www.proxysite.com Open in urlscan Pro
35.171.101.160 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://eu3.proxysite.com/process.php?d=1Y4A6uetvfW0RpHT4HFrC7VgA9nQ85XPk6yPkP284h%2Bm4l3lL2F6OuY%3D
Effective URL:
https://www.proxysite.com/
Submission: On April 04 via manual (April 4th 2022, 11:22:44 am UTC) from FR — Scanned from FR

Summary HTTP 189 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 31 IPs in 4 countries across 28 domains to perform 189 HTTP transactions. The main IP is 35.171.101.160, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.proxysite.com. The Cisco Umbrella rank of the primary domain is 207157.
TLS certificate: Issued by Amazon on March 28th 2022. Valid for: a year.

This is the only time www.proxysite.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	178.33.33.138 178.33.33.138	16276 (OVH) (OVH)
1 18	35.171.101.160 35.171.101.160	14618 (AMAZON-AES) (AMAZON-AES)
20	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
4	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
4	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
16	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	104.244.42.200 104.244.42.200	13414 (TWITTER) (TWITTER)
1	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
25	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
1	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
38	2a00:1450:400... 2a00:1450:4001:82b::2006	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
3	185.29.134.249 185.29.134.249	30419 (MEDIAMATH...) (MEDIAMATH-INC)
1 3	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
1	88.99.165.19 88.99.165.19	24940 (HETZNER-AS) (HETZNER-AS)
1	23.35.228.210 23.35.228.210	16625 (AKAMAI-AS) (AKAMAI-AS)
1 4	178.63.52.121 178.63.52.121	24940 (HETZNER-AS) (HETZNER-AS)
1 2	2620:116:800d... 2620:116:800d:21:fcb8:22d2:d390:5f1b	16509 (AMAZON-02) (AMAZON-02)
2 2	69.192.160.219 69.192.160.219	16625 (AKAMAI-AS) (AKAMAI-AS)
9	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
2	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
3 3	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
2 7	95.131.136.1 95.131.136.1	47841 (OXALIDE) (OXALIDE)
2 2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	51.75.147.170 51.75.147.170	16276 (OVH) (OVH)
1 1	89.185.38.84 89.185.38.84	8426 (CLARANET-...) (CLARANET-AS ClaraNET LTD)
1	89.185.38.100 89.185.38.100	8426 (CLARANET-...) (CLARANET-AS ClaraNET LTD)
2	192.229.220.129 192.229.220.129	15133 (EDGECAST) (EDGECAST)
189	31

1 178.33.33.138 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: ip138.ip-178-33-33.eu

eu3.proxysite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 35.171.101.160 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-171-101-160.compute-1.amazonaws.com

www.proxysite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.200 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

38 2a00:1450:4001:82b::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.29.134.249 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)

tags.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.99.165.19 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.19.165.99.88.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.35.228.210 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-228-210.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 178.63.52.121 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.121.52.63.178.clients.your-server.de

hal900020.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:fcb8:22d2:d390:5f1b (United States) 1 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.192.160.219 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-160-219.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.190.78 (United Kingdom) 3 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.138 (Frankfurt am Main, Germany) 2 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 95.131.136.1 (France) 2 redirects

ASN47841 (OXALIDE, FR)
PTR: front.netaffiliation.net

action.metaffiliation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
lov.saveur-biere.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.75.147.170 (France)

ASN16276 (OVH, FR)
PTR: ns3133977.ip-51-75-147.eu

cdn.contentspread.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.185.38.84 (Paris, France) 1 redirects

ASN8426 (CLARANET-AS ClaraNET LTD, GB)

tracking.publicidees.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.185.38.100 (Paris, France)

ASN8426 (CLARANET-AS ClaraNET LTD, GB)

ad.publicidees.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.229.220.129 (United States)

ASN15133 (EDGECAST, US)

img.metaffiliation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
45	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 98 tpc.googlesyndication.com — Cisco Umbrella Rank: 125	477 KB
38	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 257	391 KB
25	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 43 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 274 cm.g.doubleclick.net — Cisco Umbrella Rank: 206	156 KB
19	proxysite.com 2 redirects eu3.proxysite.com www.proxysite.com — Cisco Umbrella Rank: 207157	167 KB
10	gstatic.com www.gstatic.com fonts.gstatic.com	135 KB
6	saveur-biere.com 2 redirects lov.saveur-biere.com — Cisco Umbrella Rank: 752626	134 KB
6	twitter.com platform.twitter.com — Cisco Umbrella Rank: 579 syndication.twitter.com — Cisco Umbrella Rank: 828	149 KB
5	redintelligence.net 1 redirects hal9000.redintelligence.net — Cisco Umbrella Rank: 31903 hal900020.redintelligence.net — Cisco Umbrella Rank: 230230	11 KB
5	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 169	181 KB
5	google.com 1 redirects adservice.google.com — Cisco Umbrella Rank: 76 www.google.com — Cisco Umbrella Rank: 7	1 KB
4	mathtag.com tags.mathtag.com — Cisco Umbrella Rank: 2574 pixel.mathtag.com — Cisco Umbrella Rank: 1197	3 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 45	4 KB
3	metaffiliation.com action.metaffiliation.com — Cisco Umbrella Rank: 66677 img.metaffiliation.com — Cisco Umbrella Rank: 57335	18 KB
3	pubmatic.com 3 redirects image6.pubmatic.com — Cisco Umbrella Rank: 610	1 KB
2	publicidees.com 1 redirects tracking.publicidees.com — Cisco Umbrella Rank: 171656 ad.publicidees.com — Cisco Umbrella Rank: 336841	5 KB
2	rlcdn.com 2 redirects id.rlcdn.com — Cisco Umbrella Rank: 599	885 B
2	rubiconproject.com 2 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 348	914 B
2	openx.net rtb.openx.net — Cisco Umbrella Rank: 1485	415 B
2	addthis.com 2 redirects e.dlx.addthis.com — Cisco Umbrella Rank: 1776	1 KB
2	quantserve.com 1 redirects cms.quantserve.com — Cisco Umbrella Rank: 1104	798 B
2	google.fr adservice.google.fr — Cisco Umbrella Rank: 28668	914 B
2	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 585	137 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 99	18 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 39	20 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 136	84 KB
1	contentspread.net cdn.contentspread.net — Cisco Umbrella Rank: 52453	5 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 782	646 B
0	gemius.pl Failed googlecm.hit.gemius.pl Failed
189	28

	Domain	Requested by
38	s0.2mdn.net	www.proxysite.com s0.2mdn.net googleads.g.doubleclick.net
25	tpc.googlesyndication.com	googleads.g.doubleclick.net www.proxysite.com tpc.googlesyndication.com pagead2.googlesyndication.com
20	pagead2.googlesyndication.com	www.proxysite.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.gstatic.com www.googletagservices.com
18	www.proxysite.com	1 redirects www.proxysite.com
15	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net www.proxysite.com www.googletagservices.com
9	cm.g.doubleclick.net	www.proxysite.com googleads.g.doubleclick.net
7	www.gstatic.com	googleads.g.doubleclick.net
6	lov.saveur-biere.com	2 redirects googleads.g.doubleclick.net hal900020.redintelligence.net lov.saveur-biere.com
5	www.googletagservices.com	googleads.g.doubleclick.net
4	hal900020.redintelligence.net	1 redirects googleads.g.doubleclick.net hal900020.redintelligence.net
4	fonts.googleapis.com	googleads.g.doubleclick.net hal900020.redintelligence.net
4	platform.twitter.com	www.proxysite.com platform.twitter.com
3	image6.pubmatic.com	3 redirects
3	www.google.com	1 redirects googleads.g.doubleclick.net tpc.googlesyndication.com
3	tags.mathtag.com	googleads.g.doubleclick.net tags.mathtag.com
3	fonts.gstatic.com	fonts.googleapis.com
2	img.metaffiliation.com	lov.saveur-biere.com
2	id.rlcdn.com	2 redirects
2	pixel.rubiconproject.com	2 redirects
2	rtb.openx.net	googleads.g.doubleclick.net
2	e.dlx.addthis.com	2 redirects
2	cms.quantserve.com	1 redirects googleads.g.doubleclick.net
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.fr	pagead2.googlesyndication.com
2	static.xx.fbcdn.net	www.facebook.com
2	syndication.twitter.com	platform.twitter.com www.proxysite.com
2	www.facebook.com	connect.facebook.net www.proxysite.com
2	www.google-analytics.com	www.proxysite.com www.google-analytics.com
2	connect.facebook.net	www.proxysite.com connect.facebook.net
1	ad.publicidees.com	hal900020.redintelligence.net
1	tracking.publicidees.com	1 redirects
1	cdn.contentspread.net	hal900020.redintelligence.net
1	action.metaffiliation.com	hal900020.redintelligence.net
1	pixel.mathtag.com	tags.mathtag.com
1	hal9000.redintelligence.net	www.proxysite.com
1	googleads4.g.doubleclick.net	www.proxysite.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	eu3.proxysite.com	1 redirects
0	googlecm.hit.gemius.pl Failed	googleads.g.doubleclick.net
189	39

This site contains links to these domains. Also see Links.

Domain
eu2.proxysite.com
pryvacy.com

Subject Issuer	Validity	Valid
proxysite.com Amazon	`2022-03-28` - `2023-04-26`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-20` - `2022-10-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-01-11` - `2022-04-11`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
syndication.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-31` - `2022-10-30`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
*.google.fr GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
*.mathtag.com DigiCert SHA2 Secure Server CA	`2020-04-15` - `2022-04-22`	2 years	crt.sh
www.google.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
redintelligence.net R3	`2022-03-29` - `2022-06-27`	3 months	crt.sh
pixel.mathtag.com DigiCert SHA2 Secure Server CA	`2021-06-29` - `2022-07-07`	a year	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.metaffiliation.com Gandi Standard SSL CA 2	`2022-03-07` - `2023-03-20`	a year	crt.sh
lov.saveur-biere.com Gandi Standard SSL CA 2	`2021-06-08` - `2022-06-23`	a year	crt.sh
contentspread.net R3	`2022-03-31` - `2022-06-29`	3 months	crt.sh
img.metaffiliation.com Gandi Standard SSL CA 2	`2021-12-13` - `2023-01-02`	a year	crt.sh

This page contains 26 frames:

Primary Page: https://www.proxysite.com/
Frame ID: A710D17F0C929AD63C9BE3AD74F103A3
Requests: 35 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20190131/zrt_lookup.html
Frame ID: 1E2C75714417C159C8677D05401F3022
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.0af76c3310098d2f8f428367b62351b8.html?origin=https%3A%2F%2Fwww.proxysite.com
Frame ID: 6D16DF6A4E56932F2342F29A5B908638
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/v2.5/plugins/like.php?action=like&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df271966be1871e4%26domain%3Dwww.proxysite.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.proxysite.com%252Ff1406687f447f88%26relation%3Dparent.parent&container_width=105&href=https%3A%2F%2Fwww.proxysite.com%2F&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&width=80
Frame ID: 040C443C3833E84A38F70848D0FA7B0D
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&slotname=2867599685&adk=3927345067&adf=3573213364&pi=t.ma~as.2867599685&w=990&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=3&psa=0&format=990x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358257&bpp=3&bdt=608&idt=152&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&correlator=4393995530453&frm=20&pv=2&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=305&ady=191&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=uNYkntvef7&p=https%3A//www.proxysite.com&dtd=168
Frame ID: DD08C7C14477572D4DCCB98BEFE38B73
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&slotname=4344332884&adk=523175106&adf=1005968846&pi=t.ma~as.4344332884&w=990&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&psa=0&format=990x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358260&bpp=1&bdt=610&idt=180&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&prev_fmts=990x280&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=305&ady=702&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=pwFPO3JFmN&p=https%3A//www.proxysite.com&dtd=183
Frame ID: FF5D010A17B5AE9AB0CB177B0DDB3DE0
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=90&slotname=6803856480&adk=197138127&adf=1497320946&pi=t.ma~as.6803856480&w=728&lmt=1649071358&rafmt=12&psa=0&format=728x90&url=https%3A%2F%2Fwww.proxysite.com%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358261&bpp=1&bdt=611&idt=193&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&prev_fmts=990x280%2C990x280&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=2948&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepEbr%7C&abl=CS&pfx=0&fu=256&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=BGZDK9fITB&p=https%3A//www.proxysite.com&dtd=197
Frame ID: 39BA49E71EC3C651D5F9351E91B339A7
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&adk=1812271804&adf=3025194257&lmt=1649071358&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.proxysite.com%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358262&bpp=1&bdt=612&idt=199&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&prev_fmts=990x280%2C990x280%2C728x90&nras=1&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=203
Frame ID: CAF98A609D7FD7255BE32266045E4C5E
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.0af76c3310098d2f8f428367b62351b8.en.html
Frame ID: C434C9830357A1B77D8E9612312AD81A
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&adk=3625593270&adf=3099719705&pi=t.aa~a.4226026281~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1207&idt=-M&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0&nras=2&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1451&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=jqiPJSBz6z&p=https%3A//www.proxysite.com&dtd=11
Frame ID: 7B330F48FBF51F12DEF616C47F2A18DE
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=90&adk=676745548&adf=3560341080&pi=t.aa~a.4080220755~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x90&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1208&idt=1&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0%2C1200x280&nras=3&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2190&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=UDbT4e1aML&p=https%3A//www.proxysite.com&dtd=15
Frame ID: F3D7E4D8EA4A22B6C0FC4147AB4D00C6
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1
Frame ID: AB00EB9A5B7782C14CF05D4CBA0843E3
Requests: 11 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/3b8ZtKHcFUSYKihZpywKVICyDtFsaoLwoCuDyEZifyk.js
Frame ID: 67C7E775C78F6E426F2E6D9A73DF653D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=C7qaS_tRKYpSKOIK6ygWKkJLoDs-HjptcwIbZgsYCwI23ARABIABg-wGCARdjYS1wdWItNTI3MTA1MjAzMzc3NjgxMcgBCagDAaoEugFP0LQFVRBnaubiTgoQvVAdr6QDwf6GYPwGQp09GMNBRkaxqQU22HX42R3FQ1gV1c8qbjUMn5PFXo1P9skgucveLY8yXlpEj0JSNQfH26hRc_uu5xYRiVOPYJ9zUUuVmBxpoDNR-DBunCscqw3Xvf683HhAJigiG5Vh2OL_e1aOCxszGFOBGb_gVDt7Rf20rKjVhXd1RxwpjTcQcBWWHyAibYkZjTBaMTKskIMVxAvmTgGQ768-G3K2E_-ABvfsraXW59OGXqAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBABgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTUyNzEwNTIwMzM3NzY4MTEYAA&sigh=Ddb15BnuNoo&uach_m=[UACH]&cid=CAQSPACNIrLMPYSqHptimBjQEt7aQPjxvviK1M9Anp3SFmpKRzMidEWwHCsuO3qEWxWnwYbXrhmZZik4dUrB5RgB&tpd=AGWhJmvwD0F8PAwHvKQmFA-gkeyoZZEsIwYOjczzBOzM1iud-PB_RSgckGNMn8dUcJp00bSWVsjf17vdwv6K5YMZR8PIpFKSmdo67DCK9GbNDY5WuvRLZnPxkcgGb2qDwWYJ4KXCJ2MNeMCe76T0J-vShHXZHJjc8Hlwi1SX9V-6Iq_DU4tAZuNJZQwWpwpCKZ7sKhZVyEAixW95_nTezBsj_fX4JK93JdPWsleBn_H706A6Bsml3O2kvvmi6OijUt193yZxHZmB8peKYFDQD6hmui-2vNjgYvEOZif4TwhjrxQ_oYFntvLFxvGzFpEW0E0RYYoZze9gaXza3_puovUnCsVGmJ4AHzVNMHKlVxi6fWBDrLdUl6QS50Ki2bHikf9vkU9f_1d9KA3qAio0YE3qFm5zMl0O0GoNNjveW_NxO4HbEE4fw2NQO7GOOw0JwVsYS8Ei7U6Ba7cL7QID2mFH-T6K0eGw2IJCpt0yrat-VShDYTWgWflK2kU2_Qt3v7X_gDnQQFMNUMjXBvu6njKDmfmRY6aCnrp6NWghxUAZqeaHSij4upbwXcykeB86640dk1_vGK3rO9poqzEJxC4ptnG_rgHtFCf0YJppYIqD4y0iXif8qpHAxZ2ZeLz0H6GfdMl8YuIhiQfOEBnoZkWBSH9VZAsgDBxYANAZxv8UmWys0UINfMKbvhwiL-IK6rH61mgnhN_Ce8T5wH3S_3CVg3AG7J9l-ig0Gw-Z4TMD34utmDgY9itHpPc58RGG8cQJ_WxLRU7wmFbUGamxORTG0wR8MCcExvNKPWf6v9EJ7qI9wxXLaLqXI1k7G3OaA2IK-bgg-H4P4NGHC5YF8gCB8Tw81MGti2MGNzYDNvgkXqU1sS_YOa_bwilH-l8rF8G7u7hJYopHViPEMPExevFksURU6NX1EhvMJ8NwS3kGeR19LJsSaZDKnCJ_sOhqzGgt3FCYrychArVhIrtNSGAeqLDrWxcpSGIk-ebtuiEjxRh2ZIM_vGjvMhqTzHHn0QTLuYlilWMNkuCZm2QIb-6XbbThfx8DRvN0PcpGCfUGBAD78ROU1zr8tBM6N3yidsW-tA
Frame ID: D8CD107CBAEDD6727CDCD0301AA34CF5
Requests: 12 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: C4566E9CC869C1EE12A004B97378AFDD
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/3b8ZtKHcFUSYKihZpywKVICyDtFsaoLwoCuDyEZifyk.js
Frame ID: B7625C35ADBAAD9842DE706E9AE71202
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
Frame ID: 8CF5E533E5C8EB594C540B774C536275
Requests: 37 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: BB634CC0464BEB0D2204330C483C5846
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 8E82ED78A07F77A6FE1142E89124B4CB
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/3b8ZtKHcFUSYKihZpywKVICyDtFsaoLwoCuDyEZifyk.js
Frame ID: 7B8567874A94EBAD7B3088C2E9224237
Requests: 1 HTTP requests in this frame

Frame: https://action.metaffiliation.com/trk.php?taff=P51195151F57B2215&argsite=23029100101079600973094011919020&gdprconsent=
Frame ID: A3D1D9F8D04E21931CD28295B64A7FBD
Requests: 1 HTTP requests in this frame

Frame: https://hal900020.redintelligence.net/request_content.php?s=23029100101079600973094011919020&a=c1aa1cc0
Frame ID: 97213CB78B2588D072C30DFE849CA759
Requests: 8 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 2D721F62BD934F742A827D8BBD87A828
Requests: 9 HTTP requests in this frame

Frame: https://img.metaffiliation.com/kwanko-sdk-iframe.html
Frame ID: 494F18105EC039D32F8078E7BA6A132D
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: E2684A3B26F13BE4A20279BDED40EA16
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: A646680335DF99818C3DDC8B873FB174
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ProxySite.com - Free Web Proxy Site

Page URL History Show full URLs

https://eu3.proxysite.com/process.php?d=1Y4A6uetvfW0RpHT4HFrC7VgA9nQ85XPk6yPkP284h%2Bm4l3lL2F6OuY%3D HTTP 302
https://www.proxysite.com/process.php?d=1Y4A6uetvfW0RpHT4HFrC7VgA9nQ85XPk6yPkP284h%2Bm4l3lL2F6OuY%3D HTTP 301
https://www.proxysite.com/ Page URL

Detected technologies

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

189
Requests

93 %
HTTPS

44 %
IPv6

28
Domains

39
Subdomains

31
IPs

4
Countries

2091 kB
Transfer

4747 kB
Size

40
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://eu2.proxysite.com/go/youtube.com
Title: YouTube

Search URL Search Domain Scan URL

URL: https://eu2.proxysite.com/go/facebook.com
Title: Facebook

Search URL Search Domain Scan URL

URL: https://eu2.proxysite.com/go/twitter.com
Title: Twitter

Search URL Search Domain Scan URL

URL: https://eu2.proxysite.com/go/reddit.com
Title: Reddit

Search URL Search Domain Scan URL

URL: https://eu2.proxysite.com/go/imgur.com
Title: Imgur

Search URL Search Domain Scan URL

URL: https://eu2.proxysite.com/go/google.com
Title: Google

Search URL Search Domain Scan URL

URL: https://pryvacy.com/
Title: Pryvacy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://eu3.proxysite.com/process.php?d=1Y4A6uetvfW0RpHT4HFrC7VgA9nQ85XPk6yPkP284h%2Bm4l3lL2F6OuY%3D HTTP 302
https://www.proxysite.com/process.php?d=1Y4A6uetvfW0RpHT4HFrC7VgA9nQ85XPk6yPkP284h%2Bm4l3lL2F6OuY%3D HTTP 301
https://www.proxysite.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 115

https://hal900020.redintelligence.net/request.php?zone=7wi7goi91r22&nw=20&renderingType=javascript&namespace=96038b2df3&subid=&uid=c7d5bc3d8b964b25&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYkrU_gAOvccKspoOwQnVBA%26exch_seat%3D20035004448%26mt_aid%3D5119917670281174466%26mt_id%3D6686412%26mt_adid%3D216536%26mt_sid%3D4637209%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_cid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCniwS_tRKYpSKOIK6ygWKkJLoDs-HjptcwIbZgsYCwI23ARABIABg-wGCARdjYS1wdWItNTI3MTA1MjAzMzc3NjgxMcgBCagDAaoEvQFP0LQFVRBnaubiTgoQvVAdr6QDwf6GYPwGQp09GMNBRkaxqQU22HX42R3FQ1gV1c8qbjUMn5PFXo1P9skgucveLY8yXlpEj0JSNQfH26hRc_uu5xYRiVOPYJ9zUUuVmBxpoDNR-DBunCscqw3Xvf683HhAJigiG5Vh2OL_e1aOCxszGFOBGb_gVDt7Rf20rKjVhXd1BR4IH5us1BIbu2iJtcm2fS1OO46mvpv0ecum4fsx8YMmtesKFHLqTvmABvfsraXW59OGXqAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0gR8ncf6D-3kWBTLj5KEl5jn4Ppg%2526client%253Dca-pub-5271052033776811%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-5271052033776811%26output%3Dhtml%26h%3D90%26adk%3D676745548%26adf%3D3560341080%26pi%3Dt.aa~a.4080220755~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1649071358%26rafmt%3D1%26to%3Dqs%26pwprc%3D8717720231%26psa%3D1%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fwww.proxysite.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1649071358857%26bpp%3D1%26bdt%3D1208%26idt%3D1%26shv%3Dr20220330%26mjsv%3Dm202203300101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Dcbe40aec1e6cb566-221c24636dcd00cb%253AT%253D1649071358%253ART%253D1649071358%253AS%253DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw%26prev_fmts%3D990x280%252C990x280%252C728x90%252C0x0%252C1200x280%26nras%3D3%26correlator%3D4393995530453%26frm%3D20%26pv%3D1%26ga_vid%3D1121233293.1649071358%26ga_sid%3D1649071358%26ga_hid%3D1097591842%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D2190%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759837%252C31065371%252C31066008%252C31066017%26oid%3D2%26pvsid%3D3516295011854182%26pem%3D991%26tmod%3D1327873000%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D6%26uci%3Da!6%26btvi%3D3%26fsb%3D1%26xpc%3DUDbT4e1aML%26p%3Dhttps%253A%2F%2Fwww.proxysite.com%26dtd%3D15&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.proxysite.com&random=5949315884309&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900020.redintelligence.net/request.php?zone=7wi7goi91r22&nw=20&renderingType=javascript&namespace=96038b2df3&subid=&uid=c7d5bc3d8b964b25&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYkrU_gAOvccKspoOwQnVBA%26exch_seat%3D20035004448%26mt_aid%3D5119917670281174466%26mt_id%3D6686412%26mt_adid%3D216536%26mt_sid%3D4637209%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_cid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCniwS_tRKYpSKOIK6ygWKkJLoDs-HjptcwIbZgsYCwI23ARABIABg-wGCARdjYS1wdWItNTI3MTA1MjAzMzc3NjgxMcgBCagDAaoEvQFP0LQFVRBnaubiTgoQvVAdr6QDwf6GYPwGQp09GMNBRkaxqQU22HX42R3FQ1gV1c8qbjUMn5PFXo1P9skgucveLY8yXlpEj0JSNQfH26hRc_uu5xYRiVOPYJ9zUUuVmBxpoDNR-DBunCscqw3Xvf683HhAJigiG5Vh2OL_e1aOCxszGFOBGb_gVDt7Rf20rKjVhXd1BR4IH5us1BIbu2iJtcm2fS1OO46mvpv0ecum4fsx8YMmtesKFHLqTvmABvfsraXW59OGXqAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0gR8ncf6D-3kWBTLj5KEl5jn4Ppg%2526client%253Dca-pub-5271052033776811%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-5271052033776811%26output%3Dhtml%26h%3D90%26adk%3D676745548%26adf%3D3560341080%26pi%3Dt.aa~a.4080220755~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1649071358%26rafmt%3D1%26to%3Dqs%26pwprc%3D8717720231%26psa%3D1%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fwww.proxysite.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1649071358857%26bpp%3D1%26bdt%3D1208%26idt%3D1%26shv%3Dr20220330%26mjsv%3Dm202203300101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Dcbe40aec1e6cb566-221c24636dcd00cb%253AT%253D1649071358%253ART%253D1649071358%253AS%253DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw%26prev_fmts%3D990x280%252C990x280%252C728x90%252C0x0%252C1200x280%26nras%3D3%26correlator%3D4393995530453%26frm%3D20%26pv%3D1%26ga_vid%3D1121233293.1649071358%26ga_sid%3D1649071358%26ga_hid%3D1097591842%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D2190%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759837%252C31065371%252C31066008%252C31066017%26oid%3D2%26pvsid%3D3516295011854182%26pem%3D991%26tmod%3D1327873000%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D6%26uci%3Da!6%26btvi%3D3%26fsb%3D1%26xpc%3DUDbT4e1aML%26p%3Dhttps%253A%2F%2Fwww.proxysite.com%26dtd%3D15&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.proxysite.com&random=5949315884309&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 118

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKQ4FtihhFnnU0jXEOt2JMpMxVgLJElZvjK3I1TApMZXTYS2A9ckB9kCkYE5ta8mNocdR0W6Qj9ZH87a6m6EoPf9pYjoG1g&google_gid=CAESEBZnU1X_cGaRtk63S2tr4Fo&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKQ4FtihhFnnU0jXEOt2JMpMxVgLJElZvjK3I1TApMZXTYS2A9ckB9kCkYE5ta8mNocdR0W6Qj9ZH87a6m6EoPf9pYjoG1g&google_gid=CAESEBZnU1X_cGaRtk63S2tr4Fo&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA0MDQxMTIyMzkwMDA1MzM4NjE1NDg5MQ%3D%3D&google_push=AYg5qPKQ4FtihhFnnU0jXEOt2JMpMxVgLJElZvjK3I1TApMZXTYS2A9ckB9kCkYE5ta8mNocdR0W6Qj9ZH87a6m6EoPf9pYjoG1g

Request Chain 120

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBsB44prk1eJEPibxtnBmH0&google_cver=1&google_push=AYg5qPJtuZgYsX-qFgp7tyBDWI7gVhFHB6lmI6erS8MNAoCZP9WP3UvBKP2k_CIqLZ_SU-WhY3ZOtDp_SWQ4mQmA6C8rVB4lU0r1 HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBsB44prk1eJEPibxtnBmH0&google_cver=1&google_push=AYg5qPJtuZgYsX-qFgp7tyBDWI7gVhFHB6lmI6erS8MNAoCZP9WP3UvBKP2k_CIqLZ_SU-WhY3ZOtDp_SWQ4mQmA6C8rVB4lU0r1&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=6CczbhWQTYOUq4elQ0n9pQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJtuZgYsX-qFgp7tyBDWI7gVhFHB6lmI6erS8MNAoCZP9WP3UvBKP2k_CIqLZ_SU-WhY3ZOtDp_SWQ4mQmA6C8rVB4lU0r1

Request Chain 121

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEOZkCp50_FStrwHZesNFWdo&google_cver=1&google_push=AYg5qPKsWXN_dhyLiI6Y_vweTfAaCCulOzLDqSy2qalYfJFpIf47wvH7upQZLYtNVN2XaPw3eUCO7g0XZmpcUlA7JrWVOnWAZTwA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLTUlDS1YtOS1WVlY=&google_push=AYg5qPKsWXN_dhyLiI6Y_vweTfAaCCulOzLDqSy2qalYfJFpIf47wvH7upQZLYtNVN2XaPw3eUCO7g0XZmpcUlA7JrWVOnWAZTwA

Request Chain 122

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1

Request Chain 125

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 168

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEL5eFruOfs0P0RDasT3FYQg&google_cver=1&google_push=AYg5qPI1XbYQ6t9vj5kPnnw7q0e5ZvpGxJAPamZLgO-8FotQaI2ZOxuXMfgOsIASZz0YElmqxyrT46taTwthGjfB9bA8WgmY6959Wg HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPI1XbYQ6t9vj5kPnnw7q0e5ZvpGxJAPamZLgO-8FotQaI2ZOxuXMfgOsIASZz0YElmqxyrT46taTwthGjfB9bA8WgmY6959Wg&google_hm=P6UVCY7Wh47IqIMWyppnVg

Request Chain 169

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPLoTCr-O77zUkroEsuJMCMidX_QaIjxg8kxZi3FGzBDfuG-7jHMcamY5L8q00VQBxRgQCtaZS3bHoXXxvR6F3ng7WDBH1ekVQ&google_gid=CAESEKa-LB9-D0tl2vZhpKuV1iA&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCP-pq5IGEgUI6AcQAEIASnJnb29nbGVfcHVzaD1BWWc1cVBMb1RDci1PNzd6VWtyb0VzdUpNQ01pZFhfUWFJanhnOGt4WmkzRkd6QkRmdUctN2pITWNhbVk1TDhxMDBWUUJ4UmdRQ3RhWlMzYkhvWFh4dlI2RjNuZzdXREJIMWVrVlE HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwQzE3QkJDOEJmYWd2NjdOdXJUc0FtWnVKQ3F3aU5NRzZwUm5neFVuRDlrNA==&google_push

Request Chain 171

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEC7fz1OO2-DpHoRcnOKif2I&google_cver=1&google_push=AYg5qPLiwR2LcuTx5NCjCgtKSKSCsmqJPhbq8Jc9ivTzVsgafAS5lm0VCTo9tcWUo6fh7oFXfLbgThd5AHlwJBPA_5ZOtQzuWPXqHg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=6CczbhWQTYOUq4elQ0n9pQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLiwR2LcuTx5NCjCgtKSKSCsmqJPhbq8Jc9ivTzVsgafAS5lm0VCTo9tcWUo6fh7oFXfLbgThd5AHlwJBPA_5ZOtQzuWPXqHg

Request Chain 172

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEINMuT--54KVW7Y9JB1GZ1A&google_cver=1&google_push=AYg5qPJz91IB0SYqhZffTa2DW3Z_omJ1d3z5EFaPdQUuaNOHUssmWIUDWjQpWr1pQJbP7Jd69tM6gyHP-AhCgmybQKv6Ouff71DF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLTUlDUjMtSi0xOFVN&google_push=AYg5qPJz91IB0SYqhZffTa2DW3Z_omJ1d3z5EFaPdQUuaNOHUssmWIUDWjQpWr1pQJbP7Jd69tM6gyHP-AhCgmybQKv6Ouff71DF

Request Chain 173

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1

Request Chain 179

https://tracking.publicidees.com/banner.php?partid=30890&progid=1883&promoid=72579&noret=8c801e11d41b2e47a4d3979ed6d7dd3c&cb=23029100101079600973094011919020 HTTP 302
https://ad.publicidees.com/promos/banners/1199/72579.jpg

Request Chain 182

https://lov.saveur-biere.com/kwanko-sdk-iframe.html HTTP 302
https://img.metaffiliation.com/kwanko-sdk-iframe.html

Request Chain 196

https://lov.saveur-biere.com/12/64999/img_9_105_9.gif HTTP 302
https://img.metaffiliation.com/12/64999/img_9_105_9.gif

189 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.proxysite.com/
Redirect Chain

https://eu3.proxysite.com/process.php?d=1Y4A6uetvfW0RpHT4HFrC7VgA9nQ85XPk6yPkP284h%2Bm4l3lL2F6OuY%3D
https://www.proxysite.com/process.php?d=1Y4A6uetvfW0RpHT4HFrC7VgA9nQ85XPk6yPkP284h%2Bm4l3lL2F6OuY%3D
https://www.proxysite.com/

14 KB
5 KB

142ms
142ms

Document
text/html

35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proxysite.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: ff98baa3a990c2660c47a7587ba5fd0ad66cd548e9318522163653ed31e2fb7d

Request headers

Accept-Language: fr-FR,fr;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

cache-control: no-cache, max-age=0
content-encoding: gzip
content-length: 4222
content-type: text/html; charset=UTF-8
date: Mon, 04 Apr 2022 11:22:37 GMT
expires: Mon, 04 Apr 2022 11:22:37 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: max-age=0
content-length: 234
content-type: text/html; charset=iso-8859-1
date: Mon, 04 Apr 2022 11:22:37 GMT
expires: Mon, 04 Apr 2022 11:22:37 GMT
location: https://www.proxysite.com/
server: Apache

GET
H2 200 96f631f.css
www.proxysite.com/css/ 38 KB
8 KB 105ms
102ms Stylesheet
text/css 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proxysite.com/css/96f631f.css?v=17030501
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 35d4a453929aeb9cb4ca18e20087e72d2b251d050a6a7ec20931c152049d341f

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
content-encoding: gzip
last-modified: Mon, 18 Mar 2019 22:05:12 GMT
server: Apache
etag: "97e6-58465952cb63a-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 7817
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 logo.png
www.proxysite.com/assets/images/ 3 KB
4 KB 205ms
202ms Image
image/png 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.proxysite.com/assets/images/logo.png
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 2f1513a46b73f5ada51bafe9acd73abc1489f912de163236e4b6480a8311fb18

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
last-modified: Mon, 18 Mar 2019 22:04:54 GMT
server: Apache
etag: "cd8-5846594180abd"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3288
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 privacy.png
www.proxysite.com/assets/images/ 7 KB
8 KB 205ms
203ms Image
image/png 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.proxysite.com/assets/images/privacy.png
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: eaee2371582b8c319e9f7b6432b570d1c7cc5bda80a6d7819521c6df355c3f9b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
last-modified: Mon, 18 Mar 2019 22:04:54 GMT
server: Apache
etag: "1dbc-5846594181a5d"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 7612
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 speed.png
www.proxysite.com/assets/images/ 5 KB
6 KB 304ms
302ms Image
image/png 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.proxysite.com/assets/images/speed.png
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 036a97f58ae41233cce615d76fb5511d15d9db41201bae08f0099eeb07faec28

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
last-modified: Mon, 18 Mar 2019 22:04:54 GMT
server: Apache
etag: "158b-5846594181a5d"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 5515
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 magnifying.png
www.proxysite.com/assets/images/ 10 KB
10 KB 305ms
303ms Image
image/png 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.proxysite.com/assets/images/magnifying.png
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: ecb0a51c8bccd33964654ecedc1115640eec2c15b217d843df9ed2c36d358060

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
last-modified: Mon, 18 Mar 2019 22:04:54 GMT
server: Apache
etag: "2690-5846594180abd"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 9872
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 computer.png
www.proxysite.com/assets/images/ 7 KB
7 KB 304ms
303ms Image
image/png 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.proxysite.com/assets/images/computer.png
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 60738e0c21e145c63411dab779e72942f078ede817a5cdf57466ef0e61ff8d49

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
last-modified: Mon, 18 Mar 2019 22:04:54 GMT
server: Apache
etag: "1b25-5846594180abd"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 6949
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 magnifying2.png
www.proxysite.com/assets/images/ 7 KB
7 KB 305ms
303ms Image
image/png 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.proxysite.com/assets/images/magnifying2.png
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 0ac9094e17f405afb1a4cb915170e1051a048db8597a64460222f03fab4dcc76

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
last-modified: Mon, 18 Mar 2019 22:04:54 GMT
server: Apache
etag: "1b58-5846594180abd"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 7000
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 logo-footer.png
www.proxysite.com/assets/images/ 2 KB
2 KB 522ms
520ms Image
image/png 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.proxysite.com/assets/images/logo-footer.png
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 938bb7a4fe2818088711d433b38bb086516f778d8614faaf479ac89cf62968ec

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:38 GMT
last-modified: Mon, 18 Mar 2019 22:04:54 GMT
server: Apache
etag: "7b4-5846594180abd"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1972
expires: Wed, 04 May 2022 11:22:38 GMT

GET
H2 200 jquery.js Show response
www.proxysite.com/assets/js/ 95 KB
34 KB 307ms
304ms Script
application/javascript 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proxysite.com/assets/js/jquery.js?v=17030501
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
content-encoding: gzip
last-modified: Mon, 18 Mar 2019 22:05:12 GMT
server: Apache
etag: "17b8b-584659529c83c-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 33760
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 65f94d5.js Show response
www.proxysite.com/js/ 39 KB
10 KB 205ms
202ms Script
application/javascript 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proxysite.com/js/65f94d5.js?v=17030501
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: dc2261fa7fc402f3869461ab510796c6a45c58b4910d7eaaf674bfefd5274e6c

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
content-encoding: gzip
last-modified: Mon, 18 Mar 2019 22:05:13 GMT
server: Apache
etag: "9a33-584659532c117-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 9611
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 156 KB
53 KB 108ms
47ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0fa69d50d6274de1b579c381da50f4d923558a40a81fd471882ecc70d090a268

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54134
x-xss-protection: 0
server: cafe
etag: 827793155750955655
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 04 Apr 2022 11:22:37 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 97 KB
29 KB 78ms
19ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6F93) /
Resource Hash: da7ae7eec9c1f857161ad9356669f90a20a3e1bd18c8124b53cc2e367e04780b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Mon, 04 Apr 2022 11:22:37 GMT
Content-Encoding: gzip
Age: 1315
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 29457
x-tw-cdn: VZ
Last-Modified: Thu, 31 Mar 2022 19:50:29 GMT
Server: ECS (pab/6F93)
Etag: "f763893db69b9ff52796c20ddfe2ac52+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 71ms
23ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

17de8174504d5e8409dbbffece047aa33f9a92fadfd7a7784c72cb51e6c57c8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: +jA1xLpcZZtzKigxnsRRBg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 1687
x-fb-rlafr: 0
x-fb-debug: VHHTtKloi3f7XaLOzfaamQ6jRzpxQqrA8r3u/9vknY0tDAocdeB8zGxSol6MPZHQ8w/fobHCczNGZkAiPoqZCg==
x-fb-trip-id: 686109401
x-fb-content-md5: 10629a52d8f7a32c2ae4aa8f6d964931
x-frame-options: DENY
date: Mon, 04 Apr 2022 11:22:37 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "c5d9d30b577ad8cc62fd1a90ff7c8f74"
timing-allow-origin: *
expires: Mon, 04 Apr 2022 11:36:33 GMT

GET
H2 200 bg.png
www.proxysite.com/assets/images/ 236 B
765 B 290ms
286ms Image
image/png 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.proxysite.com/assets/images/bg.png
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/css/96f631f.css?v=17030501
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 9428518d1b1c9e441b6dcf1effddc210ce3ab2d1e0913be29695e907b4c82c43

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/css/96f631f.css?v=17030501
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
last-modified: Mon, 18 Mar 2019 22:04:54 GMT
server: Apache
etag: "ec-5846594180abd"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 236
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 raleway.woff2
www.proxysite.com/assets/fonts/ 15 KB
15 KB 286ms
286ms Font
application/octet-stream 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proxysite.com/assets/fonts/raleway.woff2
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/css/96f631f.css?v=17030501
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 770da7643a54e06b63d0c10b9386c21eebe7fe791bbd43e760a9f763aa95d26f

Request headers

Referer: https://www.proxysite.com/css/96f631f.css?v=17030501
Origin: https://www.proxysite.com
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
last-modified: Mon, 18 Mar 2019 22:04:54 GMT
server: Apache
etag: "3ab8-5846594180abd"
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 15032
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 raleway-semibold.woff2
www.proxysite.com/assets/fonts/ 15 KB
15 KB 283ms
283ms Font
application/octet-stream 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proxysite.com/assets/fonts/raleway-semibold.woff2
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/css/96f631f.css?v=17030501
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 3cee69d07c93d87ecbb03f206ddb86c9d4ba12638a18ed177de725be2eb8333a

Request headers

Referer: https://www.proxysite.com/css/96f631f.css?v=17030501
Origin: https://www.proxysite.com
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
last-modified: Mon, 18 Mar 2019 22:04:54 GMT
server: Apache
etag: "3b18-5846594180abd"
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 15128
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 icomoon.ttf
www.proxysite.com/assets/fonts/ 3 KB
3 KB 283ms
283ms Font
application/font-sfnt 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proxysite.com/assets/fonts/icomoon.ttf?-p3bna1
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/css/96f631f.css?v=17030501
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 7ffcb15458cc6d82ade6166ddb0788afe839679e06d01368d615e8f2c0c6a5f1

Request headers

Referer: https://www.proxysite.com/css/96f631f.css?v=17030501
Origin: https://www.proxysite.com
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
last-modified: Mon, 18 Mar 2019 22:04:54 GMT
server: Apache
etag: "a7c-5846594180abd"
content-type: application/font-sfnt
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2684
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 raleway-bold.woff2
www.proxysite.com/assets/fonts/ 15 KB
15 KB 286ms
286ms Font
application/octet-stream 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proxysite.com/assets/fonts/raleway-bold.woff2
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/css/96f631f.css?v=17030501
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 724acb468e6daf873120d385f6717f09d84ffb51b33c81cb135597dad94ab4d7

Request headers

Referer: https://www.proxysite.com/css/96f631f.css?v=17030501
Origin: https://www.proxysite.com
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
last-modified: Mon, 18 Mar 2019 22:04:54 GMT
server: Apache
etag: "3aa0-5846594180abd"
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 15008
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H2 200 raleway-light.woff2
www.proxysite.com/assets/fonts/ 15 KB
15 KB 256ms
256ms Font
application/octet-stream 35.171.101.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proxysite.com/assets/fonts/raleway-light.woff2
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/css/96f631f.css?v=17030501
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.101.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-101-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: d3f154bd52d039a8d725c3a790c0887142a2963f09b28c6280e4629ca8521e93

Request headers

Referer: https://www.proxysite.com/css/96f631f.css?v=17030501
Origin: https://www.proxysite.com
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:37 GMT
last-modified: Mon, 18 Mar 2019 22:04:54 GMT
server: Apache
etag: "3a6c-5846594180abd"
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 14956
expires: Wed, 04 May 2022 11:22:37 GMT

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 288 KB
82 KB 48ms
23ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=40829e0692b4d500408e52dc60db111d

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

69c6399954fe80eae18ec5f729521d1d535928adc5eae3a1b3ff3e4e64d95293

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.proxysite.com/
Origin: https://www.proxysite.com
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 9KndYicA519ci+YjrlYQmA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 84182
x-fb-rlafr: 0
x-fb-debug: y6w5/qKQ3TW492Zukwyf2E08hpLRXjoC3yZfnba+wCkM2P5w1pSW2To/9Iot3SojudueH37dBixq0wU6c4KZeQ==
x-fb-content-md5: 8fa27b45637c73f83875b9d70ef960fd
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 04 Apr 2022 11:22:37 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "8aa2459b9d008aee2d767200608550db"
timing-allow-origin: *
priority: u=3,i
expires: Tue, 04 Apr 2023 10:30:23 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 85ms
24ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 6468
date: Mon, 04 Apr 2022 09:34:50 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 04 Apr 2022 11:34:50 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220330/r20190131/ Frame 1E2C 10 KB
5 KB 92ms
24ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220330/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ce5fc08d0f617e71e1d61bcd79fc7cc1855f4221945b0c09ac774685fe7f52c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

age: 42969
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4502
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 03 Apr 2022 23:26:29 GMT
etag: 4044455266028820542
expires: Sun, 17 Apr 2022 23:26:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK widget_iframe.0af76c3310098d2f8f428367b62351b8.html Show response
platform.twitter.com/widgets/ Frame 6D16 319 KB
104 KB 19ms
19ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.0af76c3310098d2f8f428367b62351b8.html?origin=https%3A%2F%2Fwww.proxysite.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6F98) /
Resource Hash: c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 315008
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105433
Content-Type: text/html; charset=utf-8
Date: Mon, 04 Apr 2022 11:22:38 GMT
Etag: "8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified: Thu, 31 Mar 2022 19:49:03 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (pab/6F98)
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=2
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ

GET
H2 200 like.php Show response
www.facebook.com/v2.5/plugins/ Frame 040C 48 KB
18 KB 139ms
93ms Document
text/html 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.5/plugins/like.php?action=like&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df271966be1871e4%26domain%3Dwww.proxysite.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.proxysite.com%252Ff1406687f447f88%26relation%3Dparent.parent&container_width=105&href=https%3A%2F%2Fwww.proxysite.com%2F&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&width=80

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=40829e0692b4d500408e52dc60db111d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b334879acc4b0727c923f0a6d3cd92ce09a862177f284c659fd360ac1102f66f

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
date: Mon, 04 Apr 2022 11:22:38 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
facebook-api-version: v6.0
pragma: no-cache
priority: u=3,i
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: OAZ20riwV2tGa36QJqKa78g1QC7ZqKBccObAI//Ig9zzNTTsenkCmUNGw3lGGtfHzJwP4jfKuDnQuu1jLYExJg==
x-fb-rlafr: 0
x-xss-protection: 0

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203300101/ 301 KB
108 KB 86ms
51ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203300101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5271052033776811&plah=www.proxysite.com&bust=31066008

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddeb2faefdfb89545a8fab657a5b54d6c93d8ff75209623073945e893b916c71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 110325
x-xss-protection: 0
server: cafe
etag: 7786133231023003550
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 04 Apr 2022 11:22:38 GMT

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 6D16 230 B
445 B 187ms
127ms Fetch
application/json 104.244.42.200
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=3c8703c801047e1be3956370a0f1e8dd2b2a3e4f

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.0af76c3310098d2f8f428367b62351b8.html?origin=https%3A%2F%2Fwww.proxysite.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.200 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

5054a54db3ef08ce6320ae9a8d59ca6e4d6f0c66b5cd92a03caccf9d0448040a

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-response-time: 104
date: Mon, 04 Apr 2022 11:22:38 GMT
content-encoding: gzip
last-modified: Mon, 04 Apr 2022 11:22:38 GMT
server: tsa_f
vary: Origin
strict-transport-security: max-age=631138519
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: 942c1626134b39e048819ccd1a4208669c84ac28206f9b2c55e64dbdd5f4865a
content-length: 164

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 74ms
37ms XHR
text/plain 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1097591842&t=pageview&_s=1&dl=https%3A%2F%2Fwww.proxysite.com%2F&ul=en-us&de=UTF-8&dt=ProxySite.com%20-%20Free%20Web%20Proxy%20Site&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=632380916&gjid=1901340202&cid=1121233293.1649071358&tid=UA-45368124-2&_gid=314693249.1649071358&_r=1&_slc=1&z=1192990770

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.proxysite.com/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.proxysite.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 OqOE21UvWe3.png
static.xx.fbcdn.net/rsrc.php/v3/y5/r/ Frame 040C 400 B
660 B 23ms
22ms Image
image/png 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y5/r/OqOE21UvWe3.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.5/plugins/like.php?action=like&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df271966be1871e4%26domain%3Dwww.proxysite.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.proxysite.com%252Ff1406687f447f88%26relation%3Dparent.parent&container_width=105&href=https%3A%2F%2Fwww.proxysite.com%2F&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&width=80

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ed91fbb0cd9308f91f8e1fd93942c94ee850fc4161ed788b16f801b743c70b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:38 GMT
x-content-type-options: nosniff
content-md5: uF0RL4E+h23ClLQmPOTTMw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 400
x-fb-rlafr: 0
x-fb-debug: vJy/QdBC/3cpdJDyp+kcWhdANr+zaptvOW7ZXLvIWyrWpXqG3Ab8Dk3xUQUUXJgmgXngpmjsMNwa5ueY6muHrg==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Apr 2023 05:32:48 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 217 B
646 B 120ms
39ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.proxysite.com&callback=_gfp_s_&client=ca-pub-5271052033776811

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203300101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5271052033776811&plah=www.proxysite.com&bust=31066008

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

77ede445a0c52ee72cff281493043899135432ab67ef92065835bf9e34775f9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 202
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
792 B 135ms
39ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.proxysite.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 04 Apr 2022 11:22:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 112ms
38ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.proxysite.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 04 Apr 2022 11:22:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DD08 93 KB
32 KB 368ms
328ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&slotname=2867599685&adk=3927345067&adf=3573213364&pi=t.ma~as.2867599685&w=990&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=3&psa=0&format=990x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358257&bpp=3&bdt=608&idt=152&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&correlator=4393995530453&frm=20&pv=2&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=305&ady=191&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=uNYkntvef7&p=https%3A//www.proxysite.com&dtd=168

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

81a41e6058e181feddc2b1467c7caffeba23c4a6096016c94e742b4150f269bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 32630
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Apr 2022 11:22:38 GMT
expires: Mon, 04 Apr 2022 11:22:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 hO3BA8a1wP0.js Show response
static.xx.fbcdn.net/rsrc.php/v3iEpO4/yc/l/en_US/ Frame 040C 522 KB
136 KB 23ms
22ms XHR
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yc/l/en_US/hO3BA8a1wP0.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9c7a121317262200d9082cf560cfbbde54765e199c9894f379d9a6c91e9a4ff4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: fLd+H7q3ZlhbhsSj+trDGw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 139157
x-fb-rlafr: 0
x-fb-debug: kMwsd73mXUz/zVeLkeqToaUabGZ8ErugV1+QQ1eQIJuJv2xB2bMGGwL/4JiOVaE8THA9CRw24gKWBY7Bkv5C2A==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=1
expires: Sat, 01 Apr 2023 02:55:53 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame FF5D 94 KB
32 KB 429ms
410ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&slotname=4344332884&adk=523175106&adf=1005968846&pi=t.ma~as.4344332884&w=990&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&psa=0&format=990x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358260&bpp=1&bdt=610&idt=180&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&prev_fmts=990x280&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=305&ady=702&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=pwFPO3JFmN&p=https%3A//www.proxysite.com&dtd=183

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5be74229b5ab4032b7eafc6235b15b2f20310ebf5cc8fe3aa0cbc1724363d304

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 32797
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Apr 2022 11:22:38 GMT
expires: Mon, 04 Apr 2022 11:22:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 39BA 430 B
231 B 203ms
195ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=90&slotname=6803856480&adk=197138127&adf=1497320946&pi=t.ma~as.6803856480&w=728&lmt=1649071358&rafmt=12&psa=0&format=728x90&url=https%3A%2F%2Fwww.proxysite.com%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358261&bpp=1&bdt=611&idt=193&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&prev_fmts=990x280%2C990x280&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=2948&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepEbr%7C&abl=CS&pfx=0&fu=256&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=BGZDK9fITB&p=https%3A//www.proxysite.com&dtd=197

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7acbb66fbdc4771dd8e5aa9bb959a787551414fe2b3d8b49137633e85436349

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 208
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Apr 2022 11:22:38 GMT
expires: Mon, 04 Apr 2022 11:22:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame CAF9 88 KB
33 KB 342ms
341ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&adk=1812271804&adf=3025194257&lmt=1649071358&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.proxysite.com%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358262&bpp=1&bdt=612&idt=199&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&prev_fmts=990x280%2C990x280%2C728x90&nras=1&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=203

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a5f9151f7184cd624cfb65f6632564829537c034098c4ef670f20e3af246e13f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 33986
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Apr 2022 11:22:38 GMT
expires: Mon, 04 Apr 2022 11:22:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cavalry_endpoint.php
www.facebook.com/common/ Frame 040C 67 B
105 B 70ms
45ms Image
image/png 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/common/cavalry_endpoint.php?t_cstart=1649071358430&t_start=1649071358431&t_domcontent=1649071358452&t_layout=1649071358480&t_onload=1649071358480&t_paint=1649071358480&t_creport=1649071358480&t_tti=1649071358452&lid=7082707552058486180-0

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.facebook.com/v2.5/plugins/like.php?action=like&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df271966be1871e4%26domain%3Dwww.proxysite.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.proxysite.com%252Ff1406687f447f88%26relation%3Dparent.parent&container_width=105&href=https%3A%2F%2Fwww.proxysite.com%2F&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&width=80
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: br
x-content-type-options: nosniff
document-policy: force-load-at-top
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: no-cache
x-fb-debug: 3x1ni+qRLCfhVP7Bbkje/eEtmoVUk9p8MbBX0kZGsstKjcaOMAGqFVGVKV2to2IQKG5BjYSq1lvrWcNT1NbY4A==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 04 Apr 2022 11:22:38 GMT
strict-transport-security: max-age=15552000; preload
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: image/png
vary: Accept-Encoding
cache-control: private, no-store, no-cache, must-revalidate
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK button.aa5c8b3b99b08ae2f6493ea7d8cc8590.js Show response
platform.twitter.com/js/ 7 KB
3 KB 18ms
18ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.aa5c8b3b99b08ae2f6493ea7d8cc8590.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6F93) /
Resource Hash: 261cf8e55383415eceda39a856866ffd0b64fbb1a5be243e48b097c475ac7128

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Mon, 04 Apr 2022 11:22:38 GMT
Content-Encoding: gzip
Age: 315015
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 2293
x-tw-cdn: VZ
Last-Modified: Thu, 31 Mar 2022 19:48:55 GMT
Server: ECS (pab/6F93)
Etag: "d0a23e7e0339812df29e0bc23fe13bd2+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK tweet_button.0af76c3310098d2f8f428367b62351b8.en.html Show response
platform.twitter.com/widgets/ Frame C434 32 KB
13 KB 20ms
19ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.0af76c3310098d2f8f428367b62351b8.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6F93) /
Resource Hash: c395d306f173cb32e68acf4ecf179deddcddfb19b8d7e265c37522def3528411

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 315013
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 12241
Content-Type: text/html; charset=utf-8
Date: Mon, 04 Apr 2022 11:22:38 GMT
Etag: "f9ac47ef419be7a340744bc9713a364e+gzip"
Last-Modified: Thu, 31 Mar 2022 19:48:59 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (pab/6F93)
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ

GET
DATA 200
OK truncated
/ Frame C434 822 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
334 B 130ms
129ms Image
image/gif 104.244.42.200
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwww.proxysite.com%2F%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1649071358688%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%22f9f80a909a60b%3A1648751432723%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.200 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 107
pragma: no-cache
last-modified: Mon, 04 Apr 2022 11:22:38 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 942c1626134b39e048819ccd1a4208669c84ac28206f9b2c55e64dbdd5f4865a
x-transaction: 2956ec766d583272
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame DD08 8 KB
1 KB 104ms
40ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&slotname=2867599685&adk=3927345067&adf=3573213364&pi=t.ma~as.2867599685&w=990&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=3&psa=0&format=990x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358257&bpp=3&bdt=608&idt=152&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&correlator=4393995530453&frm=20&pv=2&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=305&ady=191&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=uNYkntvef7&p=https%3A//www.proxysite.com&dtd=168

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1e046a89bb90f44dadb24f5fdfbe412b5f6d320b790f7317fad956b193234726

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 04 Apr 2022 09:33:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 04 Apr 2022 11:22:38 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 04 Apr 2022 11:22:38 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame DD08 2 KB
984 B 105ms
27ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:05:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1029
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:05:29 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DD08 0
0 68ms
68ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CVDnE_tRKYoqZHseKrATUv4LQD6_1rvhoitjh3ccPsJAfEAEggfOTKWD7AaAByLGpzQPIAQmoAwHIA8sEqgS7AU_QDAq7nkHf4RF66YSTOJW6NQep_CJvIT9SHj3FFzu7tc2XtMrF5pG7XMPfiiF6WwnX0gYUPVKxkTd8mAADUjSM8gSqr07imRUGe7K-KdL4-_27FsQ-IiwdbZOhXxiP6LFmD1is7CMfDsQp8k7KMWGrVq8HQHAktFqrzUNqi2QZPHJRptJy03p1Ttvibq_2sjRA-iVlFKq5lOjHxnMkDv65FskL0I96VyLU2yvDRwqXybc6XYxUJDvaFavABJXru5XhA5IFBAgEGAGSBQQIBRgEoAYugAfk6uI1qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQiskO0ggJCIDhgBAQARgfgAoByAsBuBOIJ9gTDYgUAtAVAYAXAbIXHAoaCAASFHB1Yi01MjcxMDUyMDMzNzc2ODExGAA&sigh=b8WrraptRVk&uach_m=[UACH]&template_id=5000

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&slotname=2867599685&adk=3927345067&adf=3573213364&pi=t.ma~as.2867599685&w=990&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=3&psa=0&format=990x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358257&bpp=3&bdt=608&idt=152&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&correlator=4393995530453&frm=20&pv=2&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=305&ady=191&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=uNYkntvef7&p=https%3A//www.proxysite.com&dtd=168
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 04 Apr 2022 11:22:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 04 Apr 2022 11:22:38 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/ Frame DD08 19 KB
8 KB 94ms
24ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d072a09604e6a1fea8ef42203503771aa36b63a3c91fd1059966e26e6f5812b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:19:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7871
x-xss-protection: 0
server: cafe
etag: 7397949449432438406
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:19:31 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame DD08 2 KB
1 KB 97ms
28ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:21:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:21:41 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DD08 119 KB
37 KB 130ms
57ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36916
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648640521462251"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 04 Apr 2022 11:22:38 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame DD08 15 KB
6 KB 98ms
29ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 121
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:20:37 GMT

GET
H2 200 dfa9fdc9b45632ba17ba59fe64d4dcb5.js Show response
www.gstatic.com/mysidia/ Frame DD08 29 KB
12 KB 91ms
25ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/dfa9fdc9b45632ba17ba59fe64d4dcb5.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aa0992b4e17a3324d53313c014452f8636a4c6b1b84d3187886c386140911535

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 10:20:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 262950
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12015
x-xss-protection: 0
last-modified: Tue, 29 Mar 2022 18:36:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 30 Jun 2022 10:20:08 GMT

GET
DATA 200
OK truncated
/ Frame DD08 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame DD08 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203300101/ 145 KB
51 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203300101/reactive_library_fy2019.js?bust=31066008

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f1676206981b31116d3091ab7a078623b1a7917ed5adef37f7b287bc1c429786

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52632
x-xss-protection: 0
server: cafe
etag: 781167485008300180
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 04 Apr 2022 11:22:38 GMT

GET
H3 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
122 B 76ms
38ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.proxysite.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 04 Apr 2022 11:22:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 73ms
35ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.proxysite.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 04 Apr 2022 11:22:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7B33 95 KB
34 KB 282ms
281ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&adk=3625593270&adf=3099719705&pi=t.aa~a.4226026281~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1207&idt=-M&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0&nras=2&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1451&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=jqiPJSBz6z&p=https%3A//www.proxysite.com&dtd=11

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

347ceeb1226aa3c74ccaab6c4ad7e3e22fe6957dfc6c65794d6f35a03d713103

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 35170
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Apr 2022 11:22:39 GMT
expires: Mon, 04 Apr 2022 11:22:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F3D7 33 KB
13 KB 203ms
202ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=90&adk=676745548&adf=3560341080&pi=t.aa~a.4080220755~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x90&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1208&idt=1&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0%2C1200x280&nras=3&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2190&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=UDbT4e1aML&p=https%3A//www.proxysite.com&dtd=15

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e4775032cfd2307097925e1350878f770d70d7f079626d3dec3fd2c63ea6dcb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 13097
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Apr 2022 11:22:39 GMT
expires: Mon, 04 Apr 2022 11:22:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame FF5D 8 KB
965 B 42ms
40ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&slotname=4344332884&adk=523175106&adf=1005968846&pi=t.ma~as.4344332884&w=990&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&psa=0&format=990x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358260&bpp=1&bdt=610&idt=180&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&prev_fmts=990x280&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=305&ady=702&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=pwFPO3JFmN&p=https%3A//www.proxysite.com&dtd=183

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1e046a89bb90f44dadb24f5fdfbe412b5f6d320b790f7317fad956b193234726

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 04 Apr 2022 10:27:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 04 Apr 2022 11:22:38 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 04 Apr 2022 11:22:38 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame FF5D 2 KB
938 B 48ms
47ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:05:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1029
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:05:29 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/ Frame FF5D 19 KB
8 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d072a09604e6a1fea8ef42203503771aa36b63a3c91fd1059966e26e6f5812b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:19:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7871
x-xss-protection: 0
server: cafe
etag: 7397949449432438406
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:19:31 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame FF5D 2 KB
1 KB 45ms
45ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:21:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:21:41 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FF5D 119 KB
36 KB 87ms
87ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36916
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648640521462251"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 04 Apr 2022 11:22:38 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame FF5D 15 KB
6 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 121
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:20:37 GMT

GET
H2 200 dfa9fdc9b45632ba17ba59fe64d4dcb5.js Show response
www.gstatic.com/mysidia/ Frame FF5D 29 KB
12 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/dfa9fdc9b45632ba17ba59fe64d4dcb5.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aa0992b4e17a3324d53313c014452f8636a4c6b1b84d3187886c386140911535

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 10:20:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 262950
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12015
x-xss-protection: 0
last-modified: Tue, 29 Mar 2022 18:36:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 30 Jun 2022 10:20:08 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame FF5D 0
0 64ms
64ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CISFX_tRKYtPsH9TkywWt6Yu4ApWh7LZp1frtw9IP2tkeEAEggfOTKWD7AaAB9b7n8gLIAQmoAwHIA8sEqgTIAU_QJGGiC-rhRKrlX8uGYAhDioHnclJ1VLRb6HJppxq-snPZtrGtaV5Vnh09GkdkuruJVD37m2mBZgH_eJDM8BeNbjY2pierYQrrSxIHcNuerYwK7hO_VTnRm5pIHf6Pn1OdvSd2QpSeQ1uY5oykpyHZcuP3frdG3Ym2OGlerWvl3l_mI4l5_mbgfE0AW-49eUOsPkK8_hrFy0BOr2WR4busXcEPPJQ3--ud5Lnpbmd3fHVIIdcZ1x_EGF92pN-AYF-jqoOBv8c3wAT7_eSI-gOgBi6AB5aNqbsCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQwcoE0ggJCIDhgBAQARgfgAoByAsBuBOIJ9gTA9AVAZgWAYAXAbIXHAoaCAASFHB1Yi01MjcxMDUyMDMzNzc2ODExGAA&sigh=2jpXyMkYYoE&uach_m=[UACH]&template_id=5000

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&slotname=4344332884&adk=523175106&adf=1005968846&pi=t.ma~as.4344332884&w=990&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&psa=0&format=990x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358260&bpp=1&bdt=610&idt=180&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&prev_fmts=990x280&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=305&ady=702&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=pwFPO3JFmN&p=https%3A//www.proxysite.com&dtd=183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 04 Apr 2022 11:22:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/10921437080852386211/ Frame FF5D 40 KB
40 KB 34ms
34ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10921437080852386211/downsize_200k_v1?w=600&h=314

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83ddb4703804f6f155d71c7de5b659e329bd40a52d55e0bf9d6eb344833f39b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 13:12:57 GMT
x-content-type-options: nosniff
age: 252581
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41077
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 04:45:31 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 01 Apr 2023 13:12:57 GMT

GET
DATA 200
OK truncated
/ Frame FF5D 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame FF5D 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/ Frame AB00 10 KB
4 KB 30ms
28ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ce5fc08d0f617e71e1d61bcd79fc7cc1855f4221945b0c09ac774685fe7f52c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

age: 35935
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4502
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Apr 2022 01:23:43 GMT
etag: 4044455266028820542
expires: Mon, 18 Apr 2022 01:23:43 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame AB00 0
0 143ms
65ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstwPfUm0o1_qRK89Toznx14zMskg9nPjbVp5iThwb_SuYu4dTutBGGrsqqJRvBzRUjA9Or47Fy57W86wEJpHf3-FFTrZn0Zoz2B8o255B-ZHVZakEgqQVLQNkb9hpNLCG24igLZTS3oUQSKdgWoKtT--m6tA9sizjGSlah43ErHQ-KooVjPF4QMvrKv4-uqbyCOhFQH5s0GZvnc5bDDsT_paKOEGE15q1MZQ41UoGCPRkQLTQRFNI3--Ttp2ZI9QOj1cO1v4OetvoNPVQNyEA38SjZ2NyWLTNXYHBiniZ7JgRg4qZraJJiRWssJAS9jemfusQxfa2q-sdr9IUmokNQJS9E-R4v5qB5pQvTIj5p2HE7YHEMXfBJ5G4tkYkVNFjt7erON3Z_nZUzqMpIA3Y5Vf67FjuNzBUSrkY_800Lfp8zIMhyDpPVKctGaeJXB-LGdqepbuLIvPzZA3PcqFvkL8mtAL4QlD2pXNIwCDqOXX23gET3hZo4YjCsfsy01MUmCxZ1q-HmOXG4QrrGDQRQKtJESz7AGtNaSKP1rFDEDnQGZ1EBtvmwNUQiDEKzf_THot15a6rmhfHLnkyGzps-QjOoyGJpkBlszzdAHACdKxqgpDnGtveMPNf2rjfTT6Bdch7y1fKCfnkOCq6hyV8JAA1CPF3HrI2z5jPY5Uudsvnn34PALh78vGHFnhLyvFPnHR-16cwaCwEhkDEWsBVAd1X9tQKyqCOHZ3eok6nCbjvDhxUMxuNsu0rAn9_b4A0CDX9I5qiDjX0XehWbcFgDLQwu7RjFnjtIdtK9Ew20Z3i1lGo9x6wCd3xj97qlYih1R7T8Hs15HUJe42vlI2OzYTfiM8-VmHoV0Ggw-euedFC5nCKdU3GRu5EeWC4m3lH3sNapu743uizpZSmYmm_DQYdZVpm5nEODLyJF95kdC0t6kFnX08W7Rwg&sai=AMfl-YSBTOWWoRR8sLwxJ38Z_aWBfqHVtKbKNpzTzGI4NydTRORzBoWncS4uTQ&sig=Cg0ArKJSzM8byuBPuKBbEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Mon, 04 Apr 2022 11:22:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame AB00 106 KB
38 KB 129ms
24ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Sun, 03 Apr 2022 14:41:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 74456
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 04 Apr 2022 14:41:43 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame AB00 41 KB
15 KB 80ms
40ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Thu, 31 Mar 2022 06:39:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 362605
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 31 Mar 2023 06:39:14 GMT

GET
H3 200 m_js_controller_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame AB00 32 KB
13 KB 74ms
35ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/m_js_controller_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef7a0ea88b04cbef7ca69faf5d4102cbc7e9090c9eab157a14493c9720bf7e62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:07:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 904
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13099
x-xss-protection: 0
server: cafe
etag: 722200158015212502
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:07:35 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame AB00 2 KB
1 KB 88ms
49ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:21:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:21:41 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AB00 119 KB
36 KB 81ms
46ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36916
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648640521462251"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 04 Apr 2022 11:22:39 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame AB00 15 KB
6 KB 63ms
25ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 122
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:20:37 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/ Frame AB00 19 KB
8 KB 65ms
27ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d072a09604e6a1fea8ef42203503771aa36b63a3c91fd1059966e26e6f5812b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:19:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 188
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7871
x-xss-protection: 0
server: cafe
etag: 7397949449432438406
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:19:31 GMT

GET
DATA 200
OK truncated
/ Frame DD08 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aa33f4b5d3cb13bc8bd11502805c3768446add68dca5d6d54fe795c457b92b2b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame FF5D 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c55d8c697e74b3d7338e089170946e550f0323210925777120b5d284ec2291f4

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/4685342642732865058/ Frame DD08 25 KB
25 KB 48ms
48ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4685342642732865058/downsize_200k_v1?w=600&h=314

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b59aaa52856bba9541a1ddab168e5b814070257d1313d336d7cd287de4db4f70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 07:03:22 GMT
x-content-type-options: nosniff
age: 15557
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25701
x-xss-protection: 0
last-modified: Mon, 17 Jan 2022 09:50:53 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 04 Apr 2023 07:03:22 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v42/ Frame FF5D 28 KB
28 KB 85ms
25ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v42/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a67d07f733785876b3192826e76f537e2b9dc0be172ce52c773d30d65f712a07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 22:47:37 GMT
x-content-type-options: nosniff
age: 477302
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28328
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 21:57:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Mar 2023 22:47:37 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v42/ Frame DD08 28 KB
28 KB 105ms
50ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v42/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a67d07f733785876b3192826e76f537e2b9dc0be172ce52c773d30d65f712a07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 22:47:37 GMT
x-content-type-options: nosniff
age: 477302
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28328
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 21:57:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Mar 2023 22:47:37 GMT

GET
H3 200 3b8ZtKHcFUSYKihZpywKVICyDtFsaoLwoCuDyEZifyk.js Show response
pagead2.googlesyndication.com/bg/ Frame 67C7 35 KB
13 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3b8ZtKHcFUSYKihZpywKVICyDtFsaoLwoCuDyEZifyk.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ddbf19b4a1dc1544982a2859a72c0a5480b20ed16c6a82f0a02b83c846627f29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Sat, 02 Apr 2022 08:21:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 183651
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13770
x-xss-protection: 0
last-modified: Mon, 28 Mar 2022 10:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 02 Apr 2023 08:21:48 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame D8CD 0
0 65ms
65ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C7qaS_tRKYpSKOIK6ygWKkJLoDs-HjptcwIbZgsYCwI23ARABIABg-wGCARdjYS1wdWItNTI3MTA1MjAzMzc3NjgxMcgBCagDAaoEugFP0LQFVRBnaubiTgoQvVAdr6QDwf6GYPwGQp09GMNBRkaxqQU22HX42R3FQ1gV1c8qbjUMn5PFXo1P9skgucveLY8yXlpEj0JSNQfH26hRc_uu5xYRiVOPYJ9zUUuVmBxpoDNR-DBunCscqw3Xvf683HhAJigiG5Vh2OL_e1aOCxszGFOBGb_gVDt7Rf20rKjVhXd1RxwpjTcQcBWWHyAibYkZjTBaMTKskIMVxAvmTgGQ768-G3K2E_-ABvfsraXW59OGXqAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBABgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTUyNzEwNTIwMzM3NzY4MTEYAA&sigh=Ddb15BnuNoo&uach_m=[UACH]&cid=CAQSPACNIrLMPYSqHptimBjQEt7aQPjxvviK1M9Anp3SFmpKRzMidEWwHCsuO3qEWxWnwYbXrhmZZik4dUrB5RgB&tpd=AGWhJmvwD0F8PAwHvKQmFA-gkeyoZZEsIwYOjczzBOzM1iud-PB_RSgckGNMn8dUcJp00bSWVsjf17vdwv6K5YMZR8PIpFKSmdo67DCK9GbNDY5WuvRLZnPxkcgGb2qDwWYJ4KXCJ2MNeMCe76T0J-vShHXZHJjc8Hlwi1SX9V-6Iq_DU4tAZuNJZQwWpwpCKZ7sKhZVyEAixW95_nTezBsj_fX4JK93JdPWsleBn_H706A6Bsml3O2kvvmi6OijUt193yZxHZmB8peKYFDQD6hmui-2vNjgYvEOZif4TwhjrxQ_oYFntvLFxvGzFpEW0E0RYYoZze9gaXza3_puovUnCsVGmJ4AHzVNMHKlVxi6fWBDrLdUl6QS50Ki2bHikf9vkU9f_1d9KA3qAio0YE3qFm5zMl0O0GoNNjveW_NxO4HbEE4fw2NQO7GOOw0JwVsYS8Ei7U6Ba7cL7QID2mFH-T6K0eGw2IJCpt0yrat-VShDYTWgWflK2kU2_Qt3v7X_gDnQQFMNUMjXBvu6njKDmfmRY6aCnrp6NWghxUAZqeaHSij4upbwXcykeB86640dk1_vGK3rO9poqzEJxC4ptnG_rgHtFCf0YJppYIqD4y0iXif8qpHAxZ2ZeLz0H6GfdMl8YuIhiQfOEBnoZkWBSH9VZAsgDBxYANAZxv8UmWys0UINfMKbvhwiL-IK6rH61mgnhN_Ce8T5wH3S_3CVg3AG7J9l-ig0Gw-Z4TMD34utmDgY9itHpPc58RGG8cQJ_WxLRU7wmFbUGamxORTG0wR8MCcExvNKPWf6v9EJ7qI9wxXLaLqXI1k7G3OaA2IK-bgg-H4P4NGHC5YF8gCB8Tw81MGti2MGNzYDNvgkXqU1sS_YOa_bwilH-l8rF8G7u7hJYopHViPEMPExevFksURU6NX1EhvMJ8NwS3kGeR19LJsSaZDKnCJ_sOhqzGgt3FCYrychArVhIrtNSGAeqLDrWxcpSGIk-ebtuiEjxRh2ZIM_vGjvMhqTzHHn0QTLuYlilWMNkuCZm2QIb-6XbbThfx8DRvN0PcpGCfUGBAD78ROU1zr8tBM6N3yidsW-tA

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=90&adk=676745548&adf=3560341080&pi=t.aa~a.4080220755~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x90&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1208&idt=1&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0%2C1200x280&nras=3&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2190&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=UDbT4e1aML&p=https%3A//www.proxysite.com&dtd=15
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 04 Apr 2022 11:22:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK js Show response
tags.mathtag.com/notify/ Frame D8CD 2 KB
2 KB 81ms
32ms Script
application/x-javascript 185.29.134.249
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWlRNeU5tTmtPVEF0WlRVMU55MDFaRFZpTFRBd01EQXRNREF3TURBd01EQXdNREF3LzUxMTk5MTc2NzAyODExNzQ0NjYvNjY4NjQxMi80NjM3MjA5LzQvcGxaOFZHdWtuemlyVEtGSFMwR0hYQ0FtSDExRkpneTNPZ1NaYjltN1BFNC8xLzQvMC8wLzg5OTA3Mi8wLzIxNjUzNi82MTQ2ODAvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC81MTE5OTE3NjcwMjgxMTc0NDY2L3pyaC8wLzY1OS81NS85OTkvMjU4LzIwMDE6NDFkMDo4OjovMC4wMDAvMTY0OTA3MTM1OC8xNjQ5MDgzOTU4LzQvcHViLTUyNzEwNTIwMzM3NzY4MTEv/UemTq4MBlC0hqXe4aKGwvjHpMuo&nodeid=726&group=zrh&auctionid=5119917670281174466&shardkey=5119917670281174466&sid=4637209&cid=6686412&bp=a_adafih&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.132.24&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCniwS_tRKYpSKOIK6ygWKkJLoDs-HjptcwIbZgsYCwI23ARABIABg-wGCARdjYS1wdWItNTI3MTA1MjAzMzc3NjgxMcgBCagDAaoEvQFP0LQFVRBnaubiTgoQvVAdr6QDwf6GYPwGQp09GMNBRkaxqQU22HX42R3FQ1gV1c8qbjUMn5PFXo1P9skgucveLY8yXlpEj0JSNQfH26hRc_uu5xYRiVOPYJ9zUUuVmBxpoDNR-DBunCscqw3Xvf683HhAJigiG5Vh2OL_e1aOCxszGFOBGb_gVDt7Rf20rKjVhXd1BR4IH5us1BIbu2iJtcm2fS1OO46mvpv0ecum4fsx8YMmtesKFHLqTvmABvfsraXW59OGXqAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0gR8ncf6D-3kWBTLj5KEl5jn4Ppg%26client%3Dca-pub-5271052033776811%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=90&adk=676745548&adf=3560341080&pi=t.aa~a.4080220755~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x90&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1208&idt=1&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0%2C1200x280&nras=3&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2190&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=UDbT4e1aML&p=https%3A//www.proxysite.com&dtd=15
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.134.249 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.305.0 /
Resource Hash: b7620962cb744ae2dae99d5137906278ba4735b5dc197459df9a7f58b13e777d

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Mon, 04 Apr 2022 11:22:39 GMT
Content-Encoding: gzip
x-mm-bid-request-time: 1649071358
Last-Modified: Mon, 04 Apr 2022 11:22:38 GMT
Server: MMBD/3.305.0
x-mm-latency: 13 (2)
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg: Count
Cache-Control: no-cache
x-mm-host: cdg-router-x90, zrh-bidder-x79
Connection: close
Content-Type: application/x-javascript; charset=UTF-8
Expires: Mon, 04 Apr 2022 11:22:38 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame D8CD 2 KB
1 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=90&adk=676745548&adf=3560341080&pi=t.aa~a.4080220755~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x90&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1208&idt=1&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0%2C1200x280&nras=3&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2190&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=UDbT4e1aML&p=https%3A//www.proxysite.com&dtd=15

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:21:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:21:41 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D8CD 119 KB
36 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36916
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648640521462251"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 04 Apr 2022 11:22:39 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame D8CD 15 KB
6 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 122
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:20:37 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C456 22 KB
8 KB 24ms
24ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges: bytes
age: 18491
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Apr 2022 06:14:28 GMT
expires: Tue, 04 Apr 2023 06:14:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame AB00 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5c80ca3aed70370153b1cad499975a554e14f452f7f35adadc6330df7615f83e

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 583c04eba622323b1bc7d6fda2f57e1e.js Show response
www.gstatic.com/mysidia/ Frame 7B33 9 KB
4 KB 68ms
32ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/583c04eba622323b1bc7d6fda2f57e1e.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&adk=3625593270&adf=3099719705&pi=t.aa~a.4226026281~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1207&idt=-M&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0&nras=2&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1451&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=jqiPJSBz6z&p=https%3A//www.proxysite.com&dtd=11

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b968113e586107906911e61864086ba097b7b45cf857c0de3c4fd20963a90e61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 10:20:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 262951
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3720
x-xss-protection: 0
last-modified: Wed, 30 Mar 2022 08:22:36 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 30 Jun 2022 10:20:08 GMT

GET
H3 200 d153763d065fc486a30a5318c8635961.js Show response
www.gstatic.com/mysidia/ Frame 7B33 8 KB
4 KB 65ms
30ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d153763d065fc486a30a5318c8635961.js?tag=text/vanilla_highlight

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae3a15a3e9733515bb33d29c4820b33c0bcaf30a522fd034ea68d104939901d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 14:36:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593194
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3697
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 03:00:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 26 Jun 2022 14:36:05 GMT

GET
H3 200 00503a990ef139b9c679b68d30da2f64.js Show response
www.gstatic.com/mysidia/ Frame 7B33 14 KB
6 KB 63ms
27ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/00503a990ef139b9c679b68d30da2f64.js?tag=pingback

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03e8cab8d94137b2f39d2d432ccb7fea1bae757201413e3f1f22b1689aee232a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 10:20:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 262942
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5923
x-xss-protection: 0
last-modified: Thu, 24 Mar 2022 02:46:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 30 Jun 2022 10:20:17 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 7B33 8 KB
892 B 79ms
40ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1e046a89bb90f44dadb24f5fdfbe412b5f6d320b790f7317fad956b193234726

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 04 Apr 2022 09:37:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 04 Apr 2022 11:22:39 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 04 Apr 2022 11:22:39 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame 7B33 2 KB
904 B 25ms
24ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:05:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1030
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:05:29 GMT

GET
H3 200 a44a0b8f447061e92ca19622c4392a02.js Show response
www.gstatic.com/mysidia/ Frame 7B33 6 KB
2 KB 69ms
34ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a44a0b8f447061e92ca19622c4392a02.js?tag=analytics_pingback_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aa3777d578531c63cb5b48a28d1f0135a9769ca2ee44ae916aadb341089140e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 10:20:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 262951
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2233
x-xss-protection: 0
last-modified: Wed, 30 Mar 2022 08:22:36 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 30 Jun 2022 10:20:08 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/ Frame 7B33 19 KB
8 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d072a09604e6a1fea8ef42203503771aa36b63a3c91fd1059966e26e6f5812b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:19:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 188
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7871
x-xss-protection: 0
server: cafe
etag: 7397949449432438406
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:19:31 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame 7B33 2 KB
1 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:21:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:21:41 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7B33 119 KB
36 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36916
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648640521462251"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 04 Apr 2022 11:22:39 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame 7B33 15 KB
6 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 122
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 11:20:37 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 7B33 0
0 92ms
33ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ0hXdNeb7imUvXfOAAeV1WhKWUslDBb17LQJV1tZmI0c579FD8uvK3_uRle3UvR4ZT3WoWr6yIOBuuAVuTCustseP_Ww
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&adk=3625593270&adf=3099719705&pi=t.aa~a.4226026281~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1207&idt=-M&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0&nras=2&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1451&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=jqiPJSBz6z&p=https%3A//www.proxysite.com&dtd=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

GET
H3 200 dfa9fdc9b45632ba17ba59fe64d4dcb5.js Show response
www.gstatic.com/mysidia/ Frame 7B33 29 KB
12 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/dfa9fdc9b45632ba17ba59fe64d4dcb5.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aa0992b4e17a3324d53313c014452f8636a4c6b1b84d3187886c386140911535

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 10:20:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 262951
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12015
x-xss-protection: 0
last-modified: Tue, 29 Mar 2022 18:36:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 30 Jun 2022 10:20:08 GMT

GET
H3 200 3b8ZtKHcFUSYKihZpywKVICyDtFsaoLwoCuDyEZifyk.js Show response
pagead2.googlesyndication.com/bg/ Frame B762 35 KB
13 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3b8ZtKHcFUSYKihZpywKVICyDtFsaoLwoCuDyEZifyk.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ddbf19b4a1dc1544982a2859a72c0a5480b20ed16c6a82f0a02b83c846627f29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Sat, 02 Apr 2022 08:21:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 183651
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13770
x-xss-protection: 0
last-modified: Mon, 28 Mar 2022 10:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 02 Apr 2023 08:21:48 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 4 KB
1 KB 60ms
24ms Document
text/html 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ae1974962edfb6f6403064694c491c5b313a838f18fb89dc141716f0d9539d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 341337
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1376
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 31 Mar 2022 12:33:42 GMT
expires: Fri, 31 Mar 2023 12:33:42 GMT
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H/1.1 200
OK 7wi7goi91r22 Show response
hal9000.redintelligence.net/zone/ Frame D8CD 11 KB
4 KB 88ms
27ms Script
text/html 88.99.165.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/7wi7goi91r22?subid=&rnd=5119917670281174466&extVar[]=DOUBLEBORDER:1&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYkrU_gAOvccKspoOwQnVBA%26exch_seat%3D20035004448%26mt_aid%3D5119917670281174466%26mt_id%3D6686412%26mt_adid%3D216536%26mt_sid%3D4637209%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_cid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCniwS_tRKYpSKOIK6ygWKkJLoDs-HjptcwIbZgsYCwI23ARABIABg-wGCARdjYS1wdWItNTI3MTA1MjAzMzc3NjgxMcgBCagDAaoEvQFP0LQFVRBnaubiTgoQvVAdr6QDwf6GYPwGQp09GMNBRkaxqQU22HX42R3FQ1gV1c8qbjUMn5PFXo1P9skgucveLY8yXlpEj0JSNQfH26hRc_uu5xYRiVOPYJ9zUUuVmBxpoDNR-DBunCscqw3Xvf683HhAJigiG5Vh2OL_e1aOCxszGFOBGb_gVDt7Rf20rKjVhXd1BR4IH5us1BIbu2iJtcm2fS1OO46mvpv0ecum4fsx8YMmtesKFHLqTvmABvfsraXW59OGXqAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0gR8ncf6D-3kWBTLj5KEl5jn4Ppg%2526client%253Dca-pub-5271052033776811%2526adurl%253D%26redirect%3D
Requested by: Host: www.proxysite.com
URL: https://www.proxysite.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.165.19 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.19.165.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 506b65c7212c48cb6e7f38ce5a4ffacfe0ac9509f1c7f7e2f60b47f6b135cd40

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Mon, 04 Apr 2022 11:22:39 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3415
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ck-confirm
tags.mathtag.com/ Frame D8CD 49 B
329 B 84ms
43ms Image
image/gif 185.29.134.249
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/ck-confirm?bid_id=5119917670281174466&node_id=726&exch_id=4
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWlRNeU5tTmtPVEF0WlRVMU55MDFaRFZpTFRBd01EQXRNREF3TURBd01EQXdNREF3LzUxMTk5MTc2NzAyODExNzQ0NjYvNjY4NjQxMi80NjM3MjA5LzQvcGxaOFZHdWtuemlyVEtGSFMwR0hYQ0FtSDExRkpneTNPZ1NaYjltN1BFNC8xLzQvMC8wLzg5OTA3Mi8wLzIxNjUzNi82MTQ2ODAvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC81MTE5OTE3NjcwMjgxMTc0NDY2L3pyaC8wLzY1OS81NS85OTkvMjU4LzIwMDE6NDFkMDo4OjovMC4wMDAvMTY0OTA3MTM1OC8xNjQ5MDgzOTU4LzQvcHViLTUyNzEwNTIwMzM3NzY4MTEv/UemTq4MBlC0hqXe4aKGwvjHpMuo&nodeid=726&group=zrh&auctionid=5119917670281174466&shardkey=5119917670281174466&sid=4637209&cid=6686412&bp=a_adafih&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.132.24&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCniwS_tRKYpSKOIK6ygWKkJLoDs-HjptcwIbZgsYCwI23ARABIABg-wGCARdjYS1wdWItNTI3MTA1MjAzMzc3NjgxMcgBCagDAaoEvQFP0LQFVRBnaubiTgoQvVAdr6QDwf6GYPwGQp09GMNBRkaxqQU22HX42R3FQ1gV1c8qbjUMn5PFXo1P9skgucveLY8yXlpEj0JSNQfH26hRc_uu5xYRiVOPYJ9zUUuVmBxpoDNR-DBunCscqw3Xvf683HhAJigiG5Vh2OL_e1aOCxszGFOBGb_gVDt7Rf20rKjVhXd1BR4IH5us1BIbu2iJtcm2fS1OO46mvpv0ecum4fsx8YMmtesKFHLqTvmABvfsraXW59OGXqAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0gR8ncf6D-3kWBTLj5KEl5jn4Ppg%26client%3Dca-pub-5271052033776811%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.134.249 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.305.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Mon, 04 Apr 2022 11:22:39 GMT
Server: MMBD/3.305.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: cdg-router-x96, zrh-bidder-x79
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Mon, 04 Apr 2022 11:22:38 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/event/ Frame D8CD 43 B
405 B 104ms
36ms Image
image/gif 23.35.228.210
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=5119917670281174466&v3=614680&v4=4637209&v5=6686412&mt_nsync=1&no_attr=1
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWlRNeU5tTmtPVEF0WlRVMU55MDFaRFZpTFRBd01EQXRNREF3TURBd01EQXdNREF3LzUxMTk5MTc2NzAyODExNzQ0NjYvNjY4NjQxMi80NjM3MjA5LzQvcGxaOFZHdWtuemlyVEtGSFMwR0hYQ0FtSDExRkpneTNPZ1NaYjltN1BFNC8xLzQvMC8wLzg5OTA3Mi8wLzIxNjUzNi82MTQ2ODAvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC81MTE5OTE3NjcwMjgxMTc0NDY2L3pyaC8wLzY1OS81NS85OTkvMjU4LzIwMDE6NDFkMDo4OjovMC4wMDAvMTY0OTA3MTM1OC8xNjQ5MDgzOTU4LzQvcHViLTUyNzEwNTIwMzM3NzY4MTEv/UemTq4MBlC0hqXe4aKGwvjHpMuo&nodeid=726&group=zrh&auctionid=5119917670281174466&shardkey=5119917670281174466&sid=4637209&cid=6686412&bp=a_adafih&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.132.24&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCniwS_tRKYpSKOIK6ygWKkJLoDs-HjptcwIbZgsYCwI23ARABIABg-wGCARdjYS1wdWItNTI3MTA1MjAzMzc3NjgxMcgBCagDAaoEvQFP0LQFVRBnaubiTgoQvVAdr6QDwf6GYPwGQp09GMNBRkaxqQU22HX42R3FQ1gV1c8qbjUMn5PFXo1P9skgucveLY8yXlpEj0JSNQfH26hRc_uu5xYRiVOPYJ9zUUuVmBxpoDNR-DBunCscqw3Xvf683HhAJigiG5Vh2OL_e1aOCxszGFOBGb_gVDt7Rf20rKjVhXd1BR4IH5us1BIbu2iJtcm2fS1OO46mvpv0ecum4fsx8YMmtesKFHLqTvmABvfsraXW59OGXqAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0gR8ncf6D-3kWBTLj5KEl5jn4Ppg%26client%3Dca-pub-5271052033776811%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.228.210 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-228-210.deploy.static.akamaitechnologies.com
Software: MT3 4320 2f2dfe5 master cdg-pixel-x31 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Mon, 04 Apr 2022 11:22:39 GMT
Server: MT3 4320 2f2dfe5 master cdg-pixel-x31 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 04 Apr 2022 11:22:38 GMT

GET
H/1.1 200
OK img
tags.mathtag.com/event/ Frame D8CD 49 B
329 B 82ms
41ms Image
image/gif 185.29.134.249
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=5119917670281174466&st=4637209&time=1649071359&nodeid=726
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWlRNeU5tTmtPVEF0WlRVMU55MDFaRFZpTFRBd01EQXRNREF3TURBd01EQXdNREF3LzUxMTk5MTc2NzAyODExNzQ0NjYvNjY4NjQxMi80NjM3MjA5LzQvcGxaOFZHdWtuemlyVEtGSFMwR0hYQ0FtSDExRkpneTNPZ1NaYjltN1BFNC8xLzQvMC8wLzg5OTA3Mi8wLzIxNjUzNi82MTQ2ODAvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC81MTE5OTE3NjcwMjgxMTc0NDY2L3pyaC8wLzY1OS81NS85OTkvMjU4LzIwMDE6NDFkMDo4OjovMC4wMDAvMTY0OTA3MTM1OC8xNjQ5MDgzOTU4LzQvcHViLTUyNzEwNTIwMzM3NzY4MTEv/UemTq4MBlC0hqXe4aKGwvjHpMuo&nodeid=726&group=zrh&auctionid=5119917670281174466&shardkey=5119917670281174466&sid=4637209&cid=6686412&bp=a_adafih&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.132.24&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCniwS_tRKYpSKOIK6ygWKkJLoDs-HjptcwIbZgsYCwI23ARABIABg-wGCARdjYS1wdWItNTI3MTA1MjAzMzc3NjgxMcgBCagDAaoEvQFP0LQFVRBnaubiTgoQvVAdr6QDwf6GYPwGQp09GMNBRkaxqQU22HX42R3FQ1gV1c8qbjUMn5PFXo1P9skgucveLY8yXlpEj0JSNQfH26hRc_uu5xYRiVOPYJ9zUUuVmBxpoDNR-DBunCscqw3Xvf683HhAJigiG5Vh2OL_e1aOCxszGFOBGb_gVDt7Rf20rKjVhXd1BR4IH5us1BIbu2iJtcm2fS1OO46mvpv0ecum4fsx8YMmtesKFHLqTvmABvfsraXW59OGXqAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0gR8ncf6D-3kWBTLj5KEl5jn4Ppg%26client%3Dca-pub-5271052033776811%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.134.249 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.305.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Mon, 04 Apr 2022 11:22:39 GMT
Server: MMBD/3.305.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: cdg-router-x42, zrh-bidder-x79
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Mon, 04 Apr 2022 11:22:38 GMT

GET
H3 200 3b8ZtKHcFUSYKihZpywKVICyDtFsaoLwoCuDyEZifyk.js Show response
pagead2.googlesyndication.com/bg/ Frame C456 35 KB
13 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3b8ZtKHcFUSYKihZpywKVICyDtFsaoLwoCuDyEZifyk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ddbf19b4a1dc1544982a2859a72c0a5480b20ed16c6a82f0a02b83c846627f29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Sat, 02 Apr 2022 08:21:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 183651
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13770
x-xss-protection: 0
last-modified: Mon, 28 Mar 2022 10:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 02 Apr 2023 08:21:48 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7B33 0
20 B 57ms
57ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/00503a990ef139b9c679b68d30da2f64.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7B33 0
0 66ms
66ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CmV2I_tRKYvvrN5H3ywXukpSgBbyP7vFn59Sox-cOmJL4h7MCEAEggfOTKWD7AaABxZGMlALIAQGoAwHIA8sEqgTKAU_QE9Txek0EcPQXGmLEcHBEu_b9dlomCWpSwZ3UrK9CpGAcpjXm674ufx6TEVb1RMf5iYltM9_odtpwcGSKXy8B6GomS2AsQLuVnxick_WNUU0Xsq9R9L2qRlZ3mpzb9Qg_0oMszS8TA_uanrPyZLrooxPVQjg2AE0-Rsjz79FgnL6CD0u3Md9CBT0k5_ZuN14PIrrjeuWVKzbN5k32VLXKaR0c8NPbU254jK3OANgazZYs5wpcietw_nEho5rRaljyNUVUPsR2v1nABJLy9by8A5IFBAgEGAGSBQQIBRgEgAej7vPrAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEENi9AdIICQiA4YAQEAEYH4AKAcgLAdgTDNAVAZgWAYAXAbIXHAoaCAASFHB1Yi01MjcxMDUyMDMzNzc2ODExGAA&sigh=w-9aBRKVm8E&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&adk=3625593270&adf=3099719705&pi=t.aa~a.4226026281~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1207&idt=-M&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0&nras=2&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1451&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=jqiPJSBz6z&p=https%3A//www.proxysite.com&dtd=11
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 04 Apr 2022 11:22:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BB63 143 B
163 B 26ms
24ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&adk=3625593270&adf=3099719705&pi=t.aa~a.4226026281~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1207&idt=-M&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0&nras=2&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1451&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=jqiPJSBz6z&p=https%3A//www.proxysite.com&dtd=11
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

age: 1026
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Mon, 04 Apr 2022 11:05:33 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8E82 1 KB
749 B 26ms
25ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

age: 78987
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 03 Apr 2022 13:26:12 GMT
etag: 48472445140208031
expires: Mon, 04 Apr 2022 13:26:12 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 8CF5 60 KB
24 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 04 Apr 2022 11:22:39 GMT

GET
H3 200 banner.min.js Show response
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 18 KB
7 KB 26ms
25ms Script
application/x-javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/banner.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

623ec414722939f3fa6c37d93e8111e2fbc5752d6365d3b155af960e347bc6b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 12:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 429729
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6747
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 12:00:30 GMT

GET
DATA 200
OK truncated
/ Frame 7B33 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1e5a5025b6049c1e87ce7e9efec1476f9b58bc36327cc505ae31fe2d325c38f

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

request.php Show response
hal900020.redintelligence.net/ Frame D8CD
Redirect Chain

https://hal900020.redintelligence.net/request.php?zone=7wi7goi91r22&nw=20&renderingType=javascript&namespace=96038b2df3&subid=&uid=c7d5bc3d8b964b25&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900020.redintelligence.net/request.php?zone=7wi7goi91r22&nw=20&renderingType=javascript&namespace=96038b2df3&subid=&uid=c7d5bc3d8b964b25&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

2 KB
1 KB

154ms
100ms

Script
application/x-javascript

178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/request.php?zone=7wi7goi91r22&nw=20&renderingType=javascript&namespace=96038b2df3&subid=&uid=c7d5bc3d8b964b25&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYkrU_gAOvccKspoOwQnVBA%26exch_seat%3D20035004448%26mt_aid%3D5119917670281174466%26mt_id%3D6686412%26mt_adid%3D216536%26mt_sid%3D4637209%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_cid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCniwS_tRKYpSKOIK6ygWKkJLoDs-HjptcwIbZgsYCwI23ARABIABg-wGCARdjYS1wdWItNTI3MTA1MjAzMzc3NjgxMcgBCagDAaoEvQFP0LQFVRBnaubiTgoQvVAdr6QDwf6GYPwGQp09GMNBRkaxqQU22HX42R3FQ1gV1c8qbjUMn5PFXo1P9skgucveLY8yXlpEj0JSNQfH26hRc_uu5xYRiVOPYJ9zUUuVmBxpoDNR-DBunCscqw3Xvf683HhAJigiG5Vh2OL_e1aOCxszGFOBGb_gVDt7Rf20rKjVhXd1BR4IH5us1BIbu2iJtcm2fS1OO46mvpv0ecum4fsx8YMmtesKFHLqTvmABvfsraXW59OGXqAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0gR8ncf6D-3kWBTLj5KEl5jn4Ppg%2526client%253Dca-pub-5271052033776811%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-5271052033776811%26output%3Dhtml%26h%3D90%26adk%3D676745548%26adf%3D3560341080%26pi%3Dt.aa~a.4080220755~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1649071358%26rafmt%3D1%26to%3Dqs%26pwprc%3D8717720231%26psa%3D1%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fwww.proxysite.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1649071358857%26bpp%3D1%26bdt%3D1208%26idt%3D1%26shv%3Dr20220330%26mjsv%3Dm202203300101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Dcbe40aec1e6cb566-221c24636dcd00cb%253AT%253D1649071358%253ART%253D1649071358%253AS%253DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw%26prev_fmts%3D990x280%252C990x280%252C728x90%252C0x0%252C1200x280%26nras%3D3%26correlator%3D4393995530453%26frm%3D20%26pv%3D1%26ga_vid%3D1121233293.1649071358%26ga_sid%3D1649071358%26ga_hid%3D1097591842%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D2190%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759837%252C31065371%252C31066008%252C31066017%26oid%3D2%26pvsid%3D3516295011854182%26pem%3D991%26tmod%3D1327873000%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D6%26uci%3Da!6%26btvi%3D3%26fsb%3D1%26xpc%3DUDbT4e1aML%26p%3Dhttps%253A%2F%2Fwww.proxysite.com%26dtd%3D15&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.proxysite.com&random=5949315884309&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=90&adk=676745548&adf=3560341080&pi=t.aa~a.4080220755~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x90&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1208&idt=1&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0%2C1200x280&nras=3&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2190&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=UDbT4e1aML&p=https%3A//www.proxysite.com&dtd=15
Protocol: HTTP/1.1
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: 02ecb150b79f205c9cfc0c834ee441eaa7cb0871cc5aaad16924d9bcbd6a3e0a

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 04 Apr 2022 11:22:39 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 23029100101079600973094011919020
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 773
Expires: Mon, 04 Apr 2022 12:22:39 +0200

Redirect headers

Pragma: no-cache
Date: Mon, 04 Apr 2022 11:22:39 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=7wi7goi91r22&nw=20&renderingType=javascript&namespace=96038b2df3&subid=&uid=c7d5bc3d8b964b25&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYkrU_gAOvccKspoOwQnVBA%26exch_seat%3D20035004448%26mt_aid%3D5119917670281174466%26mt_id%3D6686412%26mt_adid%3D216536%26mt_sid%3D4637209%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_cid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCniwS_tRKYpSKOIK6ygWKkJLoDs-HjptcwIbZgsYCwI23ARABIABg-wGCARdjYS1wdWItNTI3MTA1MjAzMzc3NjgxMcgBCagDAaoEvQFP0LQFVRBnaubiTgoQvVAdr6QDwf6GYPwGQp09GMNBRkaxqQU22HX42R3FQ1gV1c8qbjUMn5PFXo1P9skgucveLY8yXlpEj0JSNQfH26hRc_uu5xYRiVOPYJ9zUUuVmBxpoDNR-DBunCscqw3Xvf683HhAJigiG5Vh2OL_e1aOCxszGFOBGb_gVDt7Rf20rKjVhXd1BR4IH5us1BIbu2iJtcm2fS1OO46mvpv0ecum4fsx8YMmtesKFHLqTvmABvfsraXW59OGXqAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0gR8ncf6D-3kWBTLj5KEl5jn4Ppg%2526client%253Dca-pub-5271052033776811%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-5271052033776811%26output%3Dhtml%26h%3D90%26adk%3D676745548%26adf%3D3560341080%26pi%3Dt.aa~a.4080220755~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1649071358%26rafmt%3D1%26to%3Dqs%26pwprc%3D8717720231%26psa%3D1%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fwww.proxysite.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1649071358857%26bpp%3D1%26bdt%3D1208%26idt%3D1%26shv%3Dr20220330%26mjsv%3Dm202203300101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Dcbe40aec1e6cb566-221c24636dcd00cb%253AT%253D1649071358%253ART%253D1649071358%253AS%253DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw%26prev_fmts%3D990x280%252C990x280%252C728x90%252C0x0%252C1200x280%26nras%3D3%26correlator%3D4393995530453%26frm%3D20%26pv%3D1%26ga_vid%3D1121233293.1649071358%26ga_sid%3D1649071358%26ga_hid%3D1097591842%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D2190%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759837%252C31065371%252C31066008%252C31066017%26oid%3D2%26pvsid%3D3516295011854182%26pem%3D991%26tmod%3D1327873000%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D6%26uci%3Da!6%26btvi%3D3%26fsb%3D1%26xpc%3DUDbT4e1aML%26p%3Dhttps%253A%2F%2Fwww.proxysite.com%26dtd%3D15&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.proxysite.com&random=5949315884309&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Mon, 04 Apr 2022 12:22:39 +0200

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v42/ Frame 7B33 28 KB
28 KB 61ms
25ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v42/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a67d07f733785876b3192826e76f537e2b9dc0be172ce52c773d30d65f712a07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 22:47:37 GMT
x-content-type-options: nosniff
age: 477302
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28328
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 21:57:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Mar 2023 22:47:37 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 8E82 35 B
465 B 83ms
25ms Image
image/gif 2620:116:800d:21:fcb8:22d2:d390:5f1b
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEIgpnhr1IfQWiajuJU-EJC0&google_cver=1&google_push=AYg5qPLwf-fWq7KO1AZ5TU2YYnsBBUYrFe8pa6Y0q7pgb9lSoEDd8ZvKJDLqHYenuUFqVL48N1Cdaod-17e_zWnIUAjA5zkR1ztZ

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:fcb8:22d2:d390:5f1b , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8E82
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKQ4Fti...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKQ4Fti...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA0MDQxMTIyMzkwMDA1MzM4NjE1NDg5MQ%3D%3D&google_push=AYg5qPKQ4FtihhFnnU0jXEOt2JMpMxVgLJElZvjK3I1TApMZXTYS2A9ckB9kCkYE5ta8mN...

170 B
188 B

37ms
37ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA0MDQxMTIyMzkwMDA1MzM4NjE1NDg5MQ%3D%3D&google_push=AYg5qPKQ4FtihhFnnU0jXEOt2JMpMxVgLJElZvjK3I1TApMZXTYS2A9ckB9kCkYE5ta8mNocdR0W6Qj9ZH87a6m6EoPf9pYjoG1g

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA0MDQxMTIyMzkwMDA1MzM4NjE1NDg5MQ%3D%3D&google_push=AYg5qPKQ4FtihhFnnU0jXEOt2JMpMxVgLJElZvjK3I1TApMZXTYS2A9ckB9kCkYE5ta8mNocdR0W6Qj9ZH87a6m6EoPf9pYjoG1g
pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 04 Apr 2022 11:22:39 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 8E82 43 B
351 B 79ms
33ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEJpHXx2wC8qshpjIYHd8ymw&google_cver=1&google_push=AYg5qPLYN2JIIHBT-IQARKgeo_3E5qRsmYUmcP8qLjJokr3HjjGJpqBVbSTYTA3e_LTHCSq03YQ8B6of0g36QUoV8BKMUBaLZ-sl
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&adk=3625593270&adf=3099719705&pi=t.aa~a.4226026281~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1207&idt=-M&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0&nras=2&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1451&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=jqiPJSBz6z&p=https%3A//www.proxysite.com&dtd=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:38 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: o7rm5bdcjudg9ot14nl1dmmppcbj05im

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8E82
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=6CczbhWQTYOUq4elQ0n9pQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

71ms
34ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=6CczbhWQTYOUq4elQ0n9pQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJtuZgYsX-qFgp7tyBDWI7gVhFHB6lmI6erS8MNAoCZP9WP3UvBKP2k_CIqLZ_SU-WhY3ZOtDp_SWQ4mQmA6C8rVB4lU0r1

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=6CczbhWQTYOUq4elQ0n9pQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJtuZgYsX-qFgp7tyBDWI7gVhFHB6lmI6erS8MNAoCZP9WP3UvBKP2k_CIqLZ_SU-WhY3ZOtDp_SWQ4mQmA6C8rVB4lU0r1
date: Mon, 04 Apr 2022 11:22:38 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8E82
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEOZkCp50_FStrwHZesNFWdo&google_cver=1&google_push=AYg5qPKsWXN_dhyLiI6Y_vweTfAaCCulOzLDqSy2qalYfJFpIf47wvH7upQZLYtNVN2XaPw3eUC...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLTUlDS1YtOS1WVlY=&google_push=AYg5qPKsWXN_dhyLiI6Y_vweTfAaCCulOzLDqSy2qalYfJFpIf47wvH7upQZLYtNVN2XaPw3eUCO7g0XZmpcUlA7JrWVOnWAZTwA

170 B
188 B

62ms
35ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLTUlDS1YtOS1WVlY=&google_push=AYg5qPKsWXN_dhyLiI6Y_vweTfAaCCulOzLDqSy2qalYfJFpIf47wvH7upQZLYtNVN2XaPw3eUCO7g0XZmpcUlA7JrWVOnWAZTwA

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLTUlDS1YtOS1WVlY=&google_push=AYg5qPKsWXN_dhyLiI6Y_vweTfAaCCulOzLDqSy2qalYfJFpIf47wvH7upQZLYtNVN2XaPw3eUCO7g0XZmpcUlA7JrWVOnWAZTwA
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 8E82
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48J...

0
0

GET googleredir
googlecm.hit.gemius.pl/ Frame 8E82 0
0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 8E82 0
232 B 121ms
32ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JOPQgNZbOxEtpwdWj-SnqOG5w37TMRnYX3O22E3BEJaJ8gxM50dPCtOPgnbhCJM_IF8wPO8A

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:39 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BB63
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

133ms
131ms

Document
text/html

2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 04 Apr 2022 11:22:39 GMT
expires: Mon, 04 Apr 2022 11:22:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 04 Apr 2022 11:22:39 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 fish_tank.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 25 KB
25 KB 34ms
33ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/fish_tank.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1dd5ecae9df18746501b8c7b80b016f6f2423a97ec08a7e434b5522611e1e505

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 10:14:53 GMT
x-content-type-options: nosniff
age: 522466
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25531
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Mar 2023 10:14:53 GMT

GET
H3 200 cucumbers.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 25 KB
25 KB 27ms
26ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/cucumbers.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3534be33b54b49c97653e877278aa16425446e70276d889cdc6ec02b4bc52a63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 21:24:32 GMT
x-content-type-options: nosniff
age: 568687
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25357
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Mar 2023 21:24:32 GMT

GET
H3 200 hammock.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 21 KB
22 KB 51ms
50ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/hammock.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9176fe9d940de10858d8c3b935f6dd889dc2151cb27f894863a70675fd2c1dfb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 04:14:24 GMT
x-content-type-options: nosniff
age: 457695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21991
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 04:14:24 GMT

GET
H3 200 sundae.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 23 KB
23 KB 41ms
40ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/sundae.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95f0b234c552063c85406d5fc0b308ecea3651445742b446edf134fe783fffa9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 10:14:53 GMT
x-content-type-options: nosniff
age: 522466
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23251
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Mar 2023 10:14:53 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 2 KB
2 KB 67ms
66ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/logo.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9a455034ac38913326ae9786e02c8d48b2fd55a7ac3d4fc605131b0d1c1ffbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 04:14:24 GMT
x-content-type-options: nosniff
age: 457695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1970
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 04:14:24 GMT

GET
H3 200 img_1.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 7 KB
7 KB 63ms
61ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/img_1.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf92f433f079bd95dc306ba8b7a5c49ddf33398c9b625e1921c13e674b5847c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 04:14:24 GMT
x-content-type-options: nosniff
age: 457695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7244
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 04:14:24 GMT

GET
H3 200 txt_1_5.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 5 KB
5 KB 64ms
62ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_1_5.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0048bc4b9d79753b9482ad7a42c11e8b6659183ee4eee2c4076cbe38c4e5f8d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 04:14:24 GMT
x-content-type-options: nosniff
age: 457695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4932
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 04:14:24 GMT

GET
H3 200 txt_1_4.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 3 KB
3 KB 61ms
59ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_1_4.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a24ed2b5a55ee6fb3dbaf6ef9840c306c4189fbd331649ec5b3cc044e092c51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 21:03:56 GMT
x-content-type-options: nosniff
age: 224323
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3144
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 01 Apr 2023 21:03:56 GMT

GET
H3 200 txt_1_3.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 2 KB
2 KB 66ms
64ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_1_3.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bbbca3bfd4fb515bc9b76ec7bac00902b0e183a29171df5ad78247430005e2b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 04:14:24 GMT
x-content-type-options: nosniff
age: 457695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2045
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 04:14:24 GMT

GET
H3 200 txt_1_2.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 5 KB
5 KB 78ms
76ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_1_2.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

439fff339c928c72fc2df8976ef1ded1fa7cc10ea48f4a3b259097abfba7ada3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 21:24:32 GMT
x-content-type-options: nosniff
age: 568687
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4919
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Mar 2023 21:24:32 GMT

GET
H3 200 txt_1_1.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 4 KB
4 KB 77ms
75ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_1_1.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0819f5d63c8ef0aa4380e987ec22fba4b33604c839f618315e4e747ff696bf81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 16:09:29 GMT
x-content-type-options: nosniff
age: 241990
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4375
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 01 Apr 2023 16:09:29 GMT

GET
H3 200 txt_3_1.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 5 KB
5 KB 78ms
76ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_3_1.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77fdbe39bb4311bbac32d8bb00e8d6d8d75de1d300d702ac66986d93d37cef74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 13:51:12 GMT
x-content-type-options: nosniff
age: 423087
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4783
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 13:51:12 GMT

GET
H3 200 txt_3_0.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 6 KB
6 KB 71ms
70ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_3_0.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

950064119c9c942a192669307b34181e9fec144a423dbb56404b6699d7dcd58a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Sun, 03 Apr 2022 20:28:52 GMT
x-content-type-options: nosniff
age: 53627
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6327
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Apr 2023 20:28:52 GMT

GET
H3 200 img_4_2.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 12 KB
12 KB 66ms
65ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/img_4_2.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3dbb015af6589a50e8521c55a36185c3c44e812fa49fd2b0ad76962b78f18c32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 04:14:24 GMT
x-content-type-options: nosniff
age: 457695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12101
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 04:14:24 GMT

GET
H3 200 txt_4_2.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 2 KB
3 KB 77ms
75ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_4_2.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fddeaef3163f57fc498b4de9db798b82b281d56f657c3dc40cd57dd69c8c1060

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 21:03:56 GMT
x-content-type-options: nosniff
age: 224323
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2543
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 01 Apr 2023 21:03:56 GMT

GET
H3 200 txt_4_1.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 4 KB
4 KB 76ms
75ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_4_1.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77c7724a4aa759f9949809322fcaae30079c5a19ef8b25010aea10744d7e18ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 21:24:32 GMT
x-content-type-options: nosniff
age: 568687
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4557
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Mar 2023 21:24:32 GMT

GET
H3 200 img_4_1.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 9 KB
9 KB 68ms
67ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/img_4_1.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

429903e376843b5817cfa4c5a804dd8c5b986a7f1baa3f3ba4218fc8ac36c155

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 12:00:30 GMT
x-content-type-options: nosniff
age: 429729
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9260
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 12:00:30 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7B33 0
20 B 62ms
61ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoYCAEqFGJhbm5lci1sYXJnZS12YW5pbGxhCgoIAioGc2VydmVyCiMIBCofbG9hZF9pbWFnZV9wbCxteXNpZGlhX2FuYWx5dGljcwoNEAohAAAAAJqZGUAwBAoNEA0hAAAAAAAAAAAwBAoOEB4qCDEyMDB4MjgwMAQKDhAZKggxMjAweDI4MDAECg0QDiEAAAAAAAAAADAECg0QBCEAAADMzNR9QDAECg0QDyEAAAAAAAAAADAECg0QKyEAAAAAAAA_QDAECg0QBSEAAACcmdl9QDAECg0QECEAAAAAwFHhQDAECg0QESEAAAAAAA_NQDAECg0QEiEAAAAAAAAUQDAECg0QEyEAAAAAAAAIQDAECg0QFyEAAAAAAFB_QDAEEhpDUHZpdXNTbC12WUNGWkg3c2dvZGJna0ZWQSIWdGV4dC92YW5pbGxhX2hpZ2hsaWdodCgV

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/00503a990ef139b9c679b68d30da2f64.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C456 0
20 B 62ms
61ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BDNob_tRKYvKqHrWtrATt2KPICgAAAAA4AeAEAg&bg=!X1ylXBjNAAZku-1yRLs7ACkAdvg8WmoVcDWuoW7rMZwTcvnucFlVah63VgFJL4wnWzNZQ1P5YYzSVQIAAACPUgAAAAFoAQeZAwsZikuvNwZoJZc3vbL2mzoBMA9MXdyz8vjTQ2cYEAK5jmAa34KGP7AmAXF07qApHBbhtHlySo3UF1FQVLRtsFa-IDiAPj3C6vj5RU2sRxTvVXEqHb4DgPaT1TfPPdMc7tORaM5yn1l8xZu5xosWz1qDUCvHslHoRd3mYbNBP2pjJ6KsPxnHWiQoBlI9k_yzYcbo-bG29cPn9UX-MNJ4B5gc5-x23ga47EPF20ZVGoVliO_-0_F-oKvlyX_PfOo2nujW5j0Bv1SnAbCV8AeNGz_pnyb21X0muhCzzNsL6UgNONpBcH7NdERpbrhv_08n8AYxrSLBClJYXocE1n2aMvC13inOSBD7NkB2xdWxy7YBL3b9mjjk3VVzslwsGsw44ZVILXW0-dRKeFt3dV1wKVpLGMmsKj-PPJDofjS1qgbk2Aa4wTmRLB-CEh2nQX4V6lmkxlH95Rtfs9XhRKf4mSgnU3p1f9P8cxvMLmHIMUMJLleuondwJc0RaMaxI1qC61xuUVtZXX5xSFZ6XWayo9KrGTVYvPV2S4iwrIKI45bOKGR7QEycJTqqVBqtBzmLPO5d04E6Oqqn0BS9Z9JEq1CnMGu9t_7AryYt4Tx5141GjYQZVKYrLCvWIwc06Ftodq4zu2SFGXudy5pNzjti_KB_yjvps6rsTYg3tbx36rP_7Z_KnR2jJ2r7uiam2u-JMhtTVKVCzzwLn3NBJRMYr2tiPoGjjC53t4AjlN1dn4MkUgS5wHY0PuM1tLcL0g6fkOkXavqQ2OsguaHeHbDbVglSEm7w6VT8SaJNR-JDvBzwP-E73yuMVDnRRXml7qCrJx2pVb0-2QjnGeYVRJovBlTpGVKd1JokdL0PQL95ywN5bkHupKEmtol0ePFzkYLZylK9Nq1tRPV3zSryDxFBGGzBiyioGt9cNVQTNpTauOf9e0xyNNVvqSuRne1Q2oC2HwcqQuXX7czb4_GdzXoYjmUH-iM7XfnAYNk5XY0StHNdvPEHtb1Tg6zseZ1aHA-TovArqTcKKjD1ooaBsQ

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 img_1.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 7 KB
7 KB 24ms
24ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/img_1.jpg

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf92f433f079bd95dc306ba8b7a5c49ddf33398c9b625e1921c13e674b5847c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 04:14:24 GMT
x-content-type-options: nosniff
age: 457695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7244
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 04:14:24 GMT

GET
H3 200 txt_1_5.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 5 KB
5 KB 24ms
24ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_1_5.png

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0048bc4b9d79753b9482ad7a42c11e8b6659183ee4eee2c4076cbe38c4e5f8d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 04:14:24 GMT
x-content-type-options: nosniff
age: 457695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4932
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 04:14:24 GMT

GET
H3 200 txt_1_4.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 3 KB
3 KB 24ms
24ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_1_4.png

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a24ed2b5a55ee6fb3dbaf6ef9840c306c4189fbd331649ec5b3cc044e092c51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 21:03:56 GMT
x-content-type-options: nosniff
age: 224323
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3144
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 01 Apr 2023 21:03:56 GMT

GET
H3 200 txt_1_3.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 2 KB
2 KB 24ms
24ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_1_3.png

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bbbca3bfd4fb515bc9b76ec7bac00902b0e183a29171df5ad78247430005e2b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 04:14:24 GMT
x-content-type-options: nosniff
age: 457695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2045
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 04:14:24 GMT

GET
H3 200 txt_1_2.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 5 KB
5 KB 25ms
24ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_1_2.png

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

439fff339c928c72fc2df8976ef1ded1fa7cc10ea48f4a3b259097abfba7ada3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 21:24:32 GMT
x-content-type-options: nosniff
age: 568687
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4919
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Mar 2023 21:24:32 GMT

GET
H3 200 txt_1_1.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 4 KB
4 KB 25ms
24ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_1_1.png

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0819f5d63c8ef0aa4380e987ec22fba4b33604c839f618315e4e747ff696bf81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 16:09:29 GMT
x-content-type-options: nosniff
age: 241990
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4375
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 01 Apr 2023 16:09:29 GMT

GET
H3 200 fish_tank.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 25 KB
25 KB 25ms
25ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/fish_tank.jpg

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1dd5ecae9df18746501b8c7b80b016f6f2423a97ec08a7e434b5522611e1e505

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 10:14:53 GMT
x-content-type-options: nosniff
age: 522466
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25531
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Mar 2023 10:14:53 GMT

GET
H3 200 cucumbers.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 25 KB
25 KB 27ms
27ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/cucumbers.jpg

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3534be33b54b49c97653e877278aa16425446e70276d889cdc6ec02b4bc52a63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 21:24:32 GMT
x-content-type-options: nosniff
age: 568687
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25357
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Mar 2023 21:24:32 GMT

GET
H3 200 hammock.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 21 KB
22 KB 28ms
27ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/hammock.jpg

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9176fe9d940de10858d8c3b935f6dd889dc2151cb27f894863a70675fd2c1dfb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 04:14:24 GMT
x-content-type-options: nosniff
age: 457695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21991
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 04:14:24 GMT

GET
H3 200 sundae.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 23 KB
23 KB 30ms
30ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/sundae.jpg

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95f0b234c552063c85406d5fc0b308ecea3651445742b446edf134fe783fffa9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 10:14:53 GMT
x-content-type-options: nosniff
age: 522466
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23251
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Mar 2023 10:14:53 GMT

GET
H3 200 txt_3_1.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 5 KB
5 KB 31ms
31ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_3_1.png

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77fdbe39bb4311bbac32d8bb00e8d6d8d75de1d300d702ac66986d93d37cef74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 13:51:12 GMT
x-content-type-options: nosniff
age: 423087
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4783
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 13:51:12 GMT

GET
H3 200 txt_3_0.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 6 KB
6 KB 31ms
31ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_3_0.png

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

950064119c9c942a192669307b34181e9fec144a423dbb56404b6699d7dcd58a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Sun, 03 Apr 2022 20:28:52 GMT
x-content-type-options: nosniff
age: 53627
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6327
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Apr 2023 20:28:52 GMT

GET
H3 200 img_4_2.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 12 KB
12 KB 32ms
31ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/img_4_2.jpg

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3dbb015af6589a50e8521c55a36185c3c44e812fa49fd2b0ad76962b78f18c32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 04:14:24 GMT
x-content-type-options: nosniff
age: 457695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12101
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 04:14:24 GMT

GET
H3 200 img_4_1.jpg
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 9 KB
9 KB 39ms
39ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/img_4_1.jpg

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

429903e376843b5817cfa4c5a804dd8c5b986a7f1baa3f3ba4218fc8ac36c155

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 12:00:30 GMT
x-content-type-options: nosniff
age: 429729
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9260
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 12:00:30 GMT

GET
H3 200 txt_4_2.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 2 KB
3 KB 30ms
30ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_4_2.png

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fddeaef3163f57fc498b4de9db798b82b281d56f657c3dc40cd57dd69c8c1060

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 21:03:56 GMT
x-content-type-options: nosniff
age: 224323
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2543
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 01 Apr 2023 21:03:56 GMT

GET
H3 200 txt_4_1.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 4 KB
4 KB 32ms
31ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/txt_4_1.png

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77c7724a4aa759f9949809322fcaae30079c5a19ef8b25010aea10744d7e18ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 21:24:32 GMT
x-content-type-options: nosniff
age: 568687
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4557
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Mar 2023 21:24:32 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/ Frame 8CF5 2 KB
2 KB 34ms
34ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/logo.png

Requested by

Host: www.proxysite.com
URL: https://www.proxysite.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9a455034ac38913326ae9786e02c8d48b2fd55a7ac3d4fc605131b0d1c1ffbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13879860849598931235/th_ecstasy_728x90_en/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 04:14:24 GMT
x-content-type-options: nosniff
age: 457695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1970
x-xss-protection: 0
last-modified: Mon, 23 Nov 2020 15:31:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 Mar 2023 04:14:24 GMT

GET
H3 200 3b8ZtKHcFUSYKihZpywKVICyDtFsaoLwoCuDyEZifyk.js Show response
pagead2.googlesyndication.com/bg/ Frame 7B85 35 KB
13 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3b8ZtKHcFUSYKihZpywKVICyDtFsaoLwoCuDyEZifyk.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ddbf19b4a1dc1544982a2859a72c0a5480b20ed16c6a82f0a02b83c846627f29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Sat, 02 Apr 2022 08:21:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 183651
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13770
x-xss-protection: 0
last-modified: Mon, 28 Mar 2022 10:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 02 Apr 2023 08:21:48 GMT

GET
H/1.1 200
OK trk.php Show response
action.metaffiliation.com/ Frame A3D1 43 B
2 KB 91ms
28ms Document
image/gif 95.131.136.1
OXALIDE

General

Check archive.org

Show headers Download Go to

Full URL: https://action.metaffiliation.com/trk.php?taff=P51195151F57B2215&argsite=23029100101079600973094011919020&gdprconsent=
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=7wi7goi91r22&nw=20&renderingType=javascript&namespace=96038b2df3&subid=&uid=c7d5bc3d8b964b25&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYkrU_gAOvccKspoOwQnVBA%26exch_seat%3D20035004448%26mt_aid%3D5119917670281174466%26mt_id%3D6686412%26mt_adid%3D216536%26mt_sid%3D4637209%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_cid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCniwS_tRKYpSKOIK6ygWKkJLoDs-HjptcwIbZgsYCwI23ARABIABg-wGCARdjYS1wdWItNTI3MTA1MjAzMzc3NjgxMcgBCagDAaoEvQFP0LQFVRBnaubiTgoQvVAdr6QDwf6GYPwGQp09GMNBRkaxqQU22HX42R3FQ1gV1c8qbjUMn5PFXo1P9skgucveLY8yXlpEj0JSNQfH26hRc_uu5xYRiVOPYJ9zUUuVmBxpoDNR-DBunCscqw3Xvf683HhAJigiG5Vh2OL_e1aOCxszGFOBGb_gVDt7Rf20rKjVhXd1BR4IH5us1BIbu2iJtcm2fS1OO46mvpv0ecum4fsx8YMmtesKFHLqTvmABvfsraXW59OGXqAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0gR8ncf6D-3kWBTLj5KEl5jn4Ppg%2526client%253Dca-pub-5271052033776811%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-5271052033776811%26output%3Dhtml%26h%3D90%26adk%3D676745548%26adf%3D3560341080%26pi%3Dt.aa~a.4080220755~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1649071358%26rafmt%3D1%26to%3Dqs%26pwprc%3D8717720231%26psa%3D1%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fwww.proxysite.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1649071358857%26bpp%3D1%26bdt%3D1208%26idt%3D1%26shv%3Dr20220330%26mjsv%3Dm202203300101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Dcbe40aec1e6cb566-221c24636dcd00cb%253AT%253D1649071358%253ART%253D1649071358%253AS%253DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw%26prev_fmts%3D990x280%252C990x280%252C728x90%252C0x0%252C1200x280%26nras%3D3%26correlator%3D4393995530453%26frm%3D20%26pv%3D1%26ga_vid%3D1121233293.1649071358%26ga_sid%3D1649071358%26ga_hid%3D1097591842%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D2190%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759837%252C31065371%252C31066008%252C31066017%26oid%3D2%26pvsid%3D3516295011854182%26pem%3D991%26tmod%3D1327873000%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D6%26uci%3Da!6%26btvi%3D3%26fsb%3D1%26xpc%3DUDbT4e1aML%26p%3Dhttps%253A%2F%2Fwww.proxysite.com%26dtd%3D15&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.proxysite.com&random=5949315884309&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.131.136.1 , France, ASN47841 (OXALIDE, FR),
Reverse DNS: front.netaffiliation.net
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate post-check=0, pre-check=0
Connection: close
Content-Type: image/gif
Date: Mon, 04 Apr 2022 11:22:39 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon, 04 Apr 2022 11:22:39 GMT
P3P: CP="NOI DSP COR CUR ADMa PSAa OUR IND NAV COM",policyref="http://www.netaffiliation.com/w3c/p3p.xml"
Pragma: no-cache
Server: nginx
Transfer-Encoding: chunked
X-Robots-Tag: noindex
X-TRK-D: 0.0060489177703857
X-TRK-DECISION: 7
X-TRK-KWANKO: no consent mode activated, no personnal data stored.
X-TRK-PROC: 72017
X-TRK-SRV: 9

GET
H/1.1 200
OK request_content.php Show response
hal900020.redintelligence.net/ Frame 9721 8 KB
3 KB 80ms
27ms Document
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/request_content.php?s=23029100101079600973094011919020&a=c1aa1cc0
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=7wi7goi91r22&nw=20&renderingType=javascript&namespace=96038b2df3&subid=&uid=c7d5bc3d8b964b25&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYkrU_gAOvccKspoOwQnVBA%26exch_seat%3D20035004448%26mt_aid%3D5119917670281174466%26mt_id%3D6686412%26mt_adid%3D216536%26mt_sid%3D4637209%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_cid%3D25bc624a-d4ff-4501-99d9-909bcc26e801%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCniwS_tRKYpSKOIK6ygWKkJLoDs-HjptcwIbZgsYCwI23ARABIABg-wGCARdjYS1wdWItNTI3MTA1MjAzMzc3NjgxMcgBCagDAaoEvQFP0LQFVRBnaubiTgoQvVAdr6QDwf6GYPwGQp09GMNBRkaxqQU22HX42R3FQ1gV1c8qbjUMn5PFXo1P9skgucveLY8yXlpEj0JSNQfH26hRc_uu5xYRiVOPYJ9zUUuVmBxpoDNR-DBunCscqw3Xvf683HhAJigiG5Vh2OL_e1aOCxszGFOBGb_gVDt7Rf20rKjVhXd1BR4IH5us1BIbu2iJtcm2fS1OO46mvpv0ecum4fsx8YMmtesKFHLqTvmABvfsraXW59OGXqAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0gR8ncf6D-3kWBTLj5KEl5jn4Ppg%2526client%253Dca-pub-5271052033776811%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-5271052033776811%26output%3Dhtml%26h%3D90%26adk%3D676745548%26adf%3D3560341080%26pi%3Dt.aa~a.4080220755~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1649071358%26rafmt%3D1%26to%3Dqs%26pwprc%3D8717720231%26psa%3D1%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fwww.proxysite.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1649071358857%26bpp%3D1%26bdt%3D1208%26idt%3D1%26shv%3Dr20220330%26mjsv%3Dm202203300101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Dcbe40aec1e6cb566-221c24636dcd00cb%253AT%253D1649071358%253ART%253D1649071358%253AS%253DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw%26prev_fmts%3D990x280%252C990x280%252C728x90%252C0x0%252C1200x280%26nras%3D3%26correlator%3D4393995530453%26frm%3D20%26pv%3D1%26ga_vid%3D1121233293.1649071358%26ga_sid%3D1649071358%26ga_hid%3D1097591842%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D2190%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759837%252C31065371%252C31066008%252C31066017%26oid%3D2%26pvsid%3D3516295011854182%26pem%3D991%26tmod%3D1327873000%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D6%26uci%3Da!6%26btvi%3D3%26fsb%3D1%26xpc%3DUDbT4e1aML%26p%3Dhttps%253A%2F%2Fwww.proxysite.com%26dtd%3D15&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.proxysite.com&random=5949315884309&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: 32ce94305ed24df4223c05d6ae3996356f4d3332297325747536570520983816

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2250
Content-Type: text/html; charset=utf-8
Date: Mon, 04 Apr 2022 11:22:39 GMT
Expires: Mon, 04 Apr 2022 12:22:39 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK /
lov.saveur-biere.com/ Frame D8CD 43 B
2 KB 102ms
30ms Image
image/gif 95.131.136.1
OXALIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lov.saveur-biere.com/?t=P4FDE751F57B19105&argsite=23029100101079600973094011919020&gdprconsent=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=90&adk=676745548&adf=3560341080&pi=t.aa~a.4080220755~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x90&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1208&idt=1&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0%2C1200x280&nras=3&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2190&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=UDbT4e1aML&p=https%3A//www.proxysite.com&dtd=15
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.131.136.1 , France, ASN47841 (OXALIDE, FR),
Reverse DNS: front.netaffiliation.net
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

X-TRK-KWANKO: no consent mode activated, no personnal data stored.
Date: Mon, 04 Apr 2022 11:22:39 GMT
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR CUR ADMa PSAa OUR IND NAV COM",policyref="http://www.netaffiliation.com/w3c/p3p.xml"
X-TRK-D: 0.006309986114502
Connection: close
Pragma: no-cache
X-TRK-PROC: 64999
Last-Modified: Mon, 04 Apr 2022 11:22:39 GMT
Server: nginx
X-TRK-DECISION: 7
Content-Type: image/gif
Access-Control-Allow-Origin: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version
X-TRK-SRV: 9

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2D72 1 KB
749 B 25ms
24ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

age: 78987
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 03 Apr 2022 13:26:12 GMT
etag: 48472445140208031
expires: Mon, 04 Apr 2022 13:26:12 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D8CD 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1cd14389ac7fea8d02abc8004602b5e80642a8a6f2e162dd0edb35e1d2b0e2fc

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D72
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEL5eFruOfs0P0RDasT3FYQg&google_cver=1&google_push=AYg5qPI1XbYQ6t9vj5kPnnw7q0e5ZvpGxJAPamZLgO-8FotQaI2ZOxuXMf...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPI1XbYQ6t9vj5kPnnw7q0e5ZvpGxJAPamZLgO-8FotQaI2ZOxuXMfgOsIASZz0YElmqxyrT46taTwthGjfB9bA8WgmY6959Wg&google_hm=P6UVCY7Wh4...

170 B
188 B

41ms
41ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPI1XbYQ6t9vj5kPnnw7q0e5ZvpGxJAPamZLgO-8FotQaI2ZOxuXMfgOsIASZz0YElmqxyrT46taTwthGjfB9bA8WgmY6959Wg&google_hm=P6UVCY7Wh47IqIMWyppnVg

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPI1XbYQ6t9vj5kPnnw7q0e5ZvpGxJAPamZLgO-8FotQaI2ZOxuXMfgOsIASZz0YElmqxyrT46taTwthGjfB9bA8WgmY6959Wg&google_hm=P6UVCY7Wh47IqIMWyppnVg
pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D72
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPLoTCr-O77zUkroEsuJMCMidX_QaIjxg8kxZi3FGzBDfuG-7jHMcamY5L8q00VQBxRgQCtaZS3bHoXXxvR6F3ng7WDBH1ekVQ&google_gid=CAESEKa-LB9-D0tl2vZhpKuV1iA&g...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCP-pq5IGEgUI6AcQAEIASnJnb29nbGVfcHVzaD1BWWc1cVBMb1RDci1PNzd6VWtyb0VzdUpNQ01pZFhfUWFJanhnOGt4WmkzRkd6QkRmdUctN2pITWNhbVk1TDhxMDBWUUJ4UmdRQ3RhWlMzYkhvWFh4dl...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwQzE3QkJDOEJmYWd2NjdOdXJUc0FtWnVKQ3F3aU5NRzZwUm5neFVuRDlrNA==&google_push

170 B
188 B

35ms
34ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwQzE3QkJDOEJmYWd2NjdOdXJUc0FtWnVKQ3F3aU5NRzZwUm5neFVuRDlrNA==&google_push

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 04 Apr 2022 11:22:39 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwQzE3QkJDOEJmYWd2NjdOdXJUc0FtWnVKQ3F3aU5NRzZwUm5neFVuRDlrNA==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3 200 dds
rtb.openx.net/sync/ Frame 2D72 43 B
64 B 46ms
25ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEKQzrinD-kkMxSjhYhTvcxU&google_cver=1&google_push=AYg5qPJxhf-lrqJf1LHX-DB4AmuEiOqGDaAzDmX-o8-uqsednN5go518Q8PfVnIn607P9H08ynPm50C9JIrqRa5zqGwBy7suc36TtQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=90&adk=676745548&adf=3560341080&pi=t.aa~a.4080220755~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&to=qs&pwprc=8717720231&psa=1&format=1200x90&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358857&bpp=1&bdt=1208&idt=1&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dcbe40aec1e6cb566-221c24636dcd00cb%3AT%3D1649071358%3ART%3D1649071358%3AS%3DALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw&prev_fmts=990x280%2C990x280%2C728x90%2C0x0%2C1200x280&nras=3&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2190&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=UDbT4e1aML&p=https%3A//www.proxysite.com&dtd=15
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:38 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: uedlhqm4mbnf37bb8k7cpbenrn5fp49t

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D72
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=6CczbhWQTYOUq4elQ0n9pQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

36ms
36ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=6CczbhWQTYOUq4elQ0n9pQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLiwR2LcuTx5NCjCgtKSKSCsmqJPhbq8Jc9ivTzVsgafAS5lm0VCTo9tcWUo6fh7oFXfLbgThd5AHlwJBPA_5ZOtQzuWPXqHg

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=6CczbhWQTYOUq4elQ0n9pQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLiwR2LcuTx5NCjCgtKSKSCsmqJPhbq8Jc9ivTzVsgafAS5lm0VCTo9tcWUo6fh7oFXfLbgThd5AHlwJBPA_5ZOtQzuWPXqHg
date: Mon, 04 Apr 2022 11:22:39 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D72
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEINMuT--54KVW7Y9JB1GZ1A&google_cver=1&google_push=AYg5qPJz91IB0SYqhZffTa2DW3Z_omJ1d3z5EFaPdQUuaNOHUssmWIUDWjQpWr1pQJbP7Jd69tM...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLTUlDUjMtSi0xOFVN&google_push=AYg5qPJz91IB0SYqhZffTa2DW3Z_omJ1d3z5EFaPdQUuaNOHUssmWIUDWjQpWr1pQJbP7Jd69tM6gyHP-AhCgmybQKv6Ouff71DF

170 B
188 B

40ms
39ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLTUlDUjMtSi0xOFVN&google_push=AYg5qPJz91IB0SYqhZffTa2DW3Z_omJ1d3z5EFaPdQUuaNOHUssmWIUDWjQpWr1pQJbP7Jd69tM6gyHP-AhCgmybQKv6Ouff71DF

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLTUlDUjMtSi0xOFVN&google_push=AYg5qPJz91IB0SYqhZffTa2DW3Z_omJ1d3z5EFaPdQUuaNOHUssmWIUDWjQpWr1pQJbP7Jd69tM6gyHP-AhCgmybQKv6Ouff71DF
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 2D72
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7T...

0
0

GET googleredir
googlecm.hit.gemius.pl/ Frame 2D72 0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2D72 0
12 B 33ms
32ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Lx1ur4771QKOy3TgvAYU87Ye1sPFImECdglrt_SbVxZtvVGPj4VrZPhIiZguPiCya0siGEPA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:39 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7B33 0
20 B 61ms
61ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoYCAEqFGJhbm5lci1sYXJnZS12YW5pbGxhCgoIAioGc2VydmVyCiMIBCofbG9hZF9pbWFnZV9wbCxteXNpZGlhX2FuYWx5dGljcwoNEBQhAAAAAKD_50AwBAoNEBUhAAAAAAAAMEAwBAoNEBYhAAAAAAAAHEAwBAoNEBghAAAAAAB4iEAwBAoNEDIhAAAAADAz0z8wBAoNEDMhAAAAADAz0z8wBAoNEDQhAAAAADAz0z8wBAoNEDUhAAAAADAz0z8wBAoNEDYhAAAAADAz0z8wBAoNEDchAAAAADAz0z8wBAoNEDghAAAAAAAAAEAwBAoNEDkhAAAAaGa2cUAwBAoNEDohAAAAzMz0cUAwBAoNEDshAAAAnJlJf0AwBAoNEDwhAAAAnJlJf0AwBAoNED0hAAAAAABQf0AwBAoNED4hAAAAmpk5iEAwBAoNED8hAAAAmpk5iEAwBAoNEEAhAAAAzsyEiEAwBBIaQ1B2aXVzU2wtdllDRlpIN3Nnb2RiZ2tGVkEiFnRleHQvdmFuaWxsYV9oaWdobGlnaHQoFQ==

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/00503a990ef139b9c679b68d30da2f64.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 9721 1 KB
419 B 38ms
37ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=23029100101079600973094011919020&a=c1aa1cc0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ea795a298e37c1cd48937e8d9b242162d213ebaa07c997769a6bfe4b4d8ec411

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 04 Apr 2022 09:51:31 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 04 Apr 2022 11:22:39 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 04 Apr 2022 11:22:39 GMT

GET
H/1.1 200
OK am_amex_06-120x60.jpeg
cdn.contentspread.net/24i/advertiser/60540/creativesup/ Frame 9721 5 KB
5 KB 105ms
23ms Image
image/jpeg 51.75.147.170
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.contentspread.net/24i/advertiser/60540/creativesup/am_amex_06-120x60.jpeg
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=23029100101079600973094011919020&a=c1aa1cc0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 51.75.147.170 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3133977.ip-51-75-147.eu
Software: nginx /
Resource Hash: 60d68d0d0332b5d3883ce1a19e640ac7dab15305000823a26309232e5c0b93f5

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Mon, 04 Apr 2022 11:22:39 GMT
Last-Modified: Thu, 22 Jul 2021 05:36:18 GMT
Server: nginx
ETag: "60f903d2-123f"
Content-Type: image/jpeg
Connection: close
Accept-Ranges: bytes
Content-Length: 4671

GET
H2

200

72579.jpg
ad.publicidees.com/promos/banners/1199/ Frame 9721
Redirect Chain

https://tracking.publicidees.com/banner.php?partid=30890&progid=1883&promoid=72579&noret=8c801e11d41b2e47a4d3979ed6d7dd3c&cb=23029100101079600973094011919020
https://ad.publicidees.com/promos/banners/1199/72579.jpg

4 KB
4 KB

167ms
22ms

Image
image/jpeg

89.185.38.100
CLARANET-AS Clara...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.publicidees.com/promos/banners/1199/72579.jpg
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=23029100101079600973094011919020&a=c1aa1cc0
Protocol: H2
Server: 89.185.38.100 Paris, France, ASN8426 (CLARANET-AS ClaraNET LTD, GB),
Reverse DNS
Software: nginx /
Resource Hash: e4090cf79081be69b3a450385c10be263550306372c37c21201ad4be617a687d

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:40 GMT
last-modified: Thu, 05 Mar 2020 16:55:43 GMT
server: nginx
etag: "5e612f0f-10fe"
content-type: image/jpeg
expires: Mon, 04 Apr 2022 11:27:40 GMT
cache-control: max-age=300
accept-ranges: bytes
content-length: 4350
x-proxy-cache: HIT

Redirect headers

Pragma: no-cache
Date: Mon, 04 Apr 2022 11:22:39 GMT
Last-Modified: Mon, 04 Apr 2022 11:22:39 GMT
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: https://ad.publicidees.com/promos/banners/1199/72579.jpg
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Expires: 0

GET
H/1.1 200
OK / Show response
lov.saveur-biere.com/ Frame 9721 128 KB
129 KB 72ms
37ms Script
application/javascript 95.131.136.1
OXALIDE

General

Check archive.org

Show headers Download Go to

Full URL: https://lov.saveur-biere.com/
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=23029100101079600973094011919020&a=c1aa1cc0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.131.136.1 , France, ASN47841 (OXALIDE, FR),
Reverse DNS: front.netaffiliation.net
Software: nginx /
Resource Hash: 836128b05b1242eb775d076cddf43120e8a791ca1435c60b5a25d19114f2955a

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Mon, 04 Apr 2022 11:22:39 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=3600
Access-Control-Allow-Credentials: true
Connection: close
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version

GET
H/1.1 200
OK viewability Show response
hal900020.redintelligence.net/ Frame 9721 0
150 B 79ms
27ms Script
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/viewability?s=23029100101079600973094011919020&a=5d9e9277&vb=m
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=23029100101079600973094011919020&a=c1aa1cc0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://hal900020.redintelligence.net/request_content.php?s=23029100101079600973094011919020&a=c1aa1cc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Mon, 04 Apr 2022 11:22:39 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2

200

kwanko-sdk-iframe.html Show response
img.metaffiliation.com/ Frame 494F
Redirect Chain

https://lov.saveur-biere.com/kwanko-sdk-iframe.html
https://img.metaffiliation.com/kwanko-sdk-iframe.html

3 KB
1 KB

106ms
19ms

Document
text/html

192.229.220.129
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://img.metaffiliation.com/kwanko-sdk-iframe.html
Requested by: Host: lov.saveur-biere.com
URL: https://lov.saveur-biere.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.220.129 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (paa/6F5B) /
Resource Hash: 2d43c04a2d2f68039cedc241e492503a5e0d93a2cafb3be130993b3e3dfd8d4a

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://hal900020.redintelligence.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 1752
cache-control: public, max-age=600, s-maxage=3600
content-encoding: gzip
content-length: 891
content-type: text/html
date: Mon, 04 Apr 2022 11:22:40 GMT
etag: "5fd78d26-ac5"
last-modified: Mon, 14 Dec 2020 16:04:54 GMT
server: ECAcc (paa/6F5B)
vary: Accept-Encoding
x-cache: HIT

Redirect headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version
Access-Control-Allow-Origin: *
Connection: close
Content-Type: text/html; charset=UTF-8
Date: Mon, 04 Apr 2022 11:22:39 GMT
Location: https://img.metaffiliation.com/kwanko-sdk-iframe.html
Server: nginx
Transfer-Encoding: chunked

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame FF5D 0
0 62ms
61ms Fetch
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CYmXz_tRKYtPsH9TkywWt6Yu4ApWh7LZp1frtw9IP2tkeEAEggfOTKWD7AaAB9b7n8gLIAQmoAwGqBMgBT9AkYaIL6uFEquVfy4ZgCEOKgedyUnVUtFvocmmnGr6yc9m2sa1pXlWeHT0aR2S6u4lUPfubaYFmAf94kMzwF41uNjamJ6thCutLEgdw256tjAruE79VOdGbmkgd_o-fU529J3ZClJ5DW5jmjKSnIdly4_d-t0bdibY4aV6ta-XeX-YjiXn-ZuB8TQBb7j15Q6w-Qrz-GsXLQE6vZZHhu6xdwQ88lDf7653kueluZ3d8dUgh1xnXH8QYX3ak34BgX6Oqg4G_xzfABPv95Ij6A6AGLoAHlo2puwKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBDBygTSCAkIgOGAEBABGB-ACgHICwG4E4gn2BMD0BUBmBYBgBcBshccChoIABIUcHViLTUyNzEwNTIwMzM3NzY4MTEYAA&sigh=3RZ4qCHNwyw&vt=1&template_id=5000&uach_m=[UACH]&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5271052033776811&output=html&h=280&slotname=4344332884&adk=523175106&adf=1005968846&pi=t.ma~as.4344332884&w=990&fwrn=4&fwrnh=100&lmt=1649071358&rafmt=1&psa=0&format=990x280&url=https%3A%2F%2Fwww.proxysite.com%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649071358260&bpp=1&bdt=610&idt=180&shv=r20220330&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&prev_fmts=990x280&correlator=4393995530453&frm=20&pv=1&ga_vid=1121233293.1649071358&ga_sid=1649071358&ga_hid=1097591842&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=305&ady=702&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065371%2C31066008%2C31066017&oid=2&pvsid=3516295011854182&pem=991&tmod=1327873000&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=pwFPO3JFmN&p=https%3A//www.proxysite.com&dtd=183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 04 Apr 2022 11:22:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FF5D 42 B
64 B 98ms
60ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuurp1jRSaOBPQDTtRVss7BF_swFA4s9SjZrWsBaWYgEEnB4LPWrFL1WBbr_nf5I5ThXpdfPTyDSdFs0WpsfAxJrwQe0HXL283VfUQG6eGEk8inb6GRQw&sai=AMfl-YTqTiWpOp2rU0drCnEEeAjr1LNNiR1V1J2Ju9-__xRX2QHJxZyWn3IIT5cvg0GKjfAnNJtSnkdEdUYk&sig=Cg0ArKJSzIw7hxZeQwFSEAE&id=lidar2&mcvt=1000&p=0,0,280,990&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220330&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=523175106&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&pay=1&rst=1649071358445&rpt=616&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
10 KB 67ms
41ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220330&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4ce7e161e01441d5c68b4a66f01bad30fa866950325f20427771d2d863c3663a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 04 Apr 2022 11:22:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10506
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 04 Apr 2022 11:22:40 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DD08 42 B
64 B 62ms
61ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuLUk7_d5iSjausW0RvtbQ_5UtMWG8ahGGoqXvST4b5kIFN0-PWrgdOpKn2GBWz1ol3lCo-J0c0LzxxSAnOVG1r2JLGCnw3zaS-bnLPIZhqU828jckxZw&sai=AMfl-YSfSOUvWbGAbU6chTjLgp9zNh7mCfdfChnW2fOkDYigiCp4VIxu-lspZygye2D3dDpznJyFmeEeSWxv&sig=Cg0ArKJSzDIBLhBnDF0fEAE&id=lidar2&mcvt=1000&p=0,0,280,990&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220330&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=3927345067&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1649071358427&rpt=776&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame E268 13 KB
5 KB 26ms
25ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges: bytes
age: 2873
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Apr 2022 10:34:47 GMT
expires: Tue, 04 Apr 2023 10:34:47 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A646 783 B
535 B 85ms
43ms Document
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

e1bd3bddb431f871bdad6274d1c73b9b44a3296f1325e8856b7bc3b50230e171

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-up/Rz+ZbFg1mnLEjbYjA4Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-up/Rz+ZbFg1mnLEjbYjA4Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 04 Apr 2022 11:22:40 GMT
expires: Mon, 04 Apr 2022 11:22:40 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 3b8ZtKHcFUSYKihZpywKVICyDtFsaoLwoCuDyEZifyk.js Show response
pagead2.googlesyndication.com/bg/ Frame E268 35 KB
13 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3b8ZtKHcFUSYKihZpywKVICyDtFsaoLwoCuDyEZifyk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ddbf19b4a1dc1544982a2859a72c0a5480b20ed16c6a82f0a02b83c846627f29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Sat, 02 Apr 2022 08:21:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 183652
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13770
x-xss-protection: 0
last-modified: Mon, 28 Mar 2022 10:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 02 Apr 2023 08:21:48 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A646 0
0 65ms
65ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220330&jk=3516295011854182&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame E268 0
9 B 30ms
29ms Image
text/plain 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?ddNUBA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AB00 42 B
64 B 60ms
59ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssLm4khFsE3_bUmcqupt3cxsSVOpw-kN6yhLqbj6_ftFEv5mI6Rn4MtCotEkz-EHPx-j1HR7-D4fspN8oXJBm8sole208GEZPXIBrh_CUJ3RgUXgeI41MaAW7IAr9alVXnjQhoc6YyARRT-T6TEPqVD02MVbi7yf94UIM97Z_Y7lw&sai=AMfl-YSZubP7_hdjcbJ_9ONxd5Rp4yIA9JZ9BMPAAXii3uK1ItmGZzlxmkin5evILKuhUa-fHQ4jozO0En19&sig=Cg0ArKJSzPlkSywFhDF_EAE&id=lidar2&mcvt=1000&p=0,1,124.25,1006&mtos=0,871,1000,1000,1000&tos=0,871,129,0,0&v=20220330&bin=7&avms=nio&bs=0,0&mc=0.76&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1649071358915&rpt=518&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Apr 2022 11:22:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK / Show response
lov.saveur-biere.com/ Frame 9721 714 B
3 KB 88ms
28ms Fetch
application/json 95.131.136.1
OXALIDE

General

Check archive.org

Show headers Download Go to

Full URL: https://lov.saveur-biere.com/
Requested by: Host: lov.saveur-biere.com
URL: https://lov.saveur-biere.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.131.136.1 , France, ASN47841 (OXALIDE, FR),
Reverse DNS: front.netaffiliation.net
Software: nginx /
Resource Hash: c51dd697125cf9563ec4eb9448565f811aaca22ee66f576745826360de7916b5

Request headers

x-kwanko-sdk-version: web-1.16
Referer: https://hal900020.redintelligence.net/
x-kwanko-content-type: application/json
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAyTAY319PytzC6A8

Response headers

Date: Mon, 04 Apr 2022 11:22:40 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR CUR ADMa PSAa OUR IND NAV COM",policyref="http://www.netaffiliation.com/w3c/p3p.xml"
X-TRK-D: 0.0061650276184082
Connection: close
Pragma: no-cache
X-TRK-PROC: 64999
Last-Modified: Mon, 04 Apr 2022 11:22:40 GMT
Server: nginx
X-TRK-DECISION: 2
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://hal900020.redintelligence.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version
X-TRK-SRV: 9

OPTIONS
H/1.1 204
No Content /
lov.saveur-biere.com/ Frame 0
0 76ms
18ms Preflight
text/plain 95.131.136.1
OXALIDE

General

Check archive.org

Show headers Download Go to

Full URL: https://lov.saveur-biere.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.131.136.1 , France, ASN47841 (OXALIDE, FR),
Reverse DNS: front.netaffiliation.net
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-kwanko-content-type,x-kwanko-sdk-version
Access-Control-Request-Method: POST
Origin: https://hal900020.redintelligence.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: https://hal900020.redintelligence.net
Access-Control-Max-Age: 1728000
Connection: close
Content-Length: 0
Content-Type: text/plain charset=UTF-8
Date: Mon, 04 Apr 2022 11:22:40 GMT
Server: nginx

GET
H2

200

img_9_105_9.gif
img.metaffiliation.com/12/64999/ Frame 9721
Redirect Chain

https://lov.saveur-biere.com/12/64999/img_9_105_9.gif
https://img.metaffiliation.com/12/64999/img_9_105_9.gif

18 KB
15 KB

21ms
20ms

Image
image/gif

192.229.220.129
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.metaffiliation.com/12/64999/img_9_105_9.gif
Protocol: H2
Server: 192.229.220.129 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (paa/6F7D) /
Resource Hash: e47efff06b20e0e50bfa955e2d20d04f1ffb32a20f44fae848c2b53b1b55b11e

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Mon, 04 Apr 2022 11:22:40 GMT
content-encoding: gzip
last-modified: Wed, 30 Mar 2022 07:38:28 GMT
server: ECAcc (paa/6F7D)
age: 2260
etag: "624408f4-4762"
vary: Accept-Encoding
x-cache: HIT
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=600, s-maxage=3600
accept-ranges: bytes
content-length: 15416

Redirect headers

Date: Mon, 04 Apr 2022 11:22:40 GMT
Server: nginx
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Location: https://img.metaffiliation.com/12/64999/img_9_105_9.gif
Access-Control-Allow-Credentials: true
Connection: close
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 77ms
76ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220330&jk=3516295011854182&bg=!bm2lbSnNAAZku-1yRLs7ACkAdvg8Wr_x_-9igNGj-L8ko9y3KK-o87sHCJ228Y7PTauDI22pDEgJAgIAAABfUgAAAAZoAQeZAuqvXjAC1Qrz5-zWOwe1ln7nuoyGp2-qSoKpcmmQCpwo38lNf_oBXr0hqJ6tDTBhmxmV5ai-5zpNNcYqf9W9HbtpC0wh-yMQr1h-6PMzbirqw3xknaeyW9wvFt9QAyllHKLmiLzf5f7v-dpSjbRfKpCAxuUEdhPSvfxjtm7kNHQTlCXiFuHuBAa1KT_FdL16fFjpzDsVAXhhYxy-3MwQP6MrAC6wCe_igC17JdIcjmtlJ68rdtXLvgjrmbGp-VWkeQVwHJgZAhobKRz_3ggQ8Sk5S7pSdYJdSPsBVh7NWXaNbeHDay9lNmZvPTtqJU__cB2uBgS_7xAiKybIQQm1b_Xw1uKL4cMxskFPAAgDUinXPHy2MwEYIqtnFSvO28wXdLaVyGR75qk6F2W2IbNpU3Pb4LLPtLlXhHMALn5Wrnq9jnfuUbO1r-GcjbLC0AN5nG5Z8B_1zOgz_JwyoljjC4-QOMEo6HrTB0wk3IsCms5BPTQCnQBiIj5WLKSh3uMtz0WOR0gXX-JindYAMgRhkwesMoLYOXzfoupnunLQW7jwts6pcBW_qMsCCPCXPHd92XVy7aKfBJFYX6NrCmzJtNdgCOuKpNNYWpEnDWu5mpIyueDOLktxyILo3ugL3d2u6RxHyPc8VQvB2-xdJuyQt0esLvsd3kDu27nQMzKt4KcFf5um99ABebw2a1EBN470zoxuxwUthMKRBhJKx2bmu-HOpOvBO3r0OEwXv8MfYS4x-eY-5KL5_4piSNianhKxuqD3rn49ZD-kJ0wWNjtNiNGYCryysJAENeedkZrKbG2SrhDB4jIGse161_IMvpLBFnT1wItMDN_ROmHvRkY2J3638c8XAkwicfaFVcifPjlZLNi-M300rFAi8mMKJVFZLPtLL4oJpGroyJa06NyCkuEcY_Svl9VAyyMffdQlaVo-6M2XcjU3s3b0zeASEZvroYmGjByZnjV-Yoa6hAsBu5j-yEn4bei5iflokw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.proxysite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1

Domain: googlecm.hit.gemius.pl
URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEEkILM7a2ye4i826HrGcjA0&google_cver=1&google_push=AYg5qPJ3CnhU0336J98Wzxu5zfIVvzlxx_s9cyXTgh4noQJK1lwpNo7LmF9ga3Yzh4HwtT0QPHXI7uW6fe2tmUd3v4K9MV8nai1ogg

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1

Domain: googlecm.hit.gemius.pl
URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEEYE12Hm59Sksq46kwIgE3k&google_cver=1&google_push=AYg5qPJXCp0gAWu3CB3t6_QfhhWcx_f-6yvhSuIDhefQr9gAQV1LKK7-OMa08rxXaHt50G6roDOa2VSJUr24jMCYr5KQLXAGexU7JYM

Verdicts & Comments Add Verdict or Comment

74 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

40 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
eu3.proxysite.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: d4j1jjr7v79cr78qb30g2r2pg2
www.proxysite.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6h3kci2fi1io0a6j058ebb6u50
www.proxysite.com/	1970-01-20 10:50:07	Name: hl Value: en
www.proxysite.com/	1970-01-20 02:14:36	Name: AWSALB Value: Hu2Kwyg2SOPp9UNzpSZ7dXY1RlE7nzHbO/ibUKT/qus7iYUTayyIU8xbtJZBPH2oGaSY3Gp9bb8oe6Vh+uhyyQivePOZGltH31MJ3YPytHcho1puf/0zFS4jrSnK
www.proxysite.com/	1970-01-20 02:14:36	Name: AWSALBCORS Value: Hu2Kwyg2SOPp9UNzpSZ7dXY1RlE7nzHbO/ibUKT/qus7iYUTayyIU8xbtJZBPH2oGaSY3Gp9bb8oe6Vh+uhyyQivePOZGltH31MJ3YPytHcho1puf/0zFS4jrSnK
.proxysite.com/	1970-01-20 19:35:43	Name: _ga Value: GA1.2.1121233293.1649071358
.proxysite.com/	1970-01-20 02:05:57	Name: _gid Value: GA1.2.314693249.1649071358
.proxysite.com/	1970-01-20 02:04:31	Name: _gat Value: 1
.proxysite.com/	1970-01-20 11:26:07	Name: __gads Value: ID=cbe40aec1e6cb566-221c24636dcd00cb:T=1649071358:RT=1649071358:S=ALNI_MagY5HpIh4ZzmBSToYIPvWs4C62Bw
.doubleclick.net/	1970-01-20 11:26:07	Name: IDE Value: AHWqTUnRCbSlJdvQiv7AUoHCWpsymf9lLC_K2Itwxw5zOS1jIUTuKR_yyAqOOaP1cGo
.mathtag.com/	1970-01-20 10:50:07	Name: uuid Value: 25bc624a-d4ff-4501-99d9-909bcc26e801
.redintelligence.net/	1970-01-20 04:14:07	Name: 8lcfmzhxc8d6_uid Value: 7f9add44e512e572
.pubmatic.com/	1970-01-20 02:05:57	Name: KTPCACOOKIE Value: YES
.quantserve.com/	1970-01-20 04:14:07	Name: d Value: EFQBCQHpJYEA
.quantserve.com/	1970-01-20 11:34:45	Name: mc Value: 624ad4ff-7573f-c8b12-93b50
.pubmatic.com/	1970-01-20 04:14:07	Name: KADUSERCOOKIE Value: E827336E-1590-4D83-94AB-87A54349FDA5
.casalemedia.com/	1970-01-20 10:50:07	Name: CMID Value: YkrU-4sNTKxZ8MR2gM5mcQAA
.casalemedia.com/	1970-01-20 04:14:07	Name: CMPS Value: 1214
.casalemedia.com/	1970-01-20 04:14:07	Name: CMPRO Value: 1166
.casalemedia.com/	1970-01-20 02:05:57	Name: CMST Value: YkrU-2JK1P8A
.doubleclick.net/	1970-01-20 02:04:34	Name: DSID Value: NO_DATA
.e.dlx.addthis.com/	1970-01-20 11:34:45	Name: na_tc Value: Y
.metaffiliation.com/	1970-01-20 03:30:55	Name: kwknc_ssc Value: dp51195151f57b21d5-MjMwMjkxMDAxMDEwNzk2MDA5NzMwOTQwMTE5MTkwMjA%3D
.metaffiliation.com/	1969-12-31 23:59:59	Name: kwkncses_ssc Value: dp51195151f57b21d5-MjMwMjkxMDAxMDEwNzk2MDA5NzMwOTQwMTE5MTkwMjA%3D
.rlcdn.com/	1970-01-20 10:50:07	Name: rlas3 Value: Dgkc18kw5dt3sblH5o1ytTWoNkebJ6k3qfDlcoQooeY=
.rlcdn.com/	1970-01-20 03:30:55	Name: pxrc Value: CP+pq5IGEgUI6AcQABIGCOndKhAA
.addthis.com/	1970-01-20 11:34:45	Name: na_id Value: 2022040411223900053386154891
.addthis.com/	1970-01-20 11:34:45	Name: na_tc Value: Y
.addthis.com/	1970-01-20 11:34:45	Name: uid Value: 624ad4ffd07b4b33
.addthis.com/	1970-01-20 11:34:45	Name: ouid Value: 624ad4ff0001f800bbfe8bd8ea8901cdc4ef8e996ed7c42d62db
.dlx.addthis.com/	1970-01-20 02:47:43	Name: na_rn Value: 0
.dlx.addthis.com/	1970-01-20 02:47:43	Name: na_sr Value: 20220404
.dlx.addthis.com/	1970-01-20 02:04:31	Name: na_srp Value: 3614
.dlx.addthis.com/	1970-01-20 02:47:43	Name: na_sc_e Value: 0
tracking.publicidees.com/	1970-01-20 10:50:07	Name: IC Value: eJwVx8ENgDAMA8CV7KRt6owDDFAhJB6U3Sm617F3f45kK0LQq-a1UhHSn3GnowtznBlWQ3Pf0hwmAlxCDVA4VECKguH9AJ8lFNo
tracking.publicidees.com/	1970-01-20 10:50:07	Name: WUC Value: eJxFzTEOg0AMRNEjZbxerz17m2BAokNRJAqWu0Oq6Fev-hKh59ylVcJFjeP7wODkD_vRFUGM_dO9mHPk1IuiUAB5cjaArmCFCIUouLYTvdQGXXPNtDDA8Q5ZDM0ipxm5vP7L6wbIRyGW
.saveur-biere.com/	1970-01-20 03:30:55	Name: neta_ssc Value: 40b9f3q6eucmdm0bzu9v8wo7xdcz
.saveur-biere.com/	1969-12-31 23:59:59	Name: netases_ssc Value: 40b9f3q6eucmdm0bzu9v8wo7xdcz
.saveur-biere.com/	1970-01-20 03:30:55	Name: kwknc_ssc Value: ds4fde751f57b19105-MjMwMjkxMDAxMDEwNzk2MDA5NzMwOTQwMTE5MTkwMjA%3D
.saveur-biere.com/	1969-12-31 23:59:59	Name: kwkncses_ssc Value: ds4fde751f57b19105-MjMwMjkxMDAxMDEwNzk2MDA5NzMwOTQwMTE5MTkwMjA%3D

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEEkILM7a2ye4i826HrGcjA0&google_cver=1&google_push=AYg5qPJ3CnhU0336J98Wzxu5zfIVvzlxx_s9cyXTgh4noQJK1lwpNo7LmF9ga3Yzh4HwtT0QPHXI7uW6fe2tmUd3v4K9MV8nai1ogg Message: Failed to load resource: net::ERR_ADDRESS_UNREACHABLE
network	error	URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEEYE12Hm59Sksq46kwIgE3k&google_cver=1&google_push=AYg5qPJXCp0gAWu3CB3t6_QfhhWcx_f-6yvhSuIDhefQr9gAQV1LKK7-OMa08rxXaHt50G6roDOa2VSJUr24jMCYr5KQLXAGexU7JYM Message: Failed to load resource: net::ERR_ADDRESS_UNREACHABLE
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPK8e-uQSOtH53JOgoAjSJCDdz1B0cAUKVLIIXaH0OvWkoJ4DM9y_D5BULMS4S14KXw-AvEZV5vzh6Po1pF48JcKA3kLczNt&google_gid=CAESEA-uGNZ89n6P1jWFtiP6Gug&google_cver=1 Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrU_4sNTKxZ8MR2gM5mcQAABI4AAAAB&google_push=AYg5qPJ4NgfZgle-VyUS0YN5S09GAebwk_rgn81CukcseJH0xYObBEIHxwXwnfhV0SZ7wbL3675JXNgCe-WRKmwl7Twb7SKVy8h_&google_gid=CAESEFgVEZDTdviXI3quhaRfCuk&google_cver=1 Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

action.metaffiliation.com
ad.publicidees.com
adservice.google.com
adservice.google.fr
cdn.contentspread.net
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
e.dlx.addthis.com
eu3.proxysite.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
googlecm.hit.gemius.pl
hal9000.redintelligence.net
hal900020.redintelligence.net
id.rlcdn.com
image6.pubmatic.com
img.metaffiliation.com
lov.saveur-biere.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.mathtag.com
pixel.rubiconproject.com
platform.twitter.com
rtb.openx.net
s0.2mdn.net
static.xx.fbcdn.net
syndication.twitter.com
tags.mathtag.com
tpc.googlesyndication.com
tracking.publicidees.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagservices.com
www.gstatic.com
www.proxysite.com
cm.g.doubleclick.net
googlecm.hit.gemius.pl
104.244.42.200
142.250.185.194
142.250.186.130
142.250.186.162
178.33.33.138
178.63.52.121
185.29.134.249
185.64.190.78
192.229.220.129
23.35.228.210
2606:2800:234:59:254c:406:2366:268c
2620:116:800d:21:fcb8:22d2:d390:5f1b
2a00:1450:4001:809::2001
2a00:1450:4001:809::200e
2a00:1450:4001:80f::2003
2a00:1450:4001:810::2002
2a00:1450:4001:811::2002
2a00:1450:4001:812::2003
2a00:1450:4001:812::200a
2a00:1450:4001:829::2004
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::2006
2a00:1450:4001:831::2002
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
35.171.101.160
35.186.253.211
35.244.174.68
51.75.147.170
69.173.144.138
69.192.160.219
88.99.165.19
89.185.38.100
89.185.38.84
95.131.136.1
0048bc4b9d79753b9482ad7a42c11e8b6659183ee4eee2c4076cbe38c4e5f8d4
02ecb150b79f205c9cfc0c834ee441eaa7cb0871cc5aaad16924d9bcbd6a3e0a
036a97f58ae41233cce615d76fb5511d15d9db41201bae08f0099eeb07faec28
03e8cab8d94137b2f39d2d432ccb7fea1bae757201413e3f1f22b1689aee232a
0819f5d63c8ef0aa4380e987ec22fba4b33604c839f618315e4e747ff696bf81
0a24ed2b5a55ee6fb3dbaf6ef9840c306c4189fbd331649ec5b3cc044e092c51
0ac9094e17f405afb1a4cb915170e1051a048db8597a64460222f03fab4dcc76
0ae1974962edfb6f6403064694c491c5b313a838f18fb89dc141716f0d9539d1
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ce5fc08d0f617e71e1d61bcd79fc7cc1855f4221945b0c09ac774685fe7f52c
0fa69d50d6274de1b579c381da50f4d923558a40a81fd471882ecc70d090a268
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
17de8174504d5e8409dbbffece047aa33f9a92fadfd7a7784c72cb51e6c57c8e
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1cd14389ac7fea8d02abc8004602b5e80642a8a6f2e162dd0edb35e1d2b0e2fc
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
1dd5ecae9df18746501b8c7b80b016f6f2423a97ec08a7e434b5522611e1e505
1e046a89bb90f44dadb24f5fdfbe412b5f6d320b790f7317fad956b193234726
261cf8e55383415eceda39a856866ffd0b64fbb1a5be243e48b097c475ac7128
2d43c04a2d2f68039cedc241e492503a5e0d93a2cafb3be130993b3e3dfd8d4a
2f1513a46b73f5ada51bafe9acd73abc1489f912de163236e4b6480a8311fb18
32ce94305ed24df4223c05d6ae3996356f4d3332297325747536570520983816
341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f
347ceeb1226aa3c74ccaab6c4ad7e3e22fe6957dfc6c65794d6f35a03d713103
3534be33b54b49c97653e877278aa16425446e70276d889cdc6ec02b4bc52a63
35d4a453929aeb9cb4ca18e20087e72d2b251d050a6a7ec20931c152049d341f
3cee69d07c93d87ecbb03f206ddb86c9d4ba12638a18ed177de725be2eb8333a
3dbb015af6589a50e8521c55a36185c3c44e812fa49fd2b0ad76962b78f18c32
429903e376843b5817cfa4c5a804dd8c5b986a7f1baa3f3ba4218fc8ac36c155
439fff339c928c72fc2df8976ef1ded1fa7cc10ea48f4a3b259097abfba7ada3
44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e
4ce7e161e01441d5c68b4a66f01bad30fa866950325f20427771d2d863c3663a
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5054a54db3ef08ce6320ae9a8d59ca6e4d6f0c66b5cd92a03caccf9d0448040a
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
506b65c7212c48cb6e7f38ce5a4ffacfe0ac9509f1c7f7e2f60b47f6b135cd40
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5be74229b5ab4032b7eafc6235b15b2f20310ebf5cc8fe3aa0cbc1724363d304
5c80ca3aed70370153b1cad499975a554e14f452f7f35adadc6330df7615f83e
60738e0c21e145c63411dab779e72942f078ede817a5cdf57466ef0e61ff8d49
60d68d0d0332b5d3883ce1a19e640ac7dab15305000823a26309232e5c0b93f5
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
623ec414722939f3fa6c37d93e8111e2fbc5752d6365d3b155af960e347bc6b7
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f
69c6399954fe80eae18ec5f729521d1d535928adc5eae3a1b3ff3e4e64d95293
724acb468e6daf873120d385f6717f09d84ffb51b33c81cb135597dad94ab4d7
770da7643a54e06b63d0c10b9386c21eebe7fe791bbd43e760a9f763aa95d26f
77c7724a4aa759f9949809322fcaae30079c5a19ef8b25010aea10744d7e18ed
77ede445a0c52ee72cff281493043899135432ab67ef92065835bf9e34775f9d
77fdbe39bb4311bbac32d8bb00e8d6d8d75de1d300d702ac66986d93d37cef74
7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb
7ffcb15458cc6d82ade6166ddb0788afe839679e06d01368d615e8f2c0c6a5f1
81a41e6058e181feddc2b1467c7caffeba23c4a6096016c94e742b4150f269bc
836128b05b1242eb775d076cddf43120e8a791ca1435c60b5a25d19114f2955a
83ddb4703804f6f155d71c7de5b659e329bd40a52d55e0bf9d6eb344833f39b3
9176fe9d940de10858d8c3b935f6dd889dc2151cb27f894863a70675fd2c1dfb
938bb7a4fe2818088711d433b38bb086516f778d8614faaf479ac89cf62968ec
9428518d1b1c9e441b6dcf1effddc210ce3ab2d1e0913be29695e907b4c82c43
950064119c9c942a192669307b34181e9fec144a423dbb56404b6699d7dcd58a
95f0b234c552063c85406d5fc0b308ecea3651445742b446edf134fe783fffa9
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9c7a121317262200d9082cf560cfbbde54765e199c9894f379d9a6c91e9a4ff4
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5f9151f7184cd624cfb65f6632564829537c034098c4ef670f20e3af246e13f
a67d07f733785876b3192826e76f537e2b9dc0be172ce52c773d30d65f712a07
aa0992b4e17a3324d53313c014452f8636a4c6b1b84d3187886c386140911535
aa33f4b5d3cb13bc8bd11502805c3768446add68dca5d6d54fe795c457b92b2b
aa3777d578531c63cb5b48a28d1f0135a9769ca2ee44ae916aadb341089140e1
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae3a15a3e9733515bb33d29c4820b33c0bcaf30a522fd034ea68d104939901d3
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1e5a5025b6049c1e87ce7e9efec1476f9b58bc36327cc505ae31fe2d325c38f
b334879acc4b0727c923f0a6d3cd92ce09a862177f284c659fd360ac1102f66f
b59aaa52856bba9541a1ddab168e5b814070257d1313d336d7cd287de4db4f70
b7620962cb744ae2dae99d5137906278ba4735b5dc197459df9a7f58b13e777d
b968113e586107906911e61864086ba097b7b45cf857c0de3c4fd20963a90e61
bbbca3bfd4fb515bc9b76ec7bac00902b0e183a29171df5ad78247430005e2b8
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4
bf92f433f079bd95dc306ba8b7a5c49ddf33398c9b625e1921c13e674b5847c9
c395d306f173cb32e68acf4ecf179deddcddfb19b8d7e265c37522def3528411
c51dd697125cf9563ec4eb9448565f811aaca22ee66f576745826360de7916b5
c55d8c697e74b3d7338e089170946e550f0323210925777120b5d284ec2291f4
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e
c7acbb66fbdc4771dd8e5aa9bb959a787551414fe2b3d8b49137633e85436349
d072a09604e6a1fea8ef42203503771aa36b63a3c91fd1059966e26e6f5812b3
d3f154bd52d039a8d725c3a790c0887142a2963f09b28c6280e4629ca8521e93
d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
da7ae7eec9c1f857161ad9356669f90a20a3e1bd18c8124b53cc2e367e04780b
dc2261fa7fc402f3869461ab510796c6a45c58b4910d7eaaf674bfefd5274e6c
ddbf19b4a1dc1544982a2859a72c0a5480b20ed16c6a82f0a02b83c846627f29
ddeb2faefdfb89545a8fab657a5b54d6c93d8ff75209623073945e893b916c71
e1bd3bddb431f871bdad6274d1c73b9b44a3296f1325e8856b7bc3b50230e171
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4090cf79081be69b3a450385c10be263550306372c37c21201ad4be617a687d
e4775032cfd2307097925e1350878f770d70d7f079626d3dec3fd2c63ea6dcb1
e47efff06b20e0e50bfa955e2d20d04f1ffb32a20f44fae848c2b53b1b55b11e
ea795a298e37c1cd48937e8d9b242162d213ebaa07c997769a6bfe4b4d8ec411
eaee2371582b8c319e9f7b6432b570d1c7cc5bda80a6d7819521c6df355c3f9b
ecb0a51c8bccd33964654ecedc1115640eec2c15b217d843df9ed2c36d358060
ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436
ed91fbb0cd9308f91f8e1fd93942c94ee850fc4161ed788b16f801b743c70b9b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef7a0ea88b04cbef7ca69faf5d4102cbc7e9090c9eab157a14493c9720bf7e62
f1676206981b31116d3091ab7a078623b1a7917ed5adef37f7b287bc1c429786
f9a455034ac38913326ae9786e02c8d48b2fd55a7ac3d4fc605131b0d1c1ffbb
fddeaef3163f57fc498b4de9db798b82b281d56f657c3dc40cd57dd69c8c1060
ff98baa3a990c2660c47a7587ba5fd0ad66cd548e9318522163653ed31e2fb7d

www.proxysite.com Open in urlscan Pro 35.171.101.160 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

189 Requests

93 %HTTPS

44 %IPv6

28 Domains

39 Subdomains

31 IPs

4 Countries

2091 kBTransfer

4747 kBSize

40 Cookies

7 Outgoing links

Page URL History

Redirected requests

189 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.proxysite.com Open in urlscan Pro
35.171.101.160 Public Scan

Screenshot
Live screenshot

Full Image

189
Requests

93 %
HTTPS

44 %
IPv6

28
Domains

39
Subdomains

31
IPs

4
Countries

2091 kB
Transfer

4747 kB
Size

40
Cookies

189 HTTP transactions
10 data transactions