2Z%2Fy2VprZsswvII9D7jig65LfHy9rkd2pryfAcbomD8c9nD1a9lqyLvbrXyTD"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c172bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 world-cube.png
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 1 KB
2 KB 353ms
352ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/world-cube.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 219b02d7360cfd9422919ca1500dd6b379ddf237de28e29b24f6513ff09feee4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 1363
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-553"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=69B%2B6Zi%2B6lEfQ%2FeVE1dOluy7zk72wcQsksbzmtn8f6H2YNCFC%2FYLG%2BAFfOBf6rVtfUvMBCoYXfEl1om3nBIlEajfvj2p7%2FGewKx8tka5SiA9UnW5bBop8w59r%2FapYhY4fIDMtj44R3RH"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c192bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 wooden_widget_title.jpg
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 25 KB
26 KB 1018ms
1017ms Image
image/jpeg 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_widget_title.jpg
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 155e0678d16bd038d88f59397bdc4ac0ef2126ef2ba416841d1a1e5b091f4a66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:36 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 26015
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-659f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BmlzvbGxmMe8ZYGCF6QxmrhjHikRfuJLQwV9dmNbbwoGf%2FWemdDrryw28O6k8rNJX3UO61P0od5jKkRPZrucL6R96bbiMnjPeeAvPEPupdTYJnOGSt3WXUaXdAUUWNdVxskuNWPiWSW0"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c1c2bc1-FRA
expires: Sun, 10 Mar 2024 14:43:36 GMT

GET
H3 200 wooden_footer_left.png
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 1 KB
2 KB 378ms
377ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_footer_left.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 309682f4811532cc3591fa0dbee23b8cbc5cc9d6155e4e0aa306f2c54d7c179c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 1035
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-40b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2XJjfrC%2FBPFmPNa%2FZeh9dtUswbLtB7YLKf2yPkoLaX61%2F%2FaPlHw%2B3SB1QxaMWnvc5y%2BLQNxl8q0nLdedetfUqlmgKrDz7ltjm7FXlZkp3FTtfO9uWl6A5j9QvozASp%2BUpInrfrrbcno7"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c1d2bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 wooden_footer_right.png
heromc.net/wp-content/themes/magicraft/library/skins/wooden/ 1 KB
2 KB 189ms
188ms Image
image/png 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heromc.net/wp-content/themes/magicraft/library/skins/wooden/wooden_footer_right.png
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08bd680de7e840592d658e8cc895c55866866aa07b008963febad03e32d72599

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 1025
pragma: public
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
server: cloudflare
etag: "61724a44-401"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BHtG8NxNgTju7cs%2B0KLEcr2JuybMVvN%2BNhl3xsFkTL4N2ET2cz4WA0gn4vGbyMmczid39r2llWO39nliar11dgtpbnCcISAYjOysoLBBpPCLMMrCdtXyVIY0yVMBuwEUVoIMoBV7XmAN"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 852ce2b17c1f2bc1-FRA
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
48 KB 30ms
8ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C700italic%2C400%2C300%2C700&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://heromc.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:04:50 GMT
x-content-type-options: nosniff
age: 139125
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Feb 2025 00:04:50 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2
fonts.gstatic.com/s/opensans/v40/ 35 KB
35 KB 44ms
22ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C700italic%2C400%2C300%2C700&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

adfa45260a1306cb5fefc1f17c1b5e7b61135534a82bf1b8e3d0540af7e07e3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://heromc.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:07:10 GMT
x-content-type-options: nosniff
age: 138985
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35328
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:00:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Feb 2025 00:07:10 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v40/ 49 KB
49 KB 41ms
19ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C700italic%2C400%2C300%2C700&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://heromc.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 16:03:55 GMT
x-content-type-options: nosniff
age: 254380
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50296
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:10:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Feb 2025 16:03:55 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2
fonts.gstatic.com/s/opensans/v40/ 16 KB
16 KB 47ms
27ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C700italic%2C400%2C300%2C700&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35e5eea83f2e5f2bad1213aa4b4aef30a380720e35c1821f19bc894f8e61e406

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://heromc.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:04:53 GMT
x-content-type-options: nosniff
age: 139122
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16552
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Feb 2025 00:04:53 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2
fonts.gstatic.com/s/opensans/v40/ 24 KB
25 KB 31ms
15ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C700italic%2C400%2C300%2C700&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e510e61c497d334da21eccda06df5d3a428c9ea94d6903b6138e7c7255aba0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://heromc.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:09:39 GMT
x-content-type-options: nosniff
age: 138836
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24984
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:04:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Feb 2025 00:09:39 GMT

GET
H/1.1 200
OK member2.jpg
id.heromc.net/member/images/ Frame 5568 38 KB
38 KB 427ms
426ms Image
image/jpeg 103.142.218.245
INDRA-RELOAD-AS-V...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.heromc.net/member/images/member2.jpg
Requested by: Host: id.heromc.net
URL: https://id.heromc.net/member/top/head-top.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.142.218.245 , Viet Nam, ASN135987 (INDRA-RELOAD-AS-VN Reload Company Limited, VN),
Reverse DNS
Software: nginx /
Resource Hash: 889fec0ca126224e77a3d7597c7f8cba79c5dcb1c1e516a8d770555b9cec71c2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://id.heromc.net/member/top/head-top.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Date: Fri, 09 Feb 2024 14:43:16 GMT
Last-Modified: Wed, 19 Jul 2023 18:50:34 GMT
Server: nginx
ETag: "965d-600db81ba8fe6"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 38493

GET
H/1.1 200
OK viral.gif
id.heromc.net/member/images/ Frame 5568 22 KB
22 KB 713ms
357ms Image
image/gif 103.142.218.245
INDRA-RELOAD-AS-V...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.heromc.net/member/images/viral.gif
Requested by: Host: id.heromc.net
URL: https://id.heromc.net/member/top/head-top.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.142.218.245 , Viet Nam, ASN135987 (INDRA-RELOAD-AS-VN Reload Company Limited, VN),
Reverse DNS
Software: nginx /
Resource Hash: d053beda954a4ecaef2c6aea4c68aa7a524d8c79056f68ec44c96636a1fe18f5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://id.heromc.net/member/top/head-top.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Date: Fri, 09 Feb 2024 14:43:17 GMT
Last-Modified: Wed, 19 Jul 2023 17:03:24 GMT
Server: nginx
ETag: "56f5-600da0274dd52"
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 22261

GET
H3 200 fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ Frame 5568 75 KB
76 KB 29ms
19ms Font
application/octet-stream 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Origin: https://id.heromc.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
strict-transport-security: max-age=15780000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 652175
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 77160
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-12d68"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p8hMr0g5SVJ5WCT%2BC%2FwuX99DcGOEvj0p%2B6qHI59o6q%2FNTN%2BRIO%2B%2BvBO62%2BYYjqNWuupuu22obHReNiZpS%2FZ8X0%2BdnaWKMa9u6cn7n4aZ7tEzQKB2UUK47z9LiqWI6IojQ8gQdzIiOmbYBSvn3j1aqdGL"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 852ce2b19b7f4d2e-FRA
expires: Wed, 29 Jan 2025 14:43:35 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2
fonts.gstatic.com/s/opensans/v40/ 46 KB
46 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C700italic%2C400%2C300%2C700&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b0dab5300943d98f4f20de9d48a49e0186441f6fb8b5e95a9635a30c0b60e72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://heromc.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:00:54 GMT
x-content-type-options: nosniff
age: 139361
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47136
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:04:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Feb 2025 00:00:54 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/vi_VN/ 3 KB
3 KB 27ms
8ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/vi_VN/sdk.js

Requested by

Host: heromc.net
URL: https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

feafea54bc9df8bf92b28e40deb5477785ed7a1099dbe88b97ec668faeff8a66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://heromc.net/
Origin: https://heromc.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 09 Feb 2024 14:43:35 GMT
content-md5: wuOS8uiXH+SBhYxkoJYTFA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1687
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-debug: s8/0obCd8QC2o+Xi4hNqGksZmVeEZYjEG7rDOIVmckeckhNCoQVTPRVyuxf9D9UqrfE+bfZo0qeREDQufNELIQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 73a40d7fdbed9c7db68f38479808c87f
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "415355ebad27a06042b1828df351a762"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
expires: Fri, 09 Feb 2024 14:44:13 GMT

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 61ms
42ms Script
application/javascript 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalSDK.js?

Requested by

Host: heromc.net
URL: https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4191d89ec03bce5dc273716075335e31851031184b0fff0ab9fc900a8442019f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 2671
etag: W/"a87c48d211877c49b878679b2e3cdab8"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 852ce2b4fd5a65be-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Mon, 12 Feb 2024 14:43:35 GMT

GET
H3 200 wp-embed.min.js Show response
heromc.net/wp-includes/js/ 1 KB
1 KB 1381ms
1380ms Script
application/javascript 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heromc.net/wp-includes/js/wp-embed.min.js
Requested by: Host: heromc.net
URL: https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6a482d2d94c0d1bc6937a1759389d01b475e6b28a0d9b5d7eaa3f9cc8f59f3cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: public
date: Fri, 09 Feb 2024 14:43:37 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 17 May 2023 05:06:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"646460ba-5c6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2UQvdeUuzNXmUUCVm9RYvsnv1UZ8IW%2FHTCDdYTiPDcn4aGzyw3vJMxNIS7dSsGuMTKxRfXP3E2pQAFUOZNF7C1lxNw9n%2BPeArjNpUF%2B9uK27qOWBlAPAT78jpMjK72aaan3xIPW%2Fr5Uu"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
cf-ray: 852ce2b4e9ec2bc1-FRA
alt-svc: h3=":443"; ma=86400
expires: Sun, 10 Mar 2024 14:43:37 GMT

GET
H3 200 jquery.glide.js Show response
heromc.net/wp-content/themes/magicraft/library/js/ 23 KB
6 KB 183ms
181ms Script
application/javascript 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heromc.net/wp-content/themes/magicraft/library/js/jquery.glide.js
Requested by: Host: heromc.net
URL: https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e7facd46a313e6e0fbaa7474b8853d2b112642759c73aec4b176b20f20dd771

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: public
date: Fri, 09 Feb 2024 14:43:35 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"61724a44-5d76"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QdOYnXo3QSP8gD1bw6nfXu2%2FesS4qBi7QkgNVCcaY5BQ33Hu%2B0AMkPemCd7uoJALnceI3RS8vwcRCsER8K9BXMevW6vPbjNYmylczPIZ8E58xjL%2B9FQBoMHkFdRR9p%2FKSNOQ%2FudK%2Bmni"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
cf-ray: 852ce2b4e9f22bc1-FRA
alt-svc: h3=":443"; ma=86400
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H3 200 mccreepy-server.js Show response
heromc.net/wp-content/themes/magicraft/library/js/ 188 B
651 B 890ms
889ms Script
application/javascript 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heromc.net/wp-content/themes/magicraft/library/js/mccreepy-server.js
Requested by: Host: heromc.net
URL: https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1002caaeb437132bc21a8d7b3f78898c85b4fbd4d798f409a9bab0b4db897c34

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: public
date: Fri, 09 Feb 2024 14:43:36 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"61724a44-bc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5B85qiUXqiahgXNYOo%2B9oFONeWtltuvXbT2mILJXFzcNOEa9cIpOg3TWAw47v%2Bsorp399Z5f%2B71FGCpGWYLQ3dE2qmzLEFP3fhG8qxU%2BJuuZOw2pL4GyRziO5V%2FpKXaD60nQytOFRFce"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
cf-ray: 852ce2b4e9f72bc1-FRA
alt-svc: h3=":443"; ma=86400
expires: Sun, 10 Mar 2024 14:43:36 GMT

GET
H3 200 scripts.js Show response
heromc.net/wp-content/themes/magicraft/library/js/ 4 KB
2 KB 1379ms
1378ms Script
application/javascript 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heromc.net/wp-content/themes/magicraft/library/js/scripts.js
Requested by: Host: heromc.net
URL: https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 68ccd4574efd9977168f45d2b4ffe3d750dd5d3123cf1759b5eb09ed8290749a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: public
date: Fri, 09 Feb 2024 14:43:37 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"61724a44-10ef"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Az0ioL8r%2BcnYJ7cIKqN9rEKBfVj0WPfC0afxp%2Fwt6wamK4kALL14E3M7hw2SSa0ZxqOOKOicFHFiLn5H7M8ZRYPOsslm5M%2BJ6kELL82wcP85lZE6C19EJy0Qp%2BL7U7QMJH3np2v%2BwQI1"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
cf-ray: 852ce2b4e9fa2bc1-FRA
alt-svc: h3=":443"; ma=86400
expires: Sun, 10 Mar 2024 14:43:37 GMT

GET
H3 200 kk-star-ratings.min.js Show response
heromc.net/wp-content/plugins/kk-star-ratings/src/core/public/js/ 1 KB
1 KB 1414ms
1412ms Script
application/javascript 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heromc.net/wp-content/plugins/kk-star-ratings/src/core/public/js/kk-star-ratings.min.js
Requested by: Host: heromc.net
URL: https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: acdebf935ded5cb063dcca7c46be5bbc503af5e76e295f6d0b7093c4514ed256

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: public
date: Fri, 09 Feb 2024 14:43:37 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 25 Oct 2023 14:45:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"653929ff-54f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sHmpdYc6JD%2F3WYpEEbAIE0ZsiwUHo2uzQQx5Xh0E3epvk3zqS4awbuj6t9ZAHBBiSOXVjSkDMRNCPmhDTrcFrKjJtOsB7Mc%2BXKCW6LujbtdKFZ78umOq4L9n9UkyaU0kJ32O%2F9Q9emVC"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
cf-ray: 852ce2b4e9ff2bc1-FRA
alt-svc: h3=":443"; ma=86400
expires: Sun, 10 Mar 2024 14:43:37 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 154 KB
51 KB 77ms
52ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: heromc.net
URL: https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7699e04e30163c1f8eca8ed7974c1d49c02919ae6d01e889163215d50cfd31cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52132
x-xss-protection: 0
server: cafe
etag: 2169651887449832288
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
expires: Fri, 09 Feb 2024 14:43:35 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 263 KB
90 KB 49ms
24ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-J1B76F87B0

Requested by

Host: heromc.net
URL: https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5c942a6c7365efbc92f5477fa57bad66f2c324e242e2ba646bb3d527cfaa51d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 91317
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 09 Feb 2024 14:43:35 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.9.1/ 90 KB
91 KB 32ms
7ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js

Requested by

Host: heromc.net
URL: https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:18:16 GMT
x-content-type-options: nosniff
age: 138319
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 92629
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Feb 2025 00:18:16 GMT

GET
H3 200 modernizr.custom.min.js Show response
heromc.net/wp-content/themes/magicraft/library/js/libs/ 15 KB
7 KB 231ms
230ms Script
application/javascript 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heromc.net/wp-content/themes/magicraft/library/js/libs/modernizr.custom.min.js
Requested by: Host: heromc.net
URL: https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4894e5974a57f4338abd4311e8b170b25510b81decc2e71c2c3a5558fa4561c1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: public
date: Fri, 09 Feb 2024 14:43:36 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 22 Oct 2021 05:21:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"61724a44-3b19"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LTXxEzEtaL%2BMDFLy00P6yEwKN6XOYUQxWQoSb2ARleWyVZi6XXKTm9ZdK1964MYX1XnsbxPe18K9NbJPQAj%2F8KzhU9iJOLlxqJZk28DnmAnL54JgXSstyQ2tLQV0feB5zKx6Im234SMZ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
cf-ray: 852ce2b4ea042bc1-FRA
alt-svc: h3=":443"; ma=86400
expires: Sun, 10 Mar 2024 14:43:35 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 41ms
17ms Script
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=vi

Requested by

Host: heromc.net
URL: https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d50130d61c73351be05ac038a96bb295ac2a55dbf5bf49ef2382a5bd2f7aff33

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Fri, 09 Feb 2024 14:43:35 GMT

GET
H3

200

main.js Show response
heromc.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/ Frame 34EA
Redirect Chain

https://heromc.net/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://heromc.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js

7 KB
4 KB

13ms
13ms

Script
application/javascript

2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://heromc.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Server

2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2c03a4346165dd4905961ed79c6441389d61862811ea39091b833ab97f0c7535

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qdKq%2Ftsb5cAZ2NYG3%2BWnrPGo5MJFTUgf60k7x3%2FMn2PUogTts4UZZiu9jAt8qHr08L0hk182tnnK6VjTRm1AotF2lUM6ndmdj89aL8hz%2FxJkJbch7k4XzApOLwLaMW53%2Bp%2FcaCtNi282"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 852ce2b50a3c2bc1-FRA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Fri, 09 Feb 2024 14:43:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MVTZ6qZJ73RMsnmbqfbPsfZo%2FKr4wJVce8y0TTaFZOXlLcuIJOq8ibB431UOzkaTtebso2dd59uuqJ7qc8xIrUVIVrsEJLW0m9iDrdEjQzSV5ziNvUNeFHdnkFBxmjMY1nQQvQmTl7Yo"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js
cache-control: max-age=300, public
cf-ray: 852ce2b4ea062bc1-FRA
alt-svc: h3=":443"; ma=86400

POST
H3 200 852ce2a92ac82beb Show response
heromc.net/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 34EA 0
587 B 35ms
35ms XHR
text/plain 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heromc.net/cdn-cgi/challenge-platform/h/b/jsd/r/852ce2a92ac82beb
Requested by: Host: heromc.net
URL: https://heromc.net/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 09 Feb 2024 14:43:35 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vd48A82g%2Bas6cfmdI1MEL%2BMThH2SG9NdlkB3c%2FeG1YphqvLtvI4y05nKpGjGSyShMTcbgmLc5sTp8%2BrCBH2dS40Y5LNLp31pPiZmq74cIsskFtnAIE7NYJ1zUOLjrIzn06btmNaYMJvG"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 852ce2b58b222bc1-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 recaptcha__vi.js Show response
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ 499 KB
500 KB 30ms
8ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__vi.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=vi

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a30d9bdc734a648e828f2589034bc41499c2232bc8f4aaaaba172352328afc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heromc.net/
Origin: https://heromc.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:05:04 GMT
x-content-type-options: nosniff
age: 139114
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 510912
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 00:05:04 GMT

GET
H3 200 wp-emoji-release.min.js Show response
heromc.net/wp-includes/js/ 14 KB
5 KB 525ms
525ms Script
application/javascript 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heromc.net/wp-includes/js/wp-emoji-release.min.js
Requested by: Host: heromc.net
URL: https://heromc.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 956fa56f513e1a8025bc85f9314a1747eb061d434403393591145e4ae898c694

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: public
date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 22 Oct 2021 05:21:10 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"61724a46-363c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B8AKd5DKoks%2FQK27%2FCKKsuaJt%2BAXM3B%2FNq%2FIRjAA9wusn7u53g73N5L8BDPHpIJxULAAfiAm%2FucUiWVrW3vQxpL6kNZg9sBxk3xItbqLDTgODaPZ8oRop0GHp7tAioo0ddu5TlJJceGA"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
cf-ray: 852ce2c3dd362bc1-FRA
alt-svc: h3=":443"; ma=86400
expires: Sun, 10 Mar 2024 14:43:38 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 154 KB
51 KB 211ms
211ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: heromc.net
URL: https://heromc.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

23f1076ed4d8fc4dbf9f1d301953dae1d4fb8e051ce83a70cb8d46035a796ac6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52135
x-xss-protection: 0
server: cafe
etag: 12724898761431157497
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
expires: Fri, 09 Feb 2024 14:43:38 GMT

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402010101/ 406 KB
138 KB 200ms
200ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5905678404304295&plah=heromc.net&aplac=true&bust=31080932

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f3c787c73f92b8da87e1ab86c9c7a937ecf32841d3d40678d79a7e1e35cfe44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 140916
x-xss-protection: 0
server: cafe
etag: 8159105419470034348
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 14:43:38 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240207/r20190131/ Frame B85B 9 KB
5 KB 152ms
11ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240207/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heromc.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 40912
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 03:21:46 GMT
etag: 3890843268177463596
expires: Fri, 23 Feb 2024 03:21:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
region1.analytics.google.com/g/ 0
250 B 152ms
23ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-J1B76F87B0&gtm=45je4270v878360096za200&_p=1707489818054&_gaz=1&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=794529133.1707489818&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1707489818&sct=1&seg=0&dl=https%3A%2F%2Fheromc.net%2F&dt=HeroMC.NET%20-%20Minecraft%20Vi%E1%BB%87t%20Nam&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=4360
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-J1B76F87B0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:38 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heromc.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
241 B 162ms
19ms Ping
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-J1B76F87B0&cid=794529133.1707489818&gtm=45je4270v878360096za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l3l1&npa=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-J1B76F87B0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:38 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heromc.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 194ms
40ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-J1B76F87B0&cid=794529133.1707489818&gtm=45je4270v878360096za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l3l1&npa=0&z=183489696

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

main.js Show response
heromc.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/ Frame 34EA
Redirect Chain

https://heromc.net/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://heromc.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js

7 KB
4 KB

21ms
20ms

Script
application/javascript

2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://heromc.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js

Protocol

Server

2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd675c0f06dfff9a382d9a2e971be6fe752f344b32dc793b9f8338259e254e34

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N4C0jdsPvGLiSg0YDx6joCVXBEibUu4B2bSNMlklSszkFrvn5h302mBY0Rq82xHEfP9YK5T%2Ba1TWqikXjXchJfCjkQgDxj6j4xGgz3vt8hwMTEDEZKmFz40S0%2BlUU5AJHVaK4kp%2FiWXo"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 852ce2c3ed7c2bc1-FRA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Fri, 09 Feb 2024 14:43:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vhmsge5duZrmnKZefLVQeDLUcl4jQbMTkkocB9vHkGovYTAr3yGp3%2B2QHk1OyrC%2BFjA5ugttmoLhW4qAVnczLKrJq03mogZgBDN4n54EdWcUEAUZyBLHf%2Bbl9R0D3a%2FQUrRLYBtJFJk%2F"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 852ce2c3dd3a2bc1-FRA
alt-svc: h3=":443"; ma=86400

POST
H3 200 admin-ajax.php Show response
heromc.net/wp-admin/ 0
587 B 465ms
465ms XHR
text/html 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://heromc.net/wp-admin/admin-ajax.php

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://heromc.net/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN, SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://heromc.net
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1y8Doh0wXlY%2BG3g877x4gEG0jCxFB4mUAIOZFnzkElDtBHvPUY%2F%2Bb9PsWu4I9oKUdLa7XtwJ%2BHIrrivQRl%2FtYMdpfIbGBZakm3%2BMonQ2R430vtjjojlUHXbnAE0V2bYpFvje6UBEFgxz"}],"group":"cf-nel","max_age":604800}
cache-control: no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
x-robots-tag: noindex
cf-ray: 852ce2c3dd3e2bc1-FRA
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 284 KB
68 KB 116ms
115ms Script
application/javascript 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151605

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ebe0f94ca53bc5f7d865f89aec5b0315bca03ace6942d6c1c76d94d5b59d419a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:38 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 3176
etag: W/"e3be409ac3c100e2a5d3f264ec260551"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 852ce2c3de4265be-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Mon, 12 Feb 2024 14:43:38 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/vi_VN/ 303 KB
87 KB 96ms
96ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/vi_VN/sdk.js?hash=d37cf6d61f6b43b51f068e32f8d879ba

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/vi_VN/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5badd46fcef85df860351a6a95ce0228a16c3f78f0a48e398b439eb52e4c1832

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://heromc.net/
Origin: https://heromc.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 09 Feb 2024 14:43:38 GMT
content-md5: 82OMvx5J2mQv1ahWMmKd3w==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 88597
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-debug: 5OBXgopUTtX+lGhfVVq8T+G+j0lQLIhEmpPSwB0ndTXZh7u7voutjemHAcG5qH459M6set0iL4H1ifKAEvGQcg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 3fab76b3c021585850450bfb61a1105e
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "6f8547dbc08c14c2b0275fbad389a7e9"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
expires: Sat, 08 Feb 2025 12:40:04 GMT

GET
H2 200 page.php Show response
www.facebook.com/v17.0/plugins/ Frame 4F14 50 KB
18 KB 223ms
207ms Document
text/html 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v17.0/plugins/page.php?adapt_container_width=true&app_id=737463590128289&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfb998dbd1de720c2d%26domain%3Dheromc.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fheromc.net%252Ff3861c9b316657417%26relation%3Dparent.parent&container_width=205&height=250&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fheromc.net%2F&locale=vi_VN&sdk=joey&show_facepile=true&small_header=false&width=235

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/vi_VN/sdk.js?hash=d37cf6d61f6b43b51f068e32f8d879ba

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ebc61198f08befb8a7deb1d87cb6958723c1cef176db94b01b3d22e3a23225d9

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com .tenor.co media.tenor.com .tenor.com .giphy.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co media.tenor.com .tenor.com https://.giphy.com;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://sandbox.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heromc.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co media.tenor.com *.tenor.com *.giphy.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co media.tenor.com *.tenor.com https://*.giphy.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://sandbox.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: unsafe-none;report-to="coop_report"
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 14:43:38 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
facebook-api-version: v17.0
origin-agent-cluster: ?0
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=();report-to="permissions_policy"
pragma: no-cache
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: jyPFi//VVOoEjlb8KYsgYnjUKVxt7h2I7NEfkbW7+pKCZRLBna1zQ0Kwg2rcC12whTAk8bPfLbbg8oTk6eaNzQ==
x-xss-protection: 0

GET /
www.facebook.com/plugins/customer_chat/SDK/ 0
0

GET
H2 200 / Show response
www.facebook.com/plugins/customer_chat/facade/ 1 KB
3 KB 170ms
155ms XHR
application/json 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/customer_chat/facade/?app_id=737463590128289&attribution=setup_tool&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df840a37de4a7565fb%26domain%3Dheromc.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fheromc.net%252Ff3861c9b316657417%26relation%3Dparent.parent&current_url=https%3A%2F%2Fheromc.net%2F&is_loaded_by_facade=true&locale=vi_VN&log_id=2759cf0e-3634-4340-9939-b2cea2bdb6ce&logged_in_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&logged_out_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&page_id=100438678093740&request_time=1707489818269&sdk=joey&should_use_new_domain=false&suppress_http_code=1

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/vi_VN/sdk.js?hash=d37cf6d61f6b43b51f068e32f8d879ba

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

02c3c64096cce72a3d6d94cef583f53809e493244f1a17803a7f91d8c274f9c3

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com .tenor.co media.tenor.com .tenor.com .giphy.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co media.tenor.com .tenor.com https://.giphy.com;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://sandbox.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://heromc.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=();report-to="permissions_policy"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co media.tenor.com *.tenor.com *.giphy.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co media.tenor.com *.tenor.com https://*.giphy.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://sandbox.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
date: Fri, 09 Feb 2024 14:43:38 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: no-cache
x-fb-debug: 2YgD+q2x9XUWpC35ymHLNzARh1aijLvPQhsUnto0lbL/2b7dL9+0JaPTmUxhKTiyfhA2A2QC5BZyu3AWLrcoHA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/json; charset=utf-8
x-frame-options: DENY
access-control-allow-origin: https://heromc.net
origin-agent-cluster: ?0
cache-control: private, no-cache, no-store, must-revalidate
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H3 200 852ce2a92ac82beb Show response
heromc.net/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 34EA 0
591 B 37ms
37ms XHR
text/plain 2606:4700:3034::ac43:b1b3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heromc.net/cdn-cgi/challenge-platform/h/b/jsd/r/852ce2a92ac82beb
Requested by: Host: heromc.net
URL: https://heromc.net/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b1b3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IqAW6GO%2BF5dzBKXeoEH9EqDlyPvsHnv%2Bt6GHLU%2BbC1LXalbMhrCqKM5YYiifg7Rd9K8gP7PmNgSRo8CfYN42bBqPWwq%2FZIoaHgXPLzGznQ8eFrC1vzu0SA6gFNHw9ZWCyq%2FB7EMxIDXm"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 852ce2c49f072bc1-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 web Show response
onesignal.com/api/v1/sync/74052606-2268-4a62-a71e-43adfd91a21e/ 3 KB
2 KB 94ms
75ms Script
text/javascript 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/74052606-2268-4a62-a71e-43adfd91a21e/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151605

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e423d27a6a3f918e06baca1f811be31cd5a8c684c548d9b430fe20b683b1aeb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:38 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 7ee0e517-0147-478f-bbf3-d2c4314122e1
x-runtime: 0.031005
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"e423d27a6a3f918e06baca1f811be31c"
x-download-options: noopen
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 852ce2c4cfbe65be-FRA
access-control-allow-headers: SDK-Version
expires: Fri, 09 Feb 2024 15:43:38 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7B6F 715 KB
174 KB 1845ms
1844ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5905678404304295&output=html&adk=1812271804&adf=3025194257&lmt=1707337638&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=308x945_l%7C308x945_r&format=0x0&url=https%3A%2F%2Fheromc.net%2F&pra=5&wgl=1&easpi=1&asro=0&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6~9~15&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707489818077&bpp=3&bdt=3645&idt=362&shv=r20240207&mjsv=m202402010101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2653707993091&frm=20&pv=2&ga_vid=794529133.1707489818&ga_sid=1707489818&ga_hid=1471790896&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44808397%2C31080780%2C44795921%2C31080932%2C95320869%2C95324154%2C95324160%2C95324267&oid=2&pvsid=4143772374498493&tmod=1660664628&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=374

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5905678404304295&plah=heromc.net&aplac=true&bust=31080932

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

92adf2b1dfc402327ac6d6c6442a312cde9472707ed65f31ecaa1b5f9d9df87a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heromc.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 177579
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 14:43:40 GMT
expires: Fri, 09 Feb 2024 14:43:40 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 68ms
53ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20240207&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5141a8ba7925635dd9a8ca7f45008eb9c97346ad0a23861d0960aa5d8818d63b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12386
x-xss-protection: 0

GET /
www.facebook.com/plugins/customer_chat/SDK/ 0
0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 65B1 114 KB
42 KB 1028ms
1028ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5905678404304295&output=html&h=280&slotname=5270923614&adk=2616852592&adf=2704279354&pi=t.ma~as.5270923614&w=702&fwrn=4&fwrnh=100&lmt=1707337638&rafmt=1&format=702x280&url=https%3A%2F%2Fheromc.net%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707489818080&bpp=1&bdt=3648&idt=375&shv=r20240207&mjsv=m202402010101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2653707993091&frm=20&pv=1&ga_vid=794529133.1707489818&ga_sid=1707489818&ga_hid=1471790896&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=325&ady=588&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44808397%2C31080780%2C44795921%2C31080932%2C95320869%2C95324154%2C95324160%2C95324267&oid=2&pvsid=4143772374498493&tmod=1660664628&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=377

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2e9b322621f9bdb9042b8b3f884ae73bdf167afe2a8a9d0cf2fc88ee44c6719

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heromc.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 42575
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 14:43:39 GMT
expires: Fri, 09 Feb 2024 14:43:39 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 S6m8G67lrDr.css
static.xx.fbcdn.net/rsrc.php/v3/yA/l/0,cross/ Frame 4F14 17 KB
5 KB 14ms
13ms Stylesheet
text/css 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yA/l/0,cross/S6m8G67lrDr.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v17.0/plugins/page.php?adapt_container_width=true&app_id=737463590128289&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfb998dbd1de720c2d%26domain%3Dheromc.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fheromc.net%252Ff3861c9b316657417%26relation%3Dparent.parent&container_width=205&height=250&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fheromc.net%2F&locale=vi_VN&sdk=joey&show_facepile=true&small_header=false&width=235

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8d77e1f6c897cfb95b954e83020b7ec73f930b6819e06a9fcb81de2f5ed7f999

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: q5/v/Gre1l3pQu7QMJFIEA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4552
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-debug: dQLw2g0+1r2G/EPyP/IwGm7RdWz0tlefEEqKZle5yR+BkPtvyeusFvVEF+qPl41bpOt3ieqQVoz5lj7gnOIHww==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
timing-allow-origin: *
expires: Fri, 07 Feb 2025 18:17:13 GMT

GET
H2 200 al4jLJ1tDHk.css
static.xx.fbcdn.net/rsrc.php/v3/y-/l/0,cross/ Frame 4F14 22 KB
5 KB 15ms
14ms Stylesheet
text/css 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y-/l/0,cross/al4jLJ1tDHk.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5fbcf1b2f16a65a5e6787320aa4802664c5934374b0c4c09d82d1d9b9c5b7a44

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: srsY8w3GuGnmfLnBc1ePsw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5025
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-debug: nvT6KkNOoHGDcuaiJiAoNieiElXPShq6v8hmh1sGV9db//f/RlMR6B1bF4zN3nNdVp51hDeT+0h1EuKIhkZbyg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
timing-allow-origin: *
expires: Fri, 07 Feb 2025 18:17:13 GMT

GET
H2 200 8tjXSt2RnQN.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yq/r/ Frame 4F14 355 KB
92 KB 15ms
15ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yq/r/8tjXSt2RnQN.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

955a0b70354e7bbdc381d6bd4c96cfbdc3532aef979ce69c6d0b7c1dd17fd574

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 2Krs/iChyLb7nbnk/E11EA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 93884
x-fb-debug: uuiLnGN0ikxJt0BV7s6GOwvsbJYWlRLw3p6Bsglb5Tyad829hgwwqFP48fe4ZnL9GOWveI3ugEc2GKHPeYXneg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Fri, 07 Feb 2025 02:23:28 GMT

GET
H2 200 8ZrPme2EwKH.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yc/r/ Frame 4F14 9 KB
3 KB 16ms
15ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yc/r/8ZrPme2EwKH.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2910a75fe798cbb18961bf9510620ee4edbc664b99037f2a9b0b0af70a8d9631

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: JieWsOvZ3RFDEjZePuauxg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2809
x-fb-debug: gWbLM/8zHdMFXrNFFcgLsSQ6fbBezlbuMjNJbeeEUXRs540YEKCH6Bv4aJxZtrGyBGxMkEmE67CyvFCqfQ3ojA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 25 Jan 2025 17:02:02 GMT

GET
H2 200 ZxkW9Z78oH3.js Show response
static.xx.fbcdn.net/rsrc.php/v3iSa94/y-/l/vi_VN/ Frame 4F14 108 KB
31 KB 26ms
26ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iSa94/y-/l/vi_VN/ZxkW9Z78oH3.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aec2dff0d104a2635c64ceff0891361fbe9ce047dca4b8e77b97f224e2e17420

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: vSmUQb9XjF2xJfn7DYNDoA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 31435
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-debug: OrIwpG1cHYkNDQRFEvSOCZmHODHDOduCoUpY7YglBGifyoThQovGnbnrB2NxoOffTI40SGR94P0JD/j0+gNpyQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
timing-allow-origin: *
expires: Fri, 07 Feb 2025 22:48:14 GMT

GET
H2 200 p55HfXW__mM.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yF/r/ Frame 4F14 507 B
487 B 19ms
19ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/p55HfXW__mM.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9e57fedb96b3686621bccd5521f43a2037a823c74f062176952890b179b3955b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: L5E9gSgR735vyjAzTFly4g==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 293
x-fb-debug: vzREc0PYA3qBB87nWWSOStpimTrjDFrObIM0YptMrRF8h2xzcoHOM+jboTO0UlImmKd1nDe5M9rg6TUG60QjWw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Fri, 31 Jan 2025 17:01:10 GMT

GET
H2 200 tqqv7FFsWpQ.js Show response
static.xx.fbcdn.net/rsrc.php/v3/y0/r/ Frame 4F14 216 KB
62 KB 14ms
14ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y0/r/tqqv7FFsWpQ.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d513719889530e68670b8b02f1b66ddd93d6a768c942bf7987d4004d185893a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 3nsYZ1VYmeTb5oos+6qR8Q==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 63208
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-debug: SJKc9T+/1iEi8W8EvGsurzFg8ibV9Ga1akIksIGFHIN0XC5cGD46ukKcAOJq8OQsEjhQUxqShAhR2X2efor9Gw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 08 Feb 2025 03:25:00 GMT

GET
H2 200 kCgk__hWT3L.js Show response
static.xx.fbcdn.net/rsrc.php/v3/y-/r/ Frame 4F14 45 KB
13 KB 15ms
14ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y-/r/kCgk__hWT3L.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4631d527023234963558a2e314863def038bacab84626d0f7bb63aab6982597a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: Gd6rGehkKRC/0haNqPf7Hg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 12859
x-fb-debug: v9M6vSsL1RRrmElmHJ4KM0maA2c9fPAgINf6h/w2h0Vz9PJ7Jum4Kk3cnhvS8J4BSEXG/botWf+f8aK6JkaBjQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Wed, 29 Jan 2025 17:47:16 GMT

GET
H2 200 2o-XRyr-n9k.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yD/r/ Frame 4F14 94 KB
27 KB 19ms
19ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yD/r/2o-XRyr-n9k.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

df69087d551c81123be79901817746b3989b89049c4423f90972be0aea4c7d1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: TfpQvzLG3jSKUDNcIJi79A==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27504
x-fb-debug: VFSmRH+GyX6sw5hbUijaNgt7uLaKlmq1r4E/pT7uCvi3whA4HA/cy6WfCy8j1XKRMYwe3WjpeZa5U1W2e0JNBA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Feb 2025 00:34:43 GMT

GET
H2 200 329117083_697394955188796_1444847142033764114_n.png
scontent.xx.fbcdn.net/v/t39.30808-6/ Frame 4F14 69 KB
70 KB 177ms
161ms Image
image/png 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.xx.fbcdn.net/v/t39.30808-6/329117083_697394955188796_1444847142033764114_n.png?stp=dst-png_p130x130&_nc_cat=101&ccb=1-7&_nc_sid=081abc&_nc_ohc=LO_3utWRjT4AX_xeT8u&_nc_ht=scontent.xx&edm=AK3JJvAEAAAA&oh=00_AfDeDMy8OJdO5g6Bn6h3ZBVrrQaJFoqAnx1w_s5W-v6n0A&oe=65CA91F3
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/v17.0/plugins/page.php?adapt_container_width=true&app_id=737463590128289&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfb998dbd1de720c2d%26domain%3Dheromc.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fheromc.net%252Ff3861c9b316657417%26relation%3Dparent.parent&container_width=205&height=250&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fheromc.net%2F&locale=vi_VN&sdk=joey&show_facepile=true&small_header=false&width=235
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 2d49cf88d7d6b90b8db4a89c42c8b3c3d6978b0f5fb7c76662bb8232317634a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:38 GMT
x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET
last-modified: Mon, 06 Feb 2023 16:29:08 GMT
content-type: image/png
access-control-allow-origin: *
content-digest: adler32=3028781735
thrift_fmhk: GBAitcO+Tqdrn2HPzD3SsGaMFfDr4Z0EvFUAAAA=
cache-control: max-age=1209600, no-transform
x-fb-edge-debug: cHpoRDKdJ05CdtPF9iQWSobYCMuRnA_FNoF5VoEeSqpV0vWkB-0TGD3J7uSjrgcA40WSi0nOOJ4Bo0-LIfksK6TUnZOl-7nTQg18JaJrNRx8FGOyoth5ZyKiKKqBJiW0
cross-origin-resource-policy: cross-origin
x-needle-checksum: 2939250926
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 70984

GET
H2 200 426411905_911838034155542_5996669659223362460_n.jpg
scontent.xx.fbcdn.net/v/t39.30808-1/ Frame 4F14 2 KB
2 KB 125ms
110ms Image
image/jpeg 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.xx.fbcdn.net/v/t39.30808-1/426411905_911838034155542_5996669659223362460_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=100&ccb=1-7&_nc_sid=4da83f&_nc_ohc=VFPaMzk_8K4AX_0tIS-&_nc_ht=scontent.xx&edm=AK3JJvAEAAAA&oh=00_AfCU7gGXC7MzxVVjw8bOcvyk2UeCr-xCulTPU4tWn5luNA&oe=65CC1E5A
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/v17.0/plugins/page.php?adapt_container_width=true&app_id=737463590128289&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfb998dbd1de720c2d%26domain%3Dheromc.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fheromc.net%252Ff3861c9b316657417%26relation%3Dparent.parent&container_width=205&height=250&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fheromc.net%2F&locale=vi_VN&sdk=joey&show_facepile=true&small_header=false&width=235
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 66291c6339214bc78d8ec44315894a8d146e1ab70c94862c904ad729170744fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:38 GMT
x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET
last-modified: Fri, 09 Feb 2024 03:08:31 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=2089798377
thrift_fmhk: GBCJIWlqt6ScIaiVfluVlsQvFfDr4Z0EvFUAAAA=
cache-control: max-age=1209600, no-transform
x-fb-edge-debug: phgQZqr-z8cT9SnzmtNyNpvWY6uJ1A7E3TZounSQG2GskhHY9bU4sU990DU_4c-tdlnurpCgZU5zorDL92p4yKh_ruSLq6YSo_-NOx7AUz6hKMX6fVIjr6Y4T6rknWYA
cross-origin-resource-policy: cross-origin
x-needle-checksum: 3754546362
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 1982

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 95ms
52ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 09 Feb 2024 14:43:38 GMT

GET
H3 200 UXtr_j2Fwe-.png
static.xx.fbcdn.net/rsrc.php/v3/yw/r/ Frame 4F14 573 B
713 B 17ms
7ms Image
image/png 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yw/r/UXtr_j2Fwe-.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yA/l/0,cross/S6m8G67lrDr.css?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

96e3e8dfde6b1042514824bac1b44282d4a76bac028f2d767f6534dce2cf3db0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yA/l/0,cross/S6m8G67lrDr.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
date: Fri, 09 Feb 2024 14:43:38 GMT
x-content-type-options: nosniff
content-md5: 07aG/2AEtDHVAZ5LUajMDQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 573
x-fb-debug: LhsDVs3UQ50SkCNiLcUn9IK35jiYXKDyq51GlpRtQgqR0nTy4QwsiiXTm+vY3NOW9SRVyDqRUye1SpBEYojZuQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/png
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=1,i
expires: Thu, 06 Feb 2025 04:19:59 GMT

GET
H3 200 u7L7xDrlXEl.js Show response
static.xx.fbcdn.net/rsrc.php/v3i_954/yl/l/vi_VN/ Frame 4F14 26 KB
8 KB 9ms
9ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3i_954/yl/l/vi_VN/u7L7xDrlXEl.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yq/r/8tjXSt2RnQN.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f15f2d36ea3ee2a257d53268887835c64928fc2cb02c334191b82141acd9773f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
date: Fri, 09 Feb 2024 14:43:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: eKBxDspUoG1wwX3wiruKCw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 8466
x-fb-debug: xF06Ww6xS31NEhlL3VQXqHHe2ac08vnbr411RiAkuRe/OyyqhsJDaraUAA0UAcQvgibePWmZBpj8WHKVs4tw+A==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=1
expires: Sat, 01 Feb 2025 16:52:53 GMT

GET
H3 200 hIQWajJxOFj.css
static.xx.fbcdn.net/rsrc.php/v3/yg/l/0,cross/ Frame 4F14 78 B
214 B 8ms
8ms Stylesheet
text/css 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yg/l/0,cross/hIQWajJxOFj.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yq/r/8tjXSt2RnQN.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9f48791ee0215f3b7f63318fa6ec17dc151f02a0797cbb831d8289995f322576

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
date: Fri, 09 Feb 2024 14:43:38 GMT
x-content-type-options: nosniff
content-md5: 5ahctDNSiI0/RgP+EyGMAg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 78
x-fb-debug: 2WkYcBFVLsTDdeVWc7pO7OnTRV2wMaYr/njhx7nB7zQnVfj0JCdmPWOXh8pnFu+qaVC6efz7zu91CE3op4VMyQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
x-fb-optimizer: 0
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=0
expires: Wed, 29 Jan 2025 00:03:29 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 9742 13 KB
5 KB 8ms
7ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heromc.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2050
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 14:09:28 GMT
expires: Sat, 08 Feb 2025 14:09:28 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 9119 829 B
943 B 17ms
17ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

0cd5f3c1dede77418576a916dada2b2cbd9999099c01dcbb4a1862426246d986

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-oN5tt8vwaTu8uwL6DDiSxA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://heromc.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-oN5tt8vwaTu8uwL6DDiSxA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 14:43:38 GMT
expires: Fri, 09 Feb 2024 14:43:38 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame 9742 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 07:36:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25616
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 08 Feb 2025 07:36:42 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 9119 0
0 38ms
38ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20240207&jk=4143772374498493&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 9742 0
10 B 18ms
17ms Image
text/plain 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?xBw_7A
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:38 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 40ms
40ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20240207&jk=4143772374498493&bg=!AAOlA0zNAAaxkZ3akZE7ADQBe5WfON4yDouqsxatZtXQUI9gnHWTIo8kN4Pj17A6Tul0rDD7ZNhHslJaLydMEj3Ib2U-AgAAACdSAAAAAmgBB5kCwbR1rYrA7YSrOxHeR_9PNSGr62cHcMiO8_FwehRglTLItZp4KmkMGHfTRdjWEisJzX5sJbw_G8hGT4gArERdkTadOr3BDh1cG4zASBoquqyOl3tPFP8C2fN6WASr5JM8uZha9x-7c6nta8F1ZekxTdEEBeLlPozGAOlCggBuHQCtFcGnGl0NGkWRMc3i8T7zGOFCcHb4ZjyCUPdfuCdtSJ8qCiq9wKHjCKF8IDd3DsIA9BGvhqnrFmGhSUg5eXS_9ZM6yR0zaODHtiX_uL6QZjazEm2_TTGwakkKK6bDCxGfBGDKYOflae-rbMkWioUr12KKLvVAznF9kv7OQCf4g30SPMU_fc3DwheEeCGTu86Id_VU0dwb80ibY_hBFKP1l21vqQATSIRMIU5AazzcJvdKhMDKx9zVOAPZmHiu0cmrau6RI5tvUMvuXuVI9asS0ZeGRUjEAT1n7_J3t20W3tq1wAIC2Uxrx9lU5NAdv-sToBqG-p-WRGNHkB_wCFbn7DYDS3nntBy28cecbIhD0o9JnLIJssUf2bxEZuvkSZfQaXKA0sbTY0oOecEIx6jvxlzq_RwPvqDX6mreOyGl0-1YmyJOfhM97ao5vpDrTgg2m91T3Bjr2kzQkBgeOpk7Es1bR4Nxfd5TTo6wvRP_IoCz1Rn3ST3wYZW_BK6CmO2CcqYENITN5V_AZcDusHvYQy0pWOutLjxac5IEt1jhj6nXV9ht-R_xim4o3S59ujMoPe3jy-XfaFjLLzsOOU2FBrrYXv8qGxxUYH_JdNX1-lTX8mcK3GGoNXdMuWKzgSHFz532u9_QqAZikucqG84PCwwZ4Tgt7DaDg2K-1OLYJ1Ma1g_QjDSuj71h06g60Ch1jc8HVUvkyEGGTGVwXTISQRAOv5aoq5szsD7JaKWIvhE49yA5PrpYM7oJMEK0wk_HyQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

GET
H3 200 148742464806174268
tpc.googlesyndication.com/simgad/ Frame 65B1 18 KB
18 KB 11ms
11ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/148742464806174268?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qnNnQgcSmGSEKCUC5zdqT6lGRhJ_g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5905678404304295&output=html&h=280&slotname=5270923614&adk=2616852592&adf=2704279354&pi=t.ma~as.5270923614&w=702&fwrn=4&fwrnh=100&lmt=1707337638&rafmt=1&format=702x280&url=https%3A%2F%2Fheromc.net%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707489818080&bpp=1&bdt=3648&idt=375&shv=r20240207&mjsv=m202402010101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2653707993091&frm=20&pv=1&ga_vid=794529133.1707489818&ga_sid=1707489818&ga_hid=1471790896&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=325&ady=588&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44808397%2C31080780%2C44795921%2C31080932%2C95320869%2C95324154%2C95324160%2C95324267&oid=2&pvsid=4143772374498493&tmod=1660664628&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=377

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b79e2f319a4307b8efa970936f6bf86a8236c2de2cb980c5950ed65b48a28c18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:05:38 GMT
x-content-type-options: nosniff
age: 139081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18245
x-xss-protection: 0
last-modified: Tue, 18 Jul 2023 17:40:43 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 07 Feb 2025 00:05:38 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/ Frame 65B1 23 KB
9 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46744
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 3610546441309021303
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:44:35 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 65B1 3 KB
1 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 08:31:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22301
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 08:31:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 65B1 20 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46744
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:44:35 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 65B1 205 KB
62 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84af93c376277b2fb1c7962b45ce84e1e0a31202815ceb873bd980df4378f62b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:19:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1462
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63267
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 15:19:17 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 65B1 36 KB
15 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

083453bf4d12b9c46f44e3b434994e63ab8d8507300e67eaa25d9c7a9c0354bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 02:11:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45141
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14866
x-xss-protection: 0
server: cafe
etag: 15811255140505289687
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 02:11:18 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 245E 143 B
166 B 9ms
8ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5905678404304295&output=html&h=280&slotname=5270923614&adk=2616852592&adf=2704279354&pi=t.ma~as.5270923614&w=702&fwrn=4&fwrnh=100&lmt=1707337638&rafmt=1&format=702x280&url=https%3A%2F%2Fheromc.net%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1707489818080&bpp=1&bdt=3648&idt=375&shv=r20240207&mjsv=m202402010101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2653707993091&frm=20&pv=1&ga_vid=794529133.1707489818&ga_sid=1707489818&ga_hid=1471790896&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=325&ady=588&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44808397%2C31080780%2C44795921%2C31080932%2C95320869%2C95324154%2C95324160%2C95324267&oid=2&pvsid=4143772374498493&tmod=1660664628&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=377
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 317
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 14:38:22 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 65B1 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0827113fe05e7038ca36b1867e03ee83e968bd71e55390152106dcf53f86882f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 245E
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

18ms
17ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 14:43:39 GMT
expires: Fri, 09 Feb 2024 14:43:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 14:43:39 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 65B1
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CXvCnGjrGZeKqINztxtYP6PGfiAWLk8HmdcrjnujxEbCQHxABIOOZhxxglYKAgJQHoAH34pu0KMgBAqgDAcgDyQSqBMYBT9CDLrvZf99936zCJOBwRCUt-CHsua8tr_PaKyCp4jhNJRezIdn...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%222304072450376908536%22,%22debug_reporting%22:true,%22destination%22:%22https://webcompanion.com%22,%22event_report_window%...

0
0

58ms
40ms

Fetch
text/css

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%222304072450376908536%22,%22debug_reporting%22:true,%22destination%22:%22https://webcompanion.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210846925175%22],%2222%22:[%22true%22],%224%22:[%2202-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2213084884110994329873%22}&andc=true

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:39 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"2304072450376908536","debug_reporting":true,"destination":"https://webcompanion.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10846925175"],"22":["true"],"4":["02-09"],"6":["true"]},"priority":"500","source_event_id":"13084884110994329873"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 09 Feb 2024 14:43:39 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 09 Feb 2024 14:43:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"2304072450376908536","debug_reporting":true,"destination":"https://webcompanion.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10846925175"],"22":["true"],"4":["02-09"],"6":["true"]},"priority":"500","source_event_id":"13084884110994329873"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 6A01 50 KB
19 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee8114911fb4532f4521a86c72653b2eaee580ffd8bec3445699bf569323f1b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:16:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 138410
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19829
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 00:16:49 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 61ms
39ms Preflight
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 09 Feb 2024 14:43:39 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402010101/ 165 KB
56 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402010101/reactive_library_fy2021.js?bust=31080932

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ca3584d93afd41ccd5b2bbc8162bfa18fff7838fb29ac6435c2ed72290e98905

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heromc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:40 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57064
x-xss-protection: 0
server: cafe
etag: 1826488285215369203
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 14:43:40 GMT

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/ Frame B971 9 KB
4 KB 7ms
7ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heromc.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 37150
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 04:24:30 GMT
etag: 3890843268177463596
expires: Fri, 23 Feb 2024 04:24:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/ Frame 5FE7 9 KB
4 KB 8ms
7ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heromc.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 37150
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 04:24:30 GMT
etag: 3890843268177463596
expires: Fri, 23 Feb 2024 04:24:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/ Frame 6FCF 9 KB
4 KB 8ms
7ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heromc.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 37150
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 04:24:30 GMT
etag: 3890843268177463596
expires: Fri, 23 Feb 2024 04:24:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/ Frame F51A 9 KB
4 KB 11ms
10ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heromc.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 37150
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 04:24:30 GMT
etag: 3890843268177463596
expires: Fri, 23 Feb 2024 04:24:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame B971 5 KB
790 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 09 Feb 2024 14:43:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 13:25:02 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 09 Feb 2024 14:43:40 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame B971 205 B
229 B 41ms
15ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 13:57:28 GMT
x-content-type-options: nosniff
age: 2772
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 08 Feb 2025 13:57:28 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame B971 604 B
628 B 42ms
16ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:16:06 GMT
x-content-type-options: nosniff
age: 138454
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 07 Feb 2025 00:16:06 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/ Frame B971 16 KB
7 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1984c4bb2ce10d00cb478c4ab216301e04502e25f2025b30dbeeb019172beb0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:47:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46598
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6823
x-xss-protection: 0
server: cafe
etag: 14359709190881042667
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:47:02 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/ Frame B971 22 KB
9 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c6f8aad2c2e01e81032eb3ce744f73450e33b1718dd95ee9cb968e76b8512f59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:47:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46598
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9451
x-xss-protection: 0
server: cafe
etag: 11136001603933606047
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:47:02 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 5FE7 14 KB
1 KB 17ms
17ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 09 Feb 2024 14:43:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 12:57:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 09 Feb 2024 14:43:40 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 5FE7 2 KB
822 B 8ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:44:35 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/ Frame 5FE7 23 KB
9 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 3610546441309021303
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:44:35 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 5FE7 3 KB
1 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 08:31:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22302
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 08:31:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 5FE7 20 KB
8 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:44:35 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 5FE7 205 KB
62 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84af93c376277b2fb1c7962b45ce84e1e0a31202815ceb873bd980df4378f62b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:19:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1463
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63267
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 15:19:17 GMT

GET
H3 200 7b5e6815b417a6dcda76775ec840e2bc.js Show response
www.gstatic.com/mysidia/ Frame 5FE7 37 KB
15 KB 26ms
8ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7b5e6815b417a6dcda76775ec840e2bc.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87e0bffd01248ccc0369b210b2b2004ded168a8fc478f628faa17974b7f4d6da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138476
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15515
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 17:13:29 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:15:44 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0B2A 624 B
245 B 56ms
48ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhi4-fODAjAB&v=APEucNUiCzduNvfkY4uBOayWnMSr2KzpTmDbWe7XDMuv3iiKdxYKWO08jhxNAm1n0PNAK_tE6iTk7VXyFdb-kalLI7SZwl8DWsAvMEtvudorv1OPwXTTc7Onp63F58COipp5FsOzQhL6_nLS5IPFUr7hbnCgmVkCD8aJMtqQ2TuPrOCnyQWQNL0

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 14:43:40 GMT
expires: Fri, 09 Feb 2024 14:43:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 04C0 111 KB
39 KB 82ms
7ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 00:01:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52921
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 10 Feb 2024 00:01:39 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/ Frame 04C0 8 KB
3 KB 12ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 02:59:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 42241
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 02:59:39 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/ Frame 04C0 23 KB
9 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240207/r20110914/abg_lite_fy2021.js

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 02:00:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45795
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 3610546441309021303
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 02:00:25 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 04C0 41 KB
14 KB 12ms
9ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:14:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 138580
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Feb 2025 00:14:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 04C0 3 KB
1 KB 15ms
12ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/window_focus_fy2021.js

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 08:31:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22302
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 08:31:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 04C0 20 KB
8 KB 14ms
11ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:44:35 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 04C0 205 KB
62 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84af93c376277b2fb1c7962b45ce84e1e0a31202815ceb873bd980df4378f62b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:19:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1463
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63267
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 15:19:17 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 04C0 42 B
63 B 41ms
40ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BHgmZnLbJ4ubSssLLRrX05fgjmRMVGJeLCmogaembTkrpNQhxiXIdCoVudtIEzASwxFrqOAtjOBpN3l1O3_sopMyEx7KEXu6GrT71MfQGEukxvjb0

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 73134fbfa16854d24caf7cd541ab86d9.js Show response
www.gstatic.com/mysidia/ Frame F51A 9 KB
4 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/73134fbfa16854d24caf7cd541ab86d9.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d99a3294b83fe3b21e9251c87e7696b7f5ba1651c5d82256db3c0700ead09b57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:12:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138678
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4097
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 06:36:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:12:22 GMT

GET
H3 200 42bbf393f5cdd3b75ade82a6a1ced124.js Show response
www.gstatic.com/mysidia/ Frame F51A 11 KB
5 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/42bbf393f5cdd3b75ade82a6a1ced124.js?tag=text/vanilla_highlight_ms_cta_adjustment

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c168339ab69ef010555b0678046a26f4b1657f6acd82c85d8ceaa709c1029c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 23:57:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 139567
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4932
x-xss-protection: 0
last-modified: Fri, 02 Feb 2024 16:54:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 07 May 2024 23:57:33 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame F51A 14 KB
1 KB 20ms
19ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 09 Feb 2024 14:43:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 13:40:10 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 09 Feb 2024 14:43:40 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame F51A 2 KB
822 B 18ms
17ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:44:35 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/ Frame F51A 23 KB
9 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 3610546441309021303
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:44:35 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame F51A 3 KB
1 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 08:31:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22302
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 08:31:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame F51A 20 KB
8 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:44:35 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame F51A 205 KB
62 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84af93c376277b2fb1c7962b45ce84e1e0a31202815ceb873bd980df4378f62b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:19:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1463
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63267
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 15:19:17 GMT

GET
H3 200 7b5e6815b417a6dcda76775ec840e2bc.js Show response
www.gstatic.com/mysidia/ Frame F51A 37 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7b5e6815b417a6dcda76775ec840e2bc.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87e0bffd01248ccc0369b210b2b2004ded168a8fc478f628faa17974b7f4d6da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138476
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15515
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 17:13:29 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:15:44 GMT

GET
H3 200 73134fbfa16854d24caf7cd541ab86d9.js Show response
www.gstatic.com/mysidia/ Frame 62D5 9 KB
4 KB 16ms
9ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/73134fbfa16854d24caf7cd541ab86d9.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d99a3294b83fe3b21e9251c87e7696b7f5ba1651c5d82256db3c0700ead09b57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:12:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138678
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4097
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 06:36:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:12:22 GMT

GET
H3 200 ac136ed324580ad6e6deeb53c043a6b5.js Show response
www.gstatic.com/mysidia/ Frame 62D5 119 KB
42 KB 25ms
17ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ac136ed324580ad6e6deeb53c043a6b5.js?tag=leadgen/frosmoth_image

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ee2a70b558f1cfd7db10d3b123803b99bc78bf454b87c4279917b1eda7d5741

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:14:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138564
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42771
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 17:13:29 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:14:16 GMT

GET
H3 200 16e444e2b68a962fd12469da7e7aa2e7.js Show response
www.gstatic.com/mysidia/ Frame 62D5 20 KB
8 KB 17ms
10ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/16e444e2b68a962fd12469da7e7aa2e7.js?tag=pingback

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c911fb5edd938f26a0d332996f4cd0f8f4db3cb45fc6197a832fd2b57ec42d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:16:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138455
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8308
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 17:13:29 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:05 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 62D5 21 KB
2 KB 30ms
24ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%20Sans%3A400%2C600%7CRoboto%3A400%7CGoogle%20Sans%3A400

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f7eba79c45bf07e6252e4937219790ee79a594bffe54cf93764266a5ea70f110

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 09 Feb 2024 14:43:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 12:48:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 09 Feb 2024 14:43:40 GMT

GET
H3 200 mdc_list_min.js Show response
pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/js/ Frame 62D5 27 KB
6 KB 25ms
19ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/js/mdc_list_min.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0a0610548e89956b26496552978f70638cbbba6f7d3fc204e137457a52d53f8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 19:07:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70546
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6467
x-xss-protection: 0
server: cafe
etag: 4758454654811317262
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 09 Feb 2024 19:07:54 GMT

GET
H3 200 mdc_menu_min.js Show response
pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/js/ Frame 62D5 51 KB
11 KB 39ms
33ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/js/mdc_menu_min.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd543b21d162ee922201fe54b79778548f8102ea91376960e856c069a135cb76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 23:43:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53996
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11146
x-xss-protection: 0
server: cafe
etag: 2759356358486721826
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 09 Feb 2024 23:43:44 GMT

GET
H3 200 mdc_menu_surface.min.js Show response
pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/js/ Frame 62D5 18 KB
5 KB 38ms
31ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/js/mdc_menu_surface.min.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35ef325738aec617e593976f23534b7d5b159f4642f24bc7c1bbbb40a7dc181f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 23:27:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 54960
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4739
x-xss-protection: 0
server: cafe
etag: 18373107336927916518
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 09 Feb 2024 23:27:40 GMT

GET
H3 200 mdc_select_min.js Show response
pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/js/ Frame 62D5 103 KB
18 KB 36ms
30ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/js/mdc_select_min.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f61ce0d0d062c15912a8fd7067d050eb058a4947d7d516ffa6efc31fd32ea731

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 18:54:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71352
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18791
x-xss-protection: 0
server: cafe
etag: 10996637669125113147
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 09 Feb 2024 18:54:28 GMT

GET
H3 200 mdc_textfield_min.js Show response
pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/js/ Frame 62D5 58 KB
10 KB 35ms
29ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/js/mdc_textfield_min.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bbd11d287d579b875f5ba1e88c62f56834dd8d925d7776fdc4eb201cf9aa5192

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 17:24:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10107
x-xss-protection: 0
server: cafe
etag: 7588401036457704084
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 09 Feb 2024 17:24:35 GMT

GET
H3 200 mdc_list_min.css
pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/css/ Frame 62D5 31 KB
3 KB 33ms
27ms Stylesheet
text/css 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/css/mdc_list_min.css

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

39473f41f6492001648e93d50aa18f14ae5e917cd9c93da48ec2dd50ca1f364b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 11:58:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9904
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3021
x-xss-protection: 0
server: cafe
etag: 18113988596513574663
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sat, 10 Feb 2024 11:58:36 GMT

GET
H3 200 mdc_menu_min.css
pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/css/ Frame 62D5 3 KB
793 B 32ms
26ms Stylesheet
text/css 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/css/mdc_menu_min.css

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3c4a4057f02182efe3e8959561124f215a4a8e50e03257b71d550cbf74ecc4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 09:13:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19784
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 766
x-xss-protection: 0
server: cafe
etag: 14497039402300002370
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sat, 10 Feb 2024 09:13:56 GMT

GET
H3 200 mdc_menu_surface_min.css
pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/css/ Frame 62D5 2 KB
637 B 31ms
25ms Stylesheet
text/css 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/css/mdc_menu_surface_min.css

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

389090922185d81fe757eb0e033fccb17583e98a7dc5b9900a1dbd7bb49aafa5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 02:39:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 43460
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 611
x-xss-protection: 0
server: cafe
etag: 18268606943400439583
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sat, 10 Feb 2024 02:39:20 GMT

GET
H3 200 mdc_select_min.css
pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/css/ Frame 62D5 37 KB
4 KB 30ms
25ms Stylesheet
text/css 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/css/mdc_select_min.css

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5737b0c371611ffbda25040aefb4a72202b3f4f4223da5802f9841823f125ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 17:08:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77681
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3940
x-xss-protection: 0
server: cafe
etag: 17986137158686949241
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 09 Feb 2024 17:08:59 GMT

GET
H3 200 mdc_textfield_min.css
pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/css/ Frame 62D5 51 KB
5 KB 36ms
30ms Stylesheet
text/css 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gadgets/mysidia/static/css/mdc_textfield_min.css

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5fb44f5faa5569cf002f97433c48ff5f53a0c6a181d3f67858c93a8379dbde0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:39:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65021
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4595
x-xss-protection: 0
server: cafe
etag: 17552977722549843295
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 09 Feb 2024 20:39:59 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 62D5 2 KB
822 B 16ms
11ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:44:35 GMT

GET
H3 200 2f792cc3c5c7726a78878a6415eda87d.js Show response
www.gstatic.com/mysidia/ Frame 62D5 23 KB
10 KB 27ms
22ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/2f792cc3c5c7726a78878a6415eda87d.js?tag=exit_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d618de8c2467801a06ec38c393fc4eb83d230190805ae8c4da5505104d232e37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:00:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 139365
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9733
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 17:13:29 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:00:55 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/ Frame 62D5 23 KB
9 KB 21ms
15ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 3610546441309021303
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:44:35 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 62D5 3 KB
1 KB 23ms
18ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 08:31:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22302
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 08:31:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/ Frame 62D5 20 KB
8 KB 20ms
14ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 01:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Feb 2024 01:44:35 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 62D5 205 KB
62 KB 25ms
20ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84af93c376277b2fb1c7962b45ce84e1e0a31202815ceb873bd980df4378f62b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:19:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1463
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63267
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 15:19:17 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame F662 38 KB
13 KB 8ms
7ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 138631
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 08 Feb 2024 00:13:09 GMT
expires: Fri, 07 Feb 2025 00:13:09 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 0B2A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6VmNOlF496RFNrZ7LBAww&google_cver=1

43 B
341 B

33ms
33ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6VmNOlF496RFNrZ7LBAww&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhi4-fODAjAB&v=APEucNUiCzduNvfkY4uBOayWnMSr2KzpTmDbWe7XDMuv3iiKdxYKWO08jhxNAm1n0PNAK_tE6iTk7VXyFdb-kalLI7SZwl8DWsAvMEtvudorv1OPwXTTc7Onp63F58COipp5FsOzQhL6_nLS5IPFUr7hbnCgmVkCD8aJMtqQ2TuPrOCnyQWQNL0
Protocol: H2
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:40 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XZs8w8fbEKmWGeZikO7GW1JeVjH1kbW6y0J6MU3LZ7nBgtuJxFYu%2FtL1tuX8ndHFBV%2FK99%2F%2B6X3RNb2%2FJUPMY4M20glIg8%2BnvmleT591NSDK9fArsl14J1cjVCcl3Cz2Absbf5NvYQI%2FVg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 852ce2d2cca82bba-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:40 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6VmNOlF496RFNrZ7LBAww&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 0B2A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZcY6HFVbLb4AACmNABzz0gAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6VmNOlF496RFNrZ7LBAww&google_cver=1

43 B
767 B

53ms
53ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6VmNOlF496RFNrZ7LBAww&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhi4-fODAjAB&v=APEucNUiCzduNvfkY4uBOayWnMSr2KzpTmDbWe7XDMuv3iiKdxYKWO08jhxNAm1n0PNAK_tE6iTk7VXyFdb-kalLI7SZwl8DWsAvMEtvudorv1OPwXTTc7Onp63F58COipp5FsOzQhL6_nLS5IPFUr7hbnCgmVkCD8aJMtqQ2TuPrOCnyQWQNL0
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:40 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ch3QGJipI%2F6C7k6lIx9yZ3J2FhLS9IInj1aWkba2cKYmJnquU47udEI8N0O4etq5Er2Ouq6ZJgXuzo6ek3tjef%2FcdsqV2VLkLx9mOw9lOkONrS9hQHAt4TwB9YoBURwMACwAAXelVgTPRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 852ce2d32ab2194b-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:40 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM6VmNOlF496RFNrZ7LBAww&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame 0B2A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESECs1ynfH1Z3C2E-HWq8vBio&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECs1ynfH1Z3C2E-HWq8vBio%26google_cver%3D1

43 B
1 KB

15ms
15ms

Image
image/gif

185.89.210.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECs1ynfH1Z3C2E-HWq8vBio%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhi4-fODAjAB&v=APEucNUiCzduNvfkY4uBOayWnMSr2KzpTmDbWe7XDMuv3iiKdxYKWO08jhxNAm1n0PNAK_tE6iTk7VXyFdb-kalLI7SZwl8DWsAvMEtvudorv1OPwXTTc7Onp63F58COipp5FsOzQhL6_nLS5IPFUr7hbnCgmVkCD8aJMtqQ2TuPrOCnyQWQNL0

Protocol

Server

185.89.210.244 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:40 GMT
an-x-request-uuid: 0386647e-eafc-4c27-bed3-4e0e084d64a7
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 37.58.57.5; 37.58.57.5; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:40 GMT
an-x-request-uuid: 980c5ab8-63f2-4a03-a9c2-883fd4af5931
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECs1ynfH1Z3C2E-HWq8vBio%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 37.58.57.5; 37.58.57.5; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 0B2A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjI1ODMzNTMyNzMyOTY3MTg5Mw%3D%3D

170 B
243 B

20ms
20ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjI1ODMzNTMyNzMyOTY3MTg5Mw%3D%3D

Requested by

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:40 GMT
an-x-request-uuid: d6fee70d-9014-4e59-a6af-55de67cfef4b
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjI1ODMzNTMyNzMyOTY3MTg5Mw%3D%3D
x-proxy-origin: 37.58.57.5; 37.58.57.5; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/9119114932533656539/ Frame 5FE7 6 KB
6 KB 10ms
10ms Image
image/jpeg 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9119114932533656539/14763004658117789537?w=400&h=209&tw=1&q=75

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20abf7d9d3cb472d6d8ea93e3924b1b56f06ce4032df599e8e0cead941b637b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Wed, 05 Feb 2025 22:06:41 GMT
date: Tue, 06 Feb 2024 22:06:41 GMT
x-content-type-options: nosniff
age: 232619
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6618
x-xss-protection: 0
last-modified: Sat, 18 Nov 2023 15:29:27 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
DATA 200
OK truncated
/ Frame 5FE7 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 5FE7 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 843245d38197c1ae733406b6faeda0f9b53376d8853df5d513a880489c822166

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 5FE7 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ba08da3935b66125c18c610945909586180ac97657c4008fae2411ecfb856d5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 5FE7 33 KB
33 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 00:19:40 GMT
x-content-type-options: nosniff
age: 311040
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Feb 2025 00:19:40 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/2914349705548515401/ Frame F51A 3 KB
3 KB 9ms
9ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2914349705548515401/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37d5b07c436cfe35ab0ea2083b687e03cf6df5f288863c988f997e258b2a9751

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Fri, 07 Feb 2025 00:10:44 GMT
date: Thu, 08 Feb 2024 00:10:44 GMT
x-content-type-options: nosniff
age: 138776
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2705
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 15:45:05 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2810 143 B
166 B 10ms
10ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 318
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 14:38:22 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 65B1 42 B
64 B 41ms
41ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsunIrA8Kf_vr5tk4RPZULrDphm2V5UIl1hxUB5trPdPb-6vkqRpv1h7ohJeiYl-0p6AGuwdHFdf10GodpWn_xOuUXVAcrelUza791Yl4oaz9ywsMeoPyfmOVvVaA8mQnvfUm7pm42HGQxr-Y97shn5E-8m5HvhTUM-paQ&sai=AMfl-YSFQ6I-qVja01NuYRmhoN1Aw1d5JfSyoEUfWFgICLJYSRN0e92_j-sBFv8quImsQsVAgaaTiJ2ic7rC-j8gmgmKHV_G430xJ3OuCwjuIxxnI3irH62kkZbQW5769RSWXyOdam2FmjqD2KjierHB&sig=Cg0ArKJSzGet7d2VNTTsEAE&cid=CAQSTgAvHhf_2f0VFh0_XOa60iLwkKIqjxVS0BxfePl1gDXUz0S1eHX8FVRrj0xaKD9x1oFoOOoUISDSWK8mIMNq-2dLQ5utR-wVnkYxLQ0DnBgB&id=lidar2&mcvt=1027&p=0,0,181,702&mtos=1027,1027,1027,1027,1027&tos=1027,0,0,0,0&v=20240201&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=2616852592&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=342261900&rst=1707489818458&rpt=1096&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 1609 50 KB
19 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee8114911fb4532f4521a86c72653b2eaee580ffd8bec3445699bf569323f1b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:16:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 138411
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19829
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 00:16:49 GMT

GET
DATA 200
OK truncated
/ Frame F51A 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 686d67794829f3a5d54d1da08f21396beb53d6e2ab5956a14c003fc5dd613388

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 5FE7
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C2B2YGjrGZY-kIbzsn88PjJiv4AGb9MridejYs8bIEr_hHhABIOOZhxxglYKAgJQHoAHd8KrAKsgBCagDAcgDy4SAgASqBMkBT9Bi2S5gdeBZC6F4QdmXeKTZyOnrSYulHJmRKzbEI04XQlD...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2211189878034008156955%22,%22debug_reporting%22:true,%22destination%22:%22https://pdfixers.com%22,%22event_report_window%22:...

0
0

39ms
39ms

Fetch
text/css

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2211189878034008156955%22,%22debug_reporting%22:true,%22destination%22:%22https://pdfixers.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211409209437%22],%2222%22:[%22true%22],%224%22:[%2202-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2217278254528365340977%22}&andc=true

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:40 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"11189878034008156955","debug_reporting":true,"destination":"https://pdfixers.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11409209437"],"22":["true"],"4":["02-09"],"6":["true"]},"priority":"500","source_event_id":"17278254528365340977"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 09 Feb 2024 14:43:40 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 09 Feb 2024 14:43:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"11189878034008156955","debug_reporting":true,"destination":"https://pdfixers.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11409209437"],"22":["true"],"4":["02-09"],"6":["true"]},"priority":"500","source_event_id":"17278254528365340977"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/ Frame 8D7E 8 KB
2 KB 50ms
12ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aed90a46adc3cff31de271491bbf63d2699dfcbf0636d6df3961fbd1e98b9923

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 138599
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2387
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 08 Feb 2024 00:13:41 GMT
expires: Fri, 07 Feb 2025 00:13:41 GMT
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 04C0 0
0 120ms
61ms Fetch
image/gif 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvvYLreeqhAHFq2ACcAxD4jQNjUWMLRrpyGq8zwSv3tM8Y2CE9po-vw1SWzMrFLsRIIabDGbQGT87gIK7qSLAsMPT1UCy2Nl2gv5M32h-K10xyjIJd4Io_RhhyLDB2h1b6l7YnwVXLoAWI_zlTaOtaKygITidW-USYm41FcVvutm0BcdiN4BtDpyra95KHorXnb5tglZ_rmiA8TwYgPnxeUAUkzSKX6-HREdHXFzNC2Fdp_pHn_5ViUR3ySLDF6O2P1o5L9feo5OWPN6xRlDuFkStWHHrXlddJkSRWUhvIXwukoP7x5t5mHtkYihNQEZqw7IJj6Q_JiRpm9tclGXYqzEV7_Fk9bselrPmAuNx7i932REBRML3tehd3o2wtl2JgephSyKWFd7Pi3Dhj0gafU8XIFUqubyrV3UVY68mS6sgGUgrp8Bc8tliowvRqY_Z5f_5Eb0wt4tSJ7al9RrpaWw57SsxCZlbI5jiMO3-ravqw9CPPQiwWMblwnKAP-Fq8X_q2HOuGkV9iYfHcbcscPaEeVzggD18Mm0Jt8Ga5uAOZONaAlyW1C3uJWmF-ZaJIBZgS0w4SOV9RbUYdentw4JC1gJMbsfYEMuwZ7vqh94p_D3irW2ktp2W14MVTBOBIlfg9zeqzcbb_hChQjNEldyG1B6o7U2DRU4MVKMhWxpV0hnpEev4Fu6AEmNUF-Fc0vgfl069CE6IcpdKd7sI4xMeV9CXW7RI8H280SVyOMWIRQGp5IQ5ISsH03WOkhN9Vq8ZkzbeSH-wvdfv00Z9fzTnphtSm4Mb9ZYDJ4nijlRMKoAZ_oblM-37S2lN92wfh04DOjcj4Uw3sh4OSg7becL6eaq4ZAwg_vFAWqj5X7-FjR-9KleJ3fpbi-Cb2LpSB5R4FZS3F0GbmtJYL3x5GZrLvRl-6B0Ylb-BM00CgrEqw9wUFJTh1TqFQGEGtz-LpLMUAdUfX5UsYJW9vQnyZnPgsDTg-v06WvBVc7ixTkQptUID_aVq3R7kvgpQzm2X9YvGCH5cjQcKYf4mvGo_tewjcYPlEDOW7EbO6Ar4HQVogx-ny-pS3DGqsdKXuB1lP2qmXpogS5VtwKoHFYHZt96Ntfw_bHsRUXpw1PImkFkq8tcZj_bMdGD6bt3HMqqnvlBpVUFpFNR9BOlebjoPbdGeSyGvr2E-2YPDydgDQcNXlbCQ16lMkgjgwLVTsx7RXmHq4nJh4AmUl-nOldLX-ZkBGblCoYIAJKIIXlbUp47ds2UIdkHpTcZVVxl2kbJKLoFhHg8wuXSbEx4bBAsmclnInWPO_piJ5Itcl2aPj8UTQKcf7UkOvWjNwbsrdbqD2qei4uvw&sai=AMfl-YR67PmDvDCQmr1Xgl5qm7nJ4DjAcGecD4NCS2jmCtT7_reXJlMhJR4e4JAdZOWUOnxt-fhBQjIfOWgLsXGL8_0ssZmfQ0r8D7AofMafvxAOBm77DE3_YSRh9UtTzB-WuOCZZXLQskLVxQhV-vJuJ0hl0ZZzG7IPeayaPkHB42LkSrSfu3shzF2Zh9sreJ_OHosKdP0NiiImPosNi0tcWmd8lTWe3A6L3wHeXSTq58Oj_lA8IDtzn93ON6w1Qr6Q26HK4_APfkQVH9er0KuaaLORdnZSGj0LHs2-wMJMC4IzbvTWJTinNWsuoQN7ZKNTxo7E6LLpCCNuPHq0yQ3exWmP6JwYxTqXFD7HXH8eV1R47CSlifTjeEGe_bIeK4MeH1Ox0pAaiK-SOvztz3-Amt2c5v2p4D_EF8n9aGO--vHMnXf2PQlMK5_KWAGt6hi9UpW8TgvZv-yvaYBrhdvoIxrCA3V4SX-lWaKyCPPy25tKkpG0vyvutSXHC8kWL2A6uZEGxQ&sig=Cg0ArKJSzAjIq-YZAMY3EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9oeXVuZGFpLmNvbQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=202&cbvp=1&cstd=197&cisv=r20240207.88966&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 09 Feb 2024 14:43:40 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 09 Feb 2024 14:43:40 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 62D5 0
20 B 39ms
39ms Ping
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=ChQIByoQd2ViX2ludGVyc3RpdGlhbAoHCAgqA2x0cgoNCAEqCWxhbmRzY2FwZQoKCAIqBnNlcnZlcgouGiFkaXNwbGF5X2xlYWRfZm9ybV9xdWVzdGlvbl9udW1iZXIhAAAAAAAAHEAwAQoNECshAAAAAAAALEAwARIaQ0kyWjNxQ19ub1FERlR6MjV3TWRETXdMSEEiFmxlYWRnZW4vZnJvc21vdGhfaW1hZ2UoLA==

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/16e444e2b68a962fd12469da7e7aa2e7.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js Show response
pagead2.googlesyndication.com/bg/ Frame F662 50 KB
19 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee8114911fb4532f4521a86c72653b2eaee580ffd8bec3445699bf569323f1b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:16:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 138411
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19829
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 00:16:49 GMT

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame F51A 33 KB
33 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 00:19:40 GMT
x-content-type-options: nosniff
age: 311040
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Feb 2025 00:19:40 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 39ms
38ms Preflight
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 09 Feb 2024 14:43:40 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js Show response
pagead2.googlesyndication.com/bg/ Frame C88C 50 KB
19 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee8114911fb4532f4521a86c72653b2eaee580ffd8bec3445699bf569323f1b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:16:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 138411
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19829
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 00:16:49 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2810
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

17ms
17ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 14:43:40 GMT
expires: Fri, 09 Feb 2024 14:43:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Feb 2024 14:43:40 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 8D7E 60 KB
24 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 09 Feb 2024 14:43:40 GMT

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/js/ Frame 8D7E 3 KB
870 B 8ms
8ms Script
application/x-javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/js/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a27d37f1f0d6284d6890af8cfd087b1c889d6feaf2e7343261377f3fd0222749

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Fri, 07 Feb 2025 00:16:52 GMT
date: Thu, 08 Feb 2024 00:16:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138408
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 840
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame F51A
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CLUmkGjrGZZGkIbzsn88PjJiv4AGb9MridZjTs8bIEmQQASDjmYccYJWCgICUB6AB3fCqwCrIAQGoAwHIA8uEgIAEqgTKAU_QLcO4YiiGno0oo68rS38vLEVqt247zoDAazevo4f9NODnz0a...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228621838118255296098%22,%22debug_reporting%22:true,%22destination%22:%22https://pdfixers.com%22,%22event_report_window%22:%...

0
0

39ms
39ms

Fetch
text/css

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228621838118255296098%22,%22debug_reporting%22:true,%22destination%22:%22https://pdfixers.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211409209437%22],%2222%22:[%22true%22],%224%22:[%2202-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%223764426634068378881%22}&andc=true

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:40 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"8621838118255296098","debug_reporting":true,"destination":"https://pdfixers.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11409209437"],"22":["true"],"4":["02-09"],"6":["true"]},"priority":"500","source_event_id":"3764426634068378881"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 09 Feb 2024 14:43:40 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 09 Feb 2024 14:43:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"8621838118255296098","debug_reporting":true,"destination":"https://pdfixers.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11409209437"],"22":["true"],"4":["02-09"],"6":["true"]},"priority":"500","source_event_id":"3764426634068378881"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 6078 50 KB
19 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/7oEUkR-0Uy9FIahscmU7Lq7lgP_YvsNEVpm_VpMj8bQ.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee8114911fb4532f4521a86c72653b2eaee580ffd8bec3445699bf569323f1b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:16:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 138411
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19829
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 00:16:49 GMT

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 04C0 0
0 54ms
53ms Fetch
image/gif 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvvYLreeqhAHFq2ACcAxD4jQNjUWMLRrpyGq8zwSv3tM8Y2CE9po-vw1SWzMrFLsRIIabDGbQGT87gIK7qSLAsMPT1UCy2Nl2gv5M32h-K10xyjIJd4Io_RhhyLDB2h1b6l7YnwVXLoAWI_zlTaOtaKygITidW-USYm41FcVvutm0BcdiN4BtDpyra95KHorXnb5tglZ_rmiA8TwYgPnxeUAUkzSKX6-HREdHXFzNC2Fdp_pHn_5ViUR3ySLDF6O2P1o5L9feo5OWPN6xRlDuFkStWHHrXlddJkSRWUhvIXwukoP7x5t5mHtkYihNQEZqw7IJj6Q_JiRpm9tclGXYqzEV7_Fk9bselrPmAuNx7i932REBRML3tehd3o2wtl2JgephSyKWFd7Pi3Dhj0gafU8XIFUqubyrV3UVY68mS6sgGUgrp8Bc8tliowvRqY_Z5f_5Eb0wt4tSJ7al9RrpaWw57SsxCZlbI5jiMO3-ravqw9CPPQiwWMblwnKAP-Fq8X_q2HOuGkV9iYfHcbcscPaEeVzggD18Mm0Jt8Ga5uAOZONaAlyW1C3uJWmF-ZaJIBZgS0w4SOV9RbUYdentw4JC1gJMbsfYEMuwZ7vqh94p_D3irW2ktp2W14MVTBOBIlfg9zeqzcbb_hChQjNEldyG1B6o7U2DRU4MVKMhWxpV0hnpEev4Fu6AEmNUF-Fc0vgfl069CE6IcpdKd7sI4xMeV9CXW7RI8H280SVyOMWIRQGp5IQ5ISsH03WOkhN9Vq8ZkzbeSH-wvdfv00Z9fzTnphtSm4Mb9ZYDJ4nijlRMKoAZ_oblM-37S2lN92wfh04DOjcj4Uw3sh4OSg7becL6eaq4ZAwg_vFAWqj5X7-FjR-9KleJ3fpbi-Cb2LpSB5R4FZS3F0GbmtJYL3x5GZrLvRl-6B0Ylb-BM00CgrEqw9wUFJTh1TqFQGEGtz-LpLMUAdUfX5UsYJW9vQnyZnPgsDTg-v06WvBVc7ixTkQptUID_aVq3R7kvgpQzm2X9YvGCH5cjQcKYf4mvGo_tewjcYPlEDOW7EbO6Ar4HQVogx-ny-pS3DGqsdKXuB1lP2qmXpogS5VtwKoHFYHZt96Ntfw_bHsRUXpw1PImkFkq8tcZj_bMdGD6bt3HMqqnvlBpVUFpFNR9BOlebjoPbdGeSyGvr2E-2YPDydgDQcNXlbCQ16lMkgjgwLVTsx7RXmHq4nJh4AmUl-nOldLX-ZkBGblCoYIAJKIIXlbUp47ds2UIdkHpTcZVVxl2kbJKLoFhHg8wuXSbEx4bBAsmclnInWPO_piJ5Itcl2aPj8UTQKcf7UkOvWjNwbsrdbqD2qei4uvw&sai=AMfl-YR67PmDvDCQmr1Xgl5qm7nJ4DjAcGecD4NCS2jmCtT7_reXJlMhJR4e4JAdZOWUOnxt-fhBQjIfOWgLsXGL8_0ssZmfQ0r8D7AofMafvxAOBm77DE3_YSRh9UtTzB-WuOCZZXLQskLVxQhV-vJuJ0hl0ZZzG7IPeayaPkHB42LkSrSfu3shzF2Zh9sreJ_OHosKdP0NiiImPosNi0tcWmd8lTWe3A6L3wHeXSTq58Oj_lA8IDtzn93ON6w1Qr6Q26HK4_APfkQVH9er0KuaaLORdnZSGj0LHs2-wMJMC4IzbvTWJTinNWsuoQN7ZKNTxo7E6LLpCCNuPHq0yQ3exWmP6JwYxTqXFD7HXH8eV1R47CSlifTjeEGe_bIeK4MeH1Ox0pAaiK-SOvztz3-Amt2c5v2p4D_EF8n9aGO--vHMnXf2PQlMK5_KWAGt6hi9UpW8TgvZv-yvaYBrhdvoIxrCA3V4SX-lWaKyCPPy25tKkpG0vyvutSXHC8kWL2A6uZEGxQ&sig=Cg0ArKJSzAjIq-YZAMY3EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9oeXVuZGFpLmNvbQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=342&vt=11&dtpt=140&dett=3&cstd=197&cisv=r20240207.88966&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: heromc.net
URL: https://heromc.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Fri, 09 Feb 2024 14:43:40 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 09 Feb 2024 14:43:40 GMT

GET
DATA 200
OK truncated
/ Frame 04C0 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fd8aafed47c657bc5e5c8aa44b91930ce415e3f6d31cf7eadf46ac7b57bb8b7f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 txt1.png
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/ Frame 8D7E 5 KB
5 KB 9ms
9ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/txt1.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68f87ec1f220257f68ef9393587604257eb6a3e74d220ca3add65802dfecc1e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Thu, 06 Feb 2025 23:55:16 GMT
date: Wed, 07 Feb 2024 23:55:16 GMT
x-content-type-options: nosniff
age: 139704
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4900
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/ Frame 8D7E 2 KB
1 KB 10ms
10ms Image
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/logo.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c863035b785839ac8c4c95868d0be68f60e17d897a2ed5c1f32ec96acd15c973

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Fri, 07 Feb 2025 00:09:01 GMT
date: Thu, 08 Feb 2024 00:09:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138879
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1004
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 bg1.jpg
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/ Frame 8D7E 27 KB
27 KB 11ms
11ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/bg1.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e9afb2613b8702e3a80703270c7a84b77bc6117b00b9b9bcf2e0452af8edb74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Fri, 07 Feb 2025 00:05:15 GMT
date: Thu, 08 Feb 2024 00:05:15 GMT
x-content-type-options: nosniff
age: 139105
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27914
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

OPTIONS
H3 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 39ms
38ms Preflight
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 09 Feb 2024 14:43:40 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F662 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B-o-tGjrGZZCkIbzsn88PjJiv4AEAAAAAOAHgBAI&bg=!MTKlMn3NAAY9UbWqHVE7ADQBe5WfOMCUD8-2FsmG6NnnS3UxxxwWaKXkoI1TJvGV831ocbkZCuwzB2c-vy4EO7LTDFgEAgAAAItSAAAAAmgBB5kC_ZMyHovmdLbmB0Z9l3gWDH3QU3R8gQKpHN7gNFWSX6PKjanib-XeO5WtlKEAyiHWdTiZ1QYjctn6bxeKoBi3GzahvS2fo2O6pzTZg2XGK_JI_JEe9W3zSuqOxk5u9XKgst2TjTJ4lAP5UnyNSV8lT36GabHVA7Gy2F-fBjWdqHehPx9KSkYfWfR3IOIj2AksKgJmi4gSmTZUWsxVfbR40cH-4rA33ZN2RFK3OQzL50xGGu7duIDQc7Ue22ROFscgSfQ72ZabfithMr3Muh6nCSe17KbUAi3HL2y2PSzI0ZiERpLydP31RyxIPp_aKG60gVNByphpDY-fcVMlfqCrt9VP8nCVo4VKcg8IOp-eOSqBn6YpWEZtIQWJlPRp88C8U7QT0NPVaLqrriz-AQdO7VK05f_McnM3WwFyEtfqD60VPfghZ2PKTk8eL7UxBHwawSipUtuCFJtveuBVzM8CxCNTFmbrpDXC2URE_VEPOxSPjra77X4UgT4ib22L-bgOM2LV_-LkMoEdu8Bm2GakVkFd3zNuWEZmCpe7TSgxru997IsSXwt29USkW3OBxvV3F05C5-WQ4xJ79H0uZXGjI5YEegYpsES4XG4umLYymB_wzBQjIbWzMlL8tdrI6zpPpnHf7esFxdTYcxUcL3LF7l76mOg3DivudPCRKEDVRfWjsGAut4tkcPTXnuyE-AHGs2RV5YWnJP1aa9NmlgORi0qy2koknnzf9EuCrDluzo6FKiry4sqISzHfUkGx14ZNL45F6iWuJpyiU4NXZpARHru9IsxEHSQFby5x8B_LTIdPQWP31FUEVnE2pBEM6XJfKIWB4B1H6oVneTAIu6IDJjkIFNVjY03sR9PlmQuqUTRsXrBOnwXRbwiT4UTAsre8UO0ramTLPtzcpA1RgsPslxKf6NxZbgPoop1GdiDiHoxw1lgYmiY26PCBcrkmUEMmo7o49rxIUXwxynrPKRMC2K3CaonX_vC2TqQoaT0Bh4bwnN5Wqu9ZcrjQ-HtTSA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 5FE7 42 B
64 B 42ms
41ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuwgGpYaWpCHOCwwr1VKVbXTVh0ZOJsodRYxGVT-I8-3NETo5MC0Fbvl-46FppLza0r1PXZBZeFZfGcz2xQxxlCCxs7dZYZCULq8TRfnpAWJXNREYHMsi2kFdda8uIzBcp2HWcVdQO9ahH4JA3-iAX5X93ajufQsWU3fw&sai=AMfl-YRQ2_YexgMfCzsoHZa34bnZxcU620AANM-5nd6KHhKaImIfe-tmuDfiqCyDqnIRR8kpqZ5VEbBOLKwS7Ar3T9ZuaF5B3hGNZKMYpk3IEK0_w-F9LCt3PYROaTWMXTlxPF5Wp-LIdXzE3lsnbJqp&sig=Cg0ArKJSzJFup0JMFuMjEAE&cid=CAQSTgAvHhf_uT0XfFmUW9utaDYQKI6rPv-JBzTV_W2nVkwZMSVrGqrOP0fRVbinoUlnL1Xtgto0GjUMzoGDMRwsa2Fk-tXk2sAgud8EppkiwBgB&id=lidar2&mcvt=1031&p=0,0,600,200&mtos=1031,1031,1031,1031,1031&tos=1031,0,0,0,0&v=20240201&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271803&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=342262000&rst=1707489820406&rpt=157&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/ Frame 8D7E 2 KB
477 B 8ms
8ms Stylesheet
text/css 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aea2925ad3d263f324b8e36f8d23ba8d07f7f7059162cf3cebc9848ac1083cdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Fri, 07 Feb 2025 00:08:41 GMT
date: Thu, 08 Feb 2024 00:08:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138900
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 447
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F51A 42 B
64 B 41ms
41ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssZafiVpKvp2JeGB1DDqyWbc5bfibWPIHVZajKmKN-9H2RW7v8bsNwwoUcb58x3kGjTdvaVnOj4IboX77gBudyId6lddyHY5FjO--xwGqQKMs_xd6zkvtvJFmNu3TE-g-8X4D1MziMxe_Pr06xMXspMu26R6bBiaigxzg&sai=AMfl-YRzR-0ue9UP085VRv5P3LFg_uAsCUq5-_qtfYADM0k-LkcvR6VFo5wgoeVi28DovRWJLeFohEYlCQOTtQJkPhE2nKSfj6YLCBAB3VZLkqg3gjcxuBmrd1nIgL4LDOOk0-lqK9UJ_7OfIEejZdYb&sig=Cg0ArKJSzKxlo_xrWc_KEAE&cid=CAQSTgAvHhf_uT0XfFmUW9utaDYQKI6rPv-JBzTV_W2nVkwZMSVrGqrOP0fRVbinoUlnL1Xtgto0GjUMzoGDMRwsa2Fk-tXk2sAgud8EppkiwBgB&id=lidar2&mcvt=1026&p=0,0,124,1005&mtos=101,784,1026,1043,1043&tos=101,683,242,17,0&v=20240201&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=342262000&rst=1707489820409&rpt=379&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 txt2.png
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/ Frame 8D7E 3 KB
3 KB 8ms
7ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9cb258cf0318678b90b56edeba6fa1c2ffd491ca2249f80b3a11cab05f9d9748

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Sat, 08 Feb 2025 13:32:35 GMT
date: Fri, 09 Feb 2024 13:32:35 GMT
x-content-type-options: nosniff
age: 4266
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2684
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 txt3.png
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/ Frame 8D7E 3 KB
3 KB 13ms
11ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2da2b1adfb82875dcab63acff4ce7600ab45c05580acd71e279f47c9f63ef6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Fri, 07 Feb 2025 00:13:23 GMT
date: Thu, 08 Feb 2024 00:13:23 GMT
x-content-type-options: nosniff
age: 138618
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2661
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 txt4.png
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/ Frame 8D7E 4 KB
4 KB 21ms
20ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/txt4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

420177967a9f4da39b66e2ba0d38a4e0a33dd83eb848d687a5a20aa9b069d4cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Fri, 07 Feb 2025 00:10:52 GMT
date: Thu, 08 Feb 2024 00:10:52 GMT
x-content-type-options: nosniff
age: 138769
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4264
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/ Frame 8D7E 666 B
703 B 22ms
20ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

731b8bdf96b2a28549702c5c005f99c06a4cc64ce6ea22c806a1fcfbc9a59ed7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Thu, 06 Feb 2025 23:57:52 GMT
date: Wed, 07 Feb 2024 23:57:52 GMT
x-content-type-options: nosniff
age: 139549
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 666
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 stoerer.png
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/ Frame 8D7E 1 KB
1 KB 20ms
19ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/stoerer.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3577ccd4a86dbfd2940a2e795628d453e5bfbc2763459caa04aed7b9718d3ff3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Fri, 07 Feb 2025 00:05:27 GMT
date: Thu, 08 Feb 2024 00:05:27 GMT
x-content-type-options: nosniff
age: 139094
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1273
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 disclaimer.png
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/ Frame 8D7E 2 KB
2 KB 19ms
18ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/disclaimer.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13552772e5cf0435b478a712927c1dc7fb3863a75dd9d842cbbb4122863ce9af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Sat, 08 Feb 2025 12:10:51 GMT
date: Fri, 09 Feb 2024 12:10:51 GMT
x-content-type-options: nosniff
age: 9170
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2184
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 logo2.svg
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/ Frame 8D7E 2 KB
1 KB 17ms
16ms Image
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/logo2.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

016da9c0ac71fa72d3f802a3309ccafa2733e0002355567982a31cbded742a2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Fri, 07 Feb 2025 00:09:02 GMT
date: Thu, 08 Feb 2024 00:09:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138879
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1005
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 bg2.jpg
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/ Frame 8D7E 26 KB
26 KB 14ms
14ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/bg2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef0a0649dfefa5f406c2697db61add23def697938c5459afb51ed011be085e18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Fri, 07 Feb 2025 00:01:55 GMT
date: Thu, 08 Feb 2024 00:01:55 GMT
x-content-type-options: nosniff
age: 139306
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27038
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 legals_1.png
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/ Frame 8D7E 16 KB
16 KB 13ms
12ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/legals_1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dfb99955be88976a4bacbe6a08a31eaf3dd238ee2fe0bc0e1b1f1a99325d7641

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Fri, 07 Feb 2025 00:13:43 GMT
date: Thu, 08 Feb 2024 00:13:43 GMT
x-content-type-options: nosniff
age: 138598
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16764
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 legals_2.png
s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/ Frame 8D7E 9 KB
9 KB 18ms
17ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/img/legals_2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

58dc48a3139c252ec2fe5518243e841fd1fcd12fd42ab543dd8851b5d61c0f18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4645906607200138106/10-IEU-SUV_Range_24_Q1-Skyscraper-160x600-TUCSON/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

expires: Sat, 08 Feb 2025 13:44:40 GMT
date: Fri, 09 Feb 2024 13:44:40 GMT
x-content-type-options: nosniff
age: 3541
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9112
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 12:07:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 04C0 42 B
64 B 43ms
42ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss2L4fI3x3CiJZ0JN4-qvGw5oOs2LoydckOHoJg21tnUIlssqOjzPALMJuLpLeOoWvrQJXXEYeFH73UKLzPwT-j0t28QamfTCQJGH2K5DJli5zwDlRKo0lpwjaEuACRLsd8nPTxGtGr9Z0eP-cT2y9PTe8U162YzbG9FA&sai=AMfl-YSIH4Fo2BGyNbkaVciGmdmiiFJB3zGFggbkYJb4FglGu5EdLGtj9WzdGSl_H8zz71bHoGP7XalK5TpKLYU-XeYQ0CUe_SsoHTJZTBPV9AvdM2faMQ42KFQdFyVTuZWNtVt3Rb0RrkcygBk_NYDH&sig=Cg0ArKJSzCiGJUQo6VI9EAE&cid=CAQSTgAvHhf_uT0XfFmUW9utaDYQKI6rPv-JBzTV_W2nVkwZMSVrGqrOP0fRVbinoUlnL1Xtgto0GjUMzoGDMRwsa2Fk-tXk2sAgud8EppkiwBgB&id=lidar2&mcvt=1025&p=0,0,600,160&mtos=1025,1025,1025,1025,1025&tos=1025,0,0,0,0&v=20240201&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=342262000&rst=1707489820452&rpt=315&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Feb 2024 14:43:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.facebook.com
URL: https://www.facebook.com/plugins/customer_chat/SDK/?app_id=737463590128289&attribution=setup_tool&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df840a37de4a7565fb%26domain%3Dheromc.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fheromc.net%252Ff3861c9b316657417%26relation%3Dparent.parent&current_url=https%3A%2F%2Fheromc.net%2F&event_name=chat_plugin_sdk_facade_create&is_loaded_by_facade=true&loading_time=0&locale=vi_VN&log_id=2759cf0e-3634-4340-9939-b2cea2bdb6ce&logged_in_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&logged_out_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&page_id=100438678093740&request_time=1707489818269&sdk=joey&should_use_new_domain=false&suppress_http_code=1

Domain: www.facebook.com
URL: https://www.facebook.com/plugins/customer_chat/SDK/?app_id=737463590128289&attribution=setup_tool&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df840a37de4a7565fb%26domain%3Dheromc.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fheromc.net%252Ff3861c9b316657417%26relation%3Dparent.parent&current_url=https%3A%2F%2Fheromc.net%2F&event_name=chat_plugin_sdk_facade_load&is_loaded_by_facade=true&loading_time=185&locale=vi_VN&log_id=2759cf0e-3634-4340-9939-b2cea2bdb6ce&logged_in_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&logged_out_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&page_id=100438678093740&request_time=1707489818454&sdk=joey&should_use_new_domain=false&suppress_http_code=1

Verdicts & Comments Add Verdict or Comment

69 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
id.heromc.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: n60l52i4b1k0ilvu8jd9t2o6h3
.onesignal.com/	1970-01-20 18:18:11	Name: __cf_bm Value: GYLv2QpauIa0ne9CDCNw3jYBXMJ0nDrO6mpcP5yCoNo-1707489815-1-AT68Lf08ksfpYPXy8JAw4taC49ZUbvDE+qKRfInKDjHcv8J2zKUJ27Vo+kRpcwa+ter4cZIchnh+deDc8S+tDlY=
.heromc.net/	1970-01-21 03:54:09	Name: _ga_J1B76F87B0 Value: GS1.1.1707489818.1.0.1707489818.60.0.0
.heromc.net/	1970-01-21 03:54:09	Name: _ga Value: GA1.1.794529133.1707489818
.heromc.net/	1970-01-21 03:03:45	Name: cf_clearance Value: 1c1RWEnNMI4fLgaBHNEkf3UK0MrowvS8w3hd1cVWPJ4-1707489818-1-AY3tYoTTF1jClfBwcl5i85YsUbWEuxcC1a8Ggn8U8SNVQvkOMaM4fNnB+EUPpBrNTWnEB/BwYwoCb42U3i6yCsQ=
.heromc.net/	1970-01-21 03:39:45	Name: __gads Value: ID=1ee865e55fdf5c00:T=1707489818:RT=1707489818:S=ALNI_MajFvBo1hlrs580hvyj91W_7Z4OHg
.heromc.net/	1970-01-21 03:39:45	Name: __gpi Value: UID=00000d544a2381ff:T=1707489818:RT=1707489818:S=ALNI_MbLvZlpeUJqesWrViI21IZ1p2sZ6g
.heromc.net/	1970-01-20 22:37:21	Name: __eoi Value: ID=4d17fbab62d4d1b9:T=1707489818:RT=1707489818:S=AA-AfjbjLcESiue9y5jbzIMum-E4
.doubleclick.net/	1970-01-20 18:18:13	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-21 03:39:45	Name: IDE Value: AHWqTUmkeuGmfwqqGxmZ_XTH9W7MmEIQ2Ai8nuKLRnsIyA9ofhuBhXLpuPhD8EvAreA
.googleadservices.com/	1970-01-20 20:27:45	Name: ar_debug Value: 1
.casalemedia.com/	1970-01-21 03:03:45	Name: CMID Value: ZcY6HFVbLb4AACmNABzz0gAA
.casalemedia.com/	1970-01-20 20:27:45	Name: CMPS Value: 3376
.casalemedia.com/	1970-01-20 20:27:45	Name: CMPRO Value: 3376
.adnxs.com/	1970-01-21 03:54:09	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-20 20:27:45	Name: XANDR_PANID Value: l37gXDubEH7Vqi77AXIieWvXiRuRKx3VST8tNGbxXAC2SKQnX4RsDctHrA3IzEnJf2BCI99YaPgnmNq-CTAoMDqYw-sYbpIng0EZ0Fl4raI.
.adnxs.com/	1970-01-20 20:27:45	Name: anj Value: dTM7k!M41.D>6NRF']wIg2GVJeTxz'!]tbPl1M>e)ZlrFUfJ+tGXxoa_!m6QV^TA=_-XVs^#-e4:DDic?09q4^2l(3If)y3KL9D3I?+Ncx6A
.adnxs.com/	1970-01-20 20:27:45	Name: uuid2 Value: 4767524519408890740
.doubleclick.net/	1970-01-20 22:37:21	Name: receive-cookie-deprecation Value: 1

84 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
javascript	error	URL: https://heromc.net/ Message: Access to XMLHttpRequest at 'https://www.facebook.com/plugins/customer_chat/SDK/?app_id=737463590128289&attribution=setup_tool&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df840a37de4a7565fb%26domain%3Dheromc.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fheromc.net%252Ff3861c9b316657417%26relation%3Dparent.parent&current_url=https%3A%2F%2Fheromc.net%2F&event_name=chat_plugin_sdk_facade_create&is_loaded_by_facade=true&loading_time=0&locale=vi_VN&log_id=2759cf0e-3634-4340-9939-b2cea2bdb6ce&logged_in_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&logged_out_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&page_id=100438678093740&request_time=1707489818269&sdk=joey&should_use_new_domain=false&suppress_http_code=1' from origin 'https://heromc.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.facebook.com/plugins/customer_chat/SDK/?app_id=737463590128289&attribution=setup_tool&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df840a37de4a7565fb%26domain%3Dheromc.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fheromc.net%252Ff3861c9b316657417%26relation%3Dparent.parent&current_url=https%3A%2F%2Fheromc.net%2F&event_name=chat_plugin_sdk_facade_create&is_loaded_by_facade=true&loading_time=0&locale=vi_VN&log_id=2759cf0e-3634-4340-9939-b2cea2bdb6ce&logged_in_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&logged_out_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&page_id=100438678093740&request_time=1707489818269&sdk=joey&should_use_new_domain=false&suppress_http_code=1 Message: Failed to load resource: net::ERR_FAILED
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'ambient-light-sensor'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'bluetooth'.
javascript	error	URL: https://heromc.net/ Message: Access to XMLHttpRequest at 'https://www.facebook.com/plugins/customer_chat/SDK/?app_id=737463590128289&attribution=setup_tool&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df840a37de4a7565fb%26domain%3Dheromc.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fheromc.net%252Ff3861c9b316657417%26relation%3Dparent.parent&current_url=https%3A%2F%2Fheromc.net%2F&event_name=chat_plugin_sdk_facade_load&is_loaded_by_facade=true&loading_time=185&locale=vi_VN&log_id=2759cf0e-3634-4340-9939-b2cea2bdb6ce&logged_in_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&logged_out_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&page_id=100438678093740&request_time=1707489818454&sdk=joey&should_use_new_domain=false&suppress_http_code=1' from origin 'https://heromc.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.facebook.com/plugins/customer_chat/SDK/?app_id=737463590128289&attribution=setup_tool&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df840a37de4a7565fb%26domain%3Dheromc.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fheromc.net%252Ff3861c9b316657417%26relation%3Dparent.parent&current_url=https%3A%2F%2Fheromc.net%2F&event_name=chat_plugin_sdk_facade_load&is_loaded_by_facade=true&loading_time=185&locale=vi_VN&log_id=2759cf0e-3634-4340-9939-b2cea2bdb6ce&logged_in_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&logged_out_greeting=Xin%20ch%C3%A0o%2C%20ch%C3%BAng%20t%C3%B4i%20c%C3%B3%20th%E1%BB%83%20gi%C3%BAp%20%C4%91%C6%B0%E1%BB%A3c%20g%C3%AC%20cho%20b%E1%BA%A1n%3F&page_id=100438678093740&request_time=1707489818454&sdk=joey&should_use_new_domain=false&suppress_http_code=1 Message: Failed to load resource: net::ERR_FAILED
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://heromc.net/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
ajax.googleapis.com
cdn.onesignal.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
code.jquery.com
connect.facebook.net
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
heromc.net
ib.adnxs.com
id.heromc.net
maxcdn.bootstrapcdn.com
mc-heads.net
onesignal.com
pagead2.googlesyndication.com
region1.analytics.google.com
s0.2mdn.net
scontent.xx.fbcdn.net
static.xx.fbcdn.net
stats.g.doubleclick.net
tpc.googlesyndication.com
www.facebook.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.facebook.com
103.142.218.245
142.250.185.70
142.250.186.130
172.217.18.2
172.64.151.101
185.89.210.244
2001:4860:4802:34::36
2606:4700:3030::6815:5794
2606:4700:3034::ac43:b1b3
2606:4700::6811:180e
2606:4700::6812:acf
2606:4700::6812:d73b
2a00:1450:4001:808::2006
2a00:1450:4001:80b::200a
2a00:1450:4001:810::2002
2a00:1450:4001:813::200a
2a00:1450:4001:828::2001
2a00:1450:4001:829::2002
2a00:1450:4001:829::2003
2a00:1450:4001:82a::2003
2a00:1450:4001:830::2003
2a00:1450:4001:830::2004
2a00:1450:4001:830::2008
2a00:1450:400c:c00::9a
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
2a04:4e42::649
016da9c0ac71fa72d3f802a3309ccafa2733e0002355567982a31cbded742a2f
02c3c64096cce72a3d6d94cef583f53809e493244f1a17803a7f91d8c274f9c3
0801f6ec47b1ab4ef329fe4fc69d014b3ee974869550e69db360f35e298bed8d
0827113fe05e7038ca36b1867e03ee83e968bd71e55390152106dcf53f86882f
083453bf4d12b9c46f44e3b434994e63ab8d8507300e67eaa25d9c7a9c0354bf
0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64
08bd680de7e840592d658e8cc895c55866866aa07b008963febad03e32d72599
0a0610548e89956b26496552978f70638cbbba6f7d3fc204e137457a52d53f8d
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0cd5f3c1dede77418576a916dada2b2cbd9999099c01dcbb4a1862426246d986
0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d
1002caaeb437132bc21a8d7b3f78898c85b4fbd4d798f409a9bab0b4db897c34
13552772e5cf0435b478a712927c1dc7fb3863a75dd9d842cbbb4122863ce9af
155e0678d16bd038d88f59397bdc4ac0ef2126ef2ba416841d1a1e5b091f4a66
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1984c4bb2ce10d00cb478c4ab216301e04502e25f2025b30dbeeb019172beb0d
1cd6396792d7bfdd898dcb9f2ee195387179b30fb4cc2cdc0c57575fab655230
20abf7d9d3cb472d6d8ea93e3924b1b56f06ce4032df599e8e0cead941b637b6
219b02d7360cfd9422919ca1500dd6b379ddf237de28e29b24f6513ff09feee4
23f1076ed4d8fc4dbf9f1d301953dae1d4fb8e051ce83a70cb8d46035a796ac6
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
27e5b4965c653999189b434b89a50cca4db1249ed4e872af8b6d52e2f1d9a93e
2910a75fe798cbb18961bf9510620ee4edbc664b99037f2a9b0b0af70a8d9631
2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2ba08da3935b66125c18c610945909586180ac97657c4008fae2411ecfb856d5
2c03a4346165dd4905961ed79c6441389d61862811ea39091b833ab97f0c7535
2d49cf88d7d6b90b8db4a89c42c8b3c3d6978b0f5fb7c76662bb8232317634a8
2f3c787c73f92b8da87e1ab86c9c7a937ecf32841d3d40678d79a7e1e35cfe44
309682f4811532cc3591fa0dbee23b8cbc5cc9d6155e4e0aa306f2c54d7c179c
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f
3577ccd4a86dbfd2940a2e795628d453e5bfbc2763459caa04aed7b9718d3ff3
35e5eea83f2e5f2bad1213aa4b4aef30a380720e35c1821f19bc894f8e61e406
35ef325738aec617e593976f23534b7d5b159f4642f24bc7c1bbbb40a7dc181f
37d5b07c436cfe35ab0ea2083b687e03cf6df5f288863c988f997e258b2a9751
389090922185d81fe757eb0e033fccb17583e98a7dc5b9900a1dbd7bb49aafa5
39473f41f6492001648e93d50aa18f14ae5e917cd9c93da48ec2dd50ca1f364b
3b185a9830d7d96a41b584c62bf222ad8d690662bf83ffd57eb758a4b268a1e3
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3e0b72b78bec4f1081b52f4730340a419a2231fc15fac8c8913e04e98b497f38
412799abf50c06820691d6af4da49c9189e9c4e9c2a4ddc77e750f643360aae1
4191d89ec03bce5dc273716075335e31851031184b0fff0ab9fc900a8442019f
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
420177967a9f4da39b66e2ba0d38a4e0a33dd83eb848d687a5a20aa9b069d4cd
433887067acdaaac4ae8e03d31282a32a1193658b7966ebad92748e5b80f6d6d
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e
45868cb1249416d0231c8b874f58a12f6f93b38a7b1986f0a56c53a46dc110d2
4631d527023234963558a2e314863def038bacab84626d0f7bb63aab6982597a
47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d
4894e5974a57f4338abd4311e8b170b25510b81decc2e71c2c3a5558fa4561c1
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4fc1a7b001c24a83334ea65a710c1e3922b14a14ff06bdd71919b4aae3c85c16
50733810a6ea64ddeef0bbfcc5635e6b6a367975dcb07ae60254fe06029f5e12
5141a8ba7925635dd9a8ca7f45008eb9c97346ad0a23861d0960aa5d8818d63b
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
58dc48a3139c252ec2fe5518243e841fd1fcd12fd42ab543dd8851b5d61c0f18
5a924472052d51b8dd1864b2acf707d7fb09580456e59dbe58818faf61efbbe8
5b9f58e1ce0e8c00ba91dbc86959c933e0be416b2941b5da01a885622440233c
5badd46fcef85df860351a6a95ce0228a16c3f78f0a48e398b439eb52e4c1832
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c942a6c7365efbc92f5477fa57bad66f2c324e242e2ba646bb3d527cfaa51d7
5e7facd46a313e6e0fbaa7474b8853d2b112642759c73aec4b176b20f20dd771
5e9afb2613b8702e3a80703270c7a84b77bc6117b00b9b9bcf2e0452af8edb74
5f119abf2c4c2158022eb6bfb873733ee03023f8ffcd4de8a04295655676e528
5fb44f5faa5569cf002f97433c48ff5f53a0c6a181d3f67858c93a8379dbde0d
5fbcf1b2f16a65a5e6787320aa4802664c5934374b0c4c09d82d1d9b9c5b7a44
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6311d55c34c7c52cbe18fbbf75f8f54a89cc407a5c1e189f894c6b9b83133c04
640ad21533a77d5363965122b215b73ecd3b5c3c56d7c211c110f3234c8bfdba
646a10a1c9bee960c646e77ab3a05131407eeab2514b284ddd0e151ae2bbf170
64cd96ff9eb0a950d6000c6b22490b168ab4d7a98eb754bfe79078b40c7bb8a3
65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
66291c6339214bc78d8ec44315894a8d146e1ab70c94862c904ad729170744fa
686d67794829f3a5d54d1da08f21396beb53d6e2ab5956a14c003fc5dd613388
68ccd4574efd9977168f45d2b4ffe3d750dd5d3123cf1759b5eb09ed8290749a
68f87ec1f220257f68ef9393587604257eb6a3e74d220ca3add65802dfecc1e9
6a30d9bdc734a648e828f2589034bc41499c2232bc8f4aaaaba172352328afc8
6a482d2d94c0d1bc6937a1759389d01b475e6b28a0d9b5d7eaa3f9cc8f59f3cd
6b0dab5300943d98f4f20de9d48a49e0186441f6fb8b5e95a9635a30c0b60e72
731b8bdf96b2a28549702c5c005f99c06a4cc64ce6ea22c806a1fcfbc9a59ed7
7699e04e30163c1f8eca8ed7974c1d49c02919ae6d01e889163215d50cfd31cc
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7e510e61c497d334da21eccda06df5d3a428c9ea94d6903b6138e7c7255aba0f
7ee2a70b558f1cfd7db10d3b123803b99bc78bf454b87c4279917b1eda7d5741
7f5939a71235a5ecc94eefbfc0c1268640f275ac73dae18819fb52674ad5e9fe
7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132
8189432d711c5dd842c5f878396d95d1fc45cee6fda836f3aa4a208143c0b96c
83db76383f24cb38e3dfd720ca1d2e3369d5bffb76f48945afbfcf8489e1b236
843245d38197c1ae733406b6faeda0f9b53376d8853df5d513a880489c822166
84af93c376277b2fb1c7962b45ce84e1e0a31202815ceb873bd980df4378f62b
87e0bffd01248ccc0369b210b2b2004ded168a8fc478f628faa17974b7f4d6da
889fec0ca126224e77a3d7597c7f8cba79c5dcb1c1e516a8d770555b9cec71c2
8d77e1f6c897cfb95b954e83020b7ec73f930b6819e06a9fcb81de2f5ed7f999
92adf2b1dfc402327ac6d6c6442a312cde9472707ed65f31ecaa1b5f9d9df87a
955a0b70354e7bbdc381d6bd4c96cfbdc3532aef979ce69c6d0b7c1dd17fd574
956fa56f513e1a8025bc85f9314a1747eb061d434403393591145e4ae898c694
96e3e8dfde6b1042514824bac1b44282d4a76bac028f2d767f6534dce2cf3db0
9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589
9c911fb5edd938f26a0d332996f4cd0f8f4db3cb45fc6197a832fd2b57ec42d6
9cb258cf0318678b90b56edeba6fa1c2ffd491ca2249f80b3a11cab05f9d9748
9e57fedb96b3686621bccd5521f43a2037a823c74f062176952890b179b3955b
9f48791ee0215f3b7f63318fa6ec17dc151f02a0797cbb831d8289995f322576
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a27d37f1f0d6284d6890af8cfd087b1c889d6feaf2e7343261377f3fd0222749
a2e9b322621f9bdb9042b8b3f884ae73bdf167afe2a8a9d0cf2fc88ee44c6719
a3c6ccd19e5c16faefbef429d042458b82c80af040f450b1ee208dba88d5b0df
a60d4f8cc0e1ec57d2574653a779b41406c419a8e1a0fc49d6d0a45f73491370
a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd
acdebf935ded5cb063dcca7c46be5bbc503af5e76e295f6d0b7093c4514ed256
adfa45260a1306cb5fefc1f17c1b5e7b61135534a82bf1b8e3d0540af7e07e3b
aea2925ad3d263f324b8e36f8d23ba8d07f7f7059162cf3cebc9848ac1083cdb
aec2dff0d104a2635c64ceff0891361fbe9ce047dca4b8e77b97f224e2e17420
aed90a46adc3cff31de271491bbf63d2699dfcbf0636d6df3961fbd1e98b9923
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2da2b1adfb82875dcab63acff4ce7600ab45c05580acd71e279f47c9f63ef6a
b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6
b4d0e26b6ecf4af2fab46cc147ffc30da39f350a8974ada7c8419b2ebe5d1962
b5737b0c371611ffbda25040aefb4a72202b3f4f4223da5802f9841823f125ec
b6f311082cddc0aac08827ff6c04fd13f597640635f83227faf99213b40bb1c7
b758b78b503482036d130f6f2efadca53a9d944661f1f6589515d50704c8e270
b79e2f319a4307b8efa970936f6bf86a8236c2de2cb980c5950ed65b48a28c18
bbd11d287d579b875f5ba1e88c62f56834dd8d925d7776fdc4eb201cf9aa5192
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
c168339ab69ef010555b0678046a26f4b1657f6acd82c85d8ceaa709c1029c2e
c6f8aad2c2e01e81032eb3ce744f73450e33b1718dd95ee9cb968e76b8512f59
c7a87da2e349a1220d8264616fc9d571288c01e28ee1cfe4ed4554e15c6c5e53
c863035b785839ac8c4c95868d0be68f60e17d897a2ed5c1f32ec96acd15c973
ca3584d93afd41ccd5b2bbc8162bfa18fff7838fb29ac6435c2ed72290e98905
cad1003180db5ef47e5ee3cfd628073e6411543ab77c34de59b19cecada87391
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d053beda954a4ecaef2c6aea4c68aa7a524d8c79056f68ec44c96636a1fe18f5
d50130d61c73351be05ac038a96bb295ac2a55dbf5bf49ef2382a5bd2f7aff33
d513719889530e68670b8b02f1b66ddd93d6a768c942bf7987d4004d185893a6
d618de8c2467801a06ec38c393fc4eb83d230190805ae8c4da5505104d232e37
d99a3294b83fe3b21e9251c87e7696b7f5ba1651c5d82256db3c0700ead09b57
df69087d551c81123be79901817746b3989b89049c4423f90972be0aea4c7d1f
dfb99955be88976a4bacbe6a08a31eaf3dd238ee2fe0bc0e1b1f1a99325d7641
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c4a4057f02182efe3e8959561124f215a4a8e50e03257b71d550cbf74ecc4f
e423d27a6a3f918e06baca1f811be31cd5a8c684c548d9b430fe20b683b1aeb7
e5c87467e95e7b28294c11944b7bf6680fbdc8e34c1205f2f9a298fa0a340e2b
e75709116f5ac6ef2240abfcdf4baec23290e385e3157804499d145ffb213fed
e8e576a8f256c2b656af1b055b329775a8cd7b4a9ac80ab18034006821cc76c7
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ebc61198f08befb8a7deb1d87cb6958723c1cef176db94b01b3d22e3a23225d9
ebe0f94ca53bc5f7d865f89aec5b0315bca03ace6942d6c1c76d94d5b59d419a
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
ee8114911fb4532f4521a86c72653b2eaee580ffd8bec3445699bf569323f1b4
eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c
ef0a0649dfefa5f406c2697db61add23def697938c5459afb51ed011be085e18
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2
f06fc176d714316c3773a8f99c1bd5b736a88f7b2afe45fac4d376150d30d0c6
f1475f02e12f6760867a0278efb22588e93ac3e903f51391c40e867722a02bd8
f15f2d36ea3ee2a257d53268887835c64928fc2cb02c334191b82141acd9773f
f40cec8ae340480f6945bc09b31d4dd293496d1b15ad990c06dcbb4c726e6935
f49422f7d897ed35d8b3b4f54c7cf5aa5ac3e9eb3306575ca0d67cdcecd1dc51
f5506eaabff3eeec0d33bc777d52ab390a6519ab4b57a5ba0da93f9519fba8b9
f61ce0d0d062c15912a8fd7067d050eb058a4947d7d516ffa6efc31fd32ea731
f7eba79c45bf07e6252e4937219790ee79a594bffe54cf93764266a5ea70f110
f82a032adfd1bcaee3925567c2beb50794f288fa5d463e0f408307bcae0ac9eb
fd543b21d162ee922201fe54b79778548f8102ea91376960e856c069a135cb76
fd675c0f06dfff9a382d9a2e971be6fe752f344b32dc793b9f8338259e254e34
fd8aafed47c657bc5e5c8aa44b91930ce415e3f6d31cf7eadf46ac7b57bb8b7f
feafea54bc9df8bf92b28e40deb5477785ed7a1099dbe88b97ec668faeff8a66

heromc.net Open in urlscan Pro 2606:4700:3034::ac43:b1b3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

222 Requests

95 %HTTPS

78 %IPv6

20 Domains

30 Subdomains

28 IPs

4 Countries

6114 kBTransfer

10769 kBSize

19 Cookies

8 Outgoing links

Page URL History

Redirected requests

222 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

heromc.net Open in urlscan Pro
2606:4700:3034::ac43:b1b3 Public Scan

Screenshot
Live screenshot

Full Image

222
Requests

95 %
HTTPS

78 %
IPv6

20
Domains

30
Subdomains

28
IPs

4
Countries

6114 kB
Transfer

10769 kB
Size

19
Cookies

222 HTTP transactions
6 data transactions