www.bemoneyaware.com Open in urlscan Pro
194.1.147.13 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
Submission: On December 09 via api (December 9th 2022, 8:54:53 am UTC) from IT — Scanned from IT

Summary HTTP 187 Redirects Links 40 Behaviour Indicators

Summary

This website contacted 28 IPs in 6 countries across 25 domains to perform 187 HTTP transactions. The main IP is 194.1.147.13, located in Chicago, United States and belongs to WPX, BG. The main domain is www.bemoneyaware.com.
TLS certificate: Issued by R3 on November 13th 2022. Valid for: 3 months.

This is the only time www.bemoneyaware.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
13	194.1.147.13 194.1.147.13	210250 (WPX) (WPX)
4	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
30	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
18	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c08::9c	15169 (GOOGLE) (GOOGLE)
1 4	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:828::2001	15169 (GOOGLE) (GOOGLE)
39	2a00:1450:400... 2a00:1450:4001:811::2001	15169 (GOOGLE) (GOOGLE)
1	85.14.248.71 85.14.248.71	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
3	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
6 19	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
4 8	185.80.39.216 185.80.39.216	27381 (CASALE-MEDIA) (CASALE-MEDIA)
5 7	37.252.171.21 37.252.171.21	29990 (ASN-APPNEX) (ASN-APPNEX)
25	2a00:1450:400... 2a00:1450:4001:812::2006	15169 (GOOGLE) (GOOGLE)
4	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1 2	2620:116:800d... 2620:116:800d:21:e365:4988:e8a7:3270	16509 (AMAZON-02) (AMAZON-02)
2 2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
3 3	185.64.189.115 185.64.189.115	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	104.18.33.19 104.18.33.19	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8101:d648:86cf:755a:6dbf	16509 (AMAZON-02) (AMAZON-02)
1	216.58.212.166 216.58.212.166	15169 (GOOGLE) (GOOGLE)
1 1	35.157.182.139 35.157.182.139	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:20:... 2606:4700:20::681a:34	13335 (CLOUDFLAR...) (CLOUDFLARENET)
187	28

13 194.1.147.13 (Chicago, United States)

ASN210250 (WPX, BG)
PTR: wpx.net

www.bemoneyaware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.14.248.71 (Kamp-Lintfort, Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)

at.bahn.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 142.250.186.130 (United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 185.80.39.216 (Canada) 4 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 37.252.171.21 (Frankfurt am Main, Germany) 5 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2a00:1450:4001:812::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:e365:4988:e8a7:3270 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.189.115 (United Kingdom) 3 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.139 (Frankfurt am Main, Germany) 2 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.33.19 (None, ) 2 redirects

ASN13335 (CLOUDFLARENET, US)

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8101:d648:86cf:755a:6dbf (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.166 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s01-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.157.182.139 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-182-139.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:34 (United States)

ASN13335 (CLOUDFLARENET, US)

follow.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
69	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 101 tpc.googlesyndication.com — Cisco Umbrella Rank: 142	600 KB
41	doubleclick.net 6 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 34 stats.g.doubleclick.net — Cisco Umbrella Rank: 74 cm.g.doubleclick.net — Cisco Umbrella Rank: 205 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 298 ad.doubleclick.net — Cisco Umbrella Rank: 165	182 KB
25	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 269	659 KB
13	bemoneyaware.com www.bemoneyaware.com	580 KB
10	casalemedia.com 6 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 512 ssum-sec.casalemedia.com — Cisco Umbrella Rank: 415	8 KB
7	adnxs.com 5 redirects ib.adnxs.com — Cisco Umbrella Rank: 208	7 KB
7	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 371	134 KB
7	google.com 1 redirects adservice.google.com — Cisco Umbrella Rank: 70 www.google.com — Cisco Umbrella Rank: 2	2 KB
4	google.it adservice.google.it — Cisco Umbrella Rank: 45897 www.google.it — Cisco Umbrella Rank: 22553	2 KB
4	gstatic.com fonts.gstatic.com	116 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 36	3 KB
3	pubmatic.com 3 redirects image6.pubmatic.com — Cisco Umbrella Rank: 677	2 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 188	141 KB
2	rubiconproject.com 2 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 308	918 B
2	openx.net rtb.openx.net — Cisco Umbrella Rank: 1473	415 B
2	rlcdn.com 2 redirects id.rlcdn.com — Cisco Umbrella Rank: 549	573 B
2	quantserve.com 1 redirects cms.quantserve.com — Cisco Umbrella Rank: 630	792 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 26	20 KB
1	follow.it follow.it — Cisco Umbrella Rank: 135791	2 KB
1	agkn.com 1 redirects d.agkn.com — Cisco Umbrella Rank: 634	758 B
1	innovid.com ag.innovid.com — Cisco Umbrella Rank: 1505	297 B
1	bahn.de at.bahn.de — Cisco Umbrella Rank: 77451	1 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 837	698 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 47	43 KB
0	gemius.pl Failed googlecm.hit.gemius.pl Failed
187	25

	Domain	Requested by
39	tpc.googlesyndication.com	googleads.g.doubleclick.net www.bemoneyaware.com tpc.googlesyndication.com cdn.ampproject.org s0.2mdn.net pagead2.googlesyndication.com
30	pagead2.googlesyndication.com	www.bemoneyaware.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com s0.2mdn.net
25	s0.2mdn.net	www.bemoneyaware.com tpc.googlesyndication.com s0.2mdn.net
19	cm.g.doubleclick.net	6 redirects googleads.g.doubleclick.net
16	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net www.bemoneyaware.com
13	www.bemoneyaware.com	www.bemoneyaware.com
8	dsum-sec.casalemedia.com	4 redirects googleads.g.doubleclick.net
7	ib.adnxs.com	5 redirects googleads.g.doubleclick.net
7	cdn.ampproject.org	googleads.g.doubleclick.net pagead2.googlesyndication.com
4	googleads4.g.doubleclick.net	www.bemoneyaware.com
4	www.google.com	1 redirects www.bemoneyaware.com googleads.g.doubleclick.net tpc.googlesyndication.com
4	fonts.gstatic.com	fonts.googleapis.com
4	fonts.googleapis.com	www.bemoneyaware.com
3	image6.pubmatic.com	3 redirects
3	www.googletagservices.com	googleads.g.doubleclick.net
3	adservice.google.com	pagead2.googlesyndication.com
3	adservice.google.it	pagead2.googlesyndication.com
2	ssum-sec.casalemedia.com	2 redirects
2	pixel.rubiconproject.com	2 redirects
2	rtb.openx.net	googleads.g.doubleclick.net
2	id.rlcdn.com	2 redirects
2	cms.quantserve.com	1 redirects googleads.g.doubleclick.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	follow.it
1	d.agkn.com	1 redirects
1	ad.doubleclick.net	googleads.g.doubleclick.net
1	ag.innovid.com	googleads.g.doubleclick.net
1	at.bahn.de	googleads.g.doubleclick.net
1	www.google.it	www.bemoneyaware.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.googletagmanager.com	www.bemoneyaware.com
0	googlecm.hit.gemius.pl Failed	googleads.g.doubleclick.net
187	33

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
www.linkedin.com
www.instagram.com
www.printfriendly.com
reddit.com
api.whatsapp.com
bemoneyaware.com
mkerj.com
www.vikramsuryawanshi.com
akismet.com
www.youtube.com
mailchi.mp
follow.it
www.quora.com
in.pinterest.com
instagram.com
www.elegantthemes.com
www.wordpress.org
www.instamojo.com
bemoneyaware.spayee.com
bemoneyaware.myinstamojo.com
123movies.hair
www.replybuy.com
movies123.sbs
cuevana.email

Subject Issuer	Validity	Valid
bemoneyaware.com R3	`2022-11-13` - `2023-02-11`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.google.it GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
at.bahn.de GeoTrust TLS RSA CA G1	`2021-12-06` - `2022-12-30`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.innovid.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2022-03-15` - `2023-04-15`	a year	crt.sh
follow.it R3	`2022-12-05` - `2023-03-05`	3 months	crt.sh

This page contains 25 frames:

Primary Page: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
Frame ID: BCAAC234F15465135D80F99D95327A46
Requests: 53 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20221206/r20190131/zrt_lookup.html
Frame ID: 905064C86CAFE6137534C8C21B81FD21
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6070398767421094&output=html&h=250&slotname=2336220800&adk=2712813064&adf=63464297&pi=t.ma~as.2336220800&w=300&lmt=1670575821&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086290&bpp=25&bdt=532&idt=280&shv=r20221206&mjsv=m202212010101&ptt=5&saldr=sa&abxe=1&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=508&ady=4687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7Cpebr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=wIKkEHJaF3&p=https%3A//www.bemoneyaware.com&dtd=301
Frame ID: 6725B75931AC983E9FF3C394EB7AEF53
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2575021678&adk=3021408649&adf=714983735&pi=t.ma~as.2575021678&w=716&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=716x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086389&bpp=9&bdt=630&idt=323&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=307&ady=2028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=UK5BeNeO4I&p=https%3A//www.bemoneyaware.com&dtd=350
Frame ID: 2438C022CC78EB85DBE895585DEE8777
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2420045140&adk=3858830745&adf=2329611710&pi=t.ma~as.2420045140&w=795&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=795x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086398&bpp=3&bdt=639&idt=378&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_fmts=716x280&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=260&ady=2970&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=e35IBEzdEe&p=https%3A//www.bemoneyaware.com&dtd=406
Frame ID: 662C789FF99EB496E11E69F11E7C996C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&slotname=2346077534&adk=577862522&adf=3324056184&pi=t.ma~as.2346077534&w=0&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=12&format=0xnull&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&fwrattr=true&rh=0&rw=0&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086401&bpp=4&bdt=643&idt=483&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_fmts=716x280%2C795x280&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=658&ady=3716&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&fu=128&bc=31&ifi=4&uci=a!4&btvi=4&fsb=1&xpc=zglLBKAeQ7&p=https%3A//www.bemoneyaware.com&dtd=486
Frame ID: 19281DAD5FC29C1758B9063E4FE33EC4
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=8599118285&adk=2970099097&adf=249810244&pi=t.ma~as.8599118285&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086405&bpp=1&bdt=646&idt=505&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CneEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=5&uci=a!5&fsb=1&xpc=z6GTTIbjGR&p=https%3A//www.bemoneyaware.com&dtd=510
Frame ID: A414091C5E666A3729837B4E8217C1D1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=4089115291&adk=2767514032&adf=1078849241&pi=t.ma~as.4089115291&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086408&bpp=2&bdt=650&idt=520&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull%2C336x280&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1145&ady=3369&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=fArseK1ySW&p=https%3A//www.bemoneyaware.com&dtd=525
Frame ID: 2CAADE0E64ECAFDEE6388CD149FDF718
Requests: 22 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012211060024000/amp4ads-v0.mjs
Frame ID: 224BD9A75C68898D9065DD0D41F15A99
Requests: 25 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhj5oqp5MAE&v=APEucNW_D0GMM7_60ZG2ExjIBANpIYZCCI9SyITGfEys6rUFy5w8YTGKEL3dGhCdrEXhSPRzvLtcdEJ9jPWOxGTD0ScTFycw8vmdB8i3p3iOcYYhsB-1tAm62zOG5Fl3AYa69KWZmQxVhVvgpjXozB1CYuYpTu8iP9Tg2YHqTm6o0WRyB2MKV6M
Frame ID: C9156A9D160D79F9ECD226D448303919
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bdf3lBaIvlRANq1FH58fug2IVbSuDcv4BpBmthXq5z140yOXPtyLFeUJmgHv5ydCyqfuZpyYbkaps2xiAPk9CeZMvMOuNiJyT2dNDtzl6HOKYoXMxEN47lE_D2R8ENS_C_iVlf_h2MloefrXSDsm0oEAlgyr2OP5KCgDvaxfRgy78pflg&dbm_d=AKAmf-DDB8PisVO7dgqeDDIUDvg4GNuZWm6EFVH5at94xnqPrBY5qqW5C38mKohMR9v9_fGWrmTKnhQDaFgb7fYwHxqZngq0rUZ4237P31XKGZT1CxO9Qgkhq20OkSfDRuYECxtC3o2XGM4RGoTE7RtJ4m5Az-JujgWp8ln4UIScfEZjdMSDiywm-wXOkO2vFpjpXWvb9ZmYB7VvJk_bAlZpd4YZcPMdxbZs8LGjt2Pk04wnHXLVKT-3bYWcityDxZV_i1MpHkJhhc0KDisIMYZxjxlk_rwe6V_bziJiqmPV5CgMegmkRyiDfj_XYfWrZ-KZ21ERwSxacOSQe5WlxRp-GM5GBrvcvX2PLfb5ceSXcDip-PFut9pQtMSdxe_aMfbjrPlA99okOa-qx425LDs6BBolXYlmUEHOiDKE-UCneHvGxQShoUqr9L9YZUjfeuyoVRKRPwIw_2hOtFKYqsBl12wRsuSqzz9w2EPdB6BCTVc12GDHUAYDca5YRSbfMhjIfy68p8y7lxCR6G5mwB5KJrQNsU-eal6FcglwMym63yswQMTXMZF9umSTNhFiiq7E2qhJtQUnAZSuiUn-5SyFa0k2QldBvCL2HJAOzKUiepp7gxlfjuOoss9YgbwWuGBdXsYvEzWUlD59FI11bi91jXSrhy9b4ll0T1yaX88d5PlFowbGcTHTYxJutKMAi6rt-MvTd4NZnmEVWuxNQQyo3WaoSo0UugrLTzUxOGeodHRgGE4y2URo2MlID1nzHfiKaTKgNLhhAHJK-Rcp7tfNOCZTDY_t_UGvd2K0KBBgSoR1i7Yxf5A6vh-bE3yCkIc2RP2W7yct4_MWVbETpM75Ts33vMm1tM8dbHvJr9iEnm64dpCTxU5ro7I_EP-TN9aV_WpImBgdByBIROA_zZostusJ8g_krtQFwL-WwRlOuH9GoGx7_2tcLMmpIf1-y5Sy4zEt-OV1lQEJ7IKvOkzxi96xUY4bIA7_OcJxdFOQ_tVNTfbKYDOmEO3x2vUPVtb6K4tDv_3gXSe5J2keVkQYbc5v3pmzqsZ2HlwfY5TE-ippVhpwwC99lE-yQuX9H9wqaXLBM4Sjm27qJSli-VpA-cRpt1p5dE0-cIPIam_wbz9Nh8Q9VVqiQKUjW04aLI2YJjmFBmE2TrftVVWc5pXVXLvnT130pRqmDPKxdCeXsP0Ub46Nr9PpImPuNtzWc_1i2qmVkEBLdE0pbdfPOqLHXPS_BXWke1GrmcHxvnKU53rvkt2VRuKzWXdg1gLqFw1nbxzxfNQpA1FRo9hx-pYDB2Eg-09ojmIwmu1RsE3hg7bCIIBmLd56e-2xI7oj3q-F4IPZK9qDF_ompv-gA2lBubU5hfl3OYWhRjBynnlkD-JkcfoNAiqMrfHhDcJAAg62cD7P9jc_uUocA59uDtIzxGDrHxUS_YWrXxjcFW-lPF9yH1RjwBOUOqZb7mfWnjyeMwEO5BQj3b4u2j8trZmv1pR5DkHsAuVKukg4cnjpSoCmjiB66Xuin9-yiPDDiV6bRp8imi54Bbh8hTpVT4VtaesswYVQ7vRe7ToFGSwetVn3LnPXMgNEosS7hDwA3vpf78O_fVBR63YHcGZGd1G_z9SQPnA-BC4qn1YdUVDMLX8OmcDmVBhu3R6wZO7yULorp1yU6dujuC11zxkjyFbaAPNIE16RgQIDdWV_nOQYROjP7LcW_biRNTBGK5TuRK-4GqS-khH9z18WTgozWzqAl5k14m2XzEhn9zwQhNHBmst9Pphub1h2WVeXZlga77DzZdNMn6frN4pHGVghQon7Efvnnkbh2T95wqKtdyzdfZYsSgT6krGXFD-Rn2qHuOQzC1G1JJrezzufs6roYu-S1qXtW3U8o7UU2WDb9ZYDRvoelL_DVfgY7s-5uWycVLCNVsvEnmzIzdpohIsgjzNQatKmLWohlubwHMPkgbzdpFOWKKulpXBpZo5DvmRXdh7IohV2Nfc6GoY1qL0r3jL8FxKJGig2hbniKml__7Dh4nJQa5NflqEfj3IzijSjPF_v359thhUdjQoCEJ3XMRuLoaJ-EXzcTnmZxF6_FFUTgzueqTUnug107czPiutscNhfbRZKCJmMpTOH0ZyLNs6Sjr3bWkJkvMoTxnwlH_hdb7jIzTP_aIz7Itm2UISKuyMG9Xl3YJ_xLhYUuTM63ngKSk5lZOND1RdKIsSU2o-phgsaQTuNRTIplZrnumkGTrhibaFuYJIG5RVtdtt4YifyDarSKncZi03hUbvsne0VhqMqzRzwwvl8Ajv3zO4y0sGPUyQpC3YVB5Ldra0tt--UmremEvI7O1uusq6MRiItaJt8mF2ongzNT4X9HVDoPZU8dFyKKEH318GPV3nxO6LTSkT1MRSeUjgWNy32IedvVw2qtOqjm428IA8_-yU0tkLcoMTXkmjd4axv_9m9dxrnsFlJrFitJDumXi3hu_3niob0vs86A5TG0oi7mg7uRb__JxMkdwXdzObmy-cSUmlExo8cJocMTSUbqMbaR3v-KY4VnzHd_Di08dp_Iz2N0bWlm9dHIKOIHxI3u9yXyZsFu5CzHj1jGmb3PpVMatxxGv2PMitJS1pds8vfDQpSrKhx0LEGw46i_extLTBjq20n3jBEpt6sk7QiG95157_DLU8sLIGz2pp6gk0Q8ylBjrsreUs7LWaQs3KVOq07kb8psWeXj-hreqjSurTaPalybtSkAYWd8JTN1hYcYL2F1Vj7EOh8y38jHjHp6j6L3GlzPgKjM_PTHyzgX2TLOaBhZcQgf_FmJZxX3a5bIHmHkpTcotqBYoXimqBw_Cl0TM8sJM3AmkiphXMAk3aH9OigUBaZ3rnkMWsq5gVS0LS6oRjLTb2VRJ70Sox8jgMpCHr4Zx0zhk-Bpz3CMdBwxsndEMpBTeoex-zrViWDAiwNmk71gJO2W3dwcCP3iuEUCtJCeFc74rQHy9hIR4ZoxFNLfx6DJv08wvzdbz_H0LqctJfSPj4wNUrs8JeSbryvWgY0VegYOJUnxXmfzkye5uLIrYnXg0Dmn8Pd1G-dqrJ_kiDYhE_YILkCS7_4gBQfaGjiSFySZxjQifpCKPCKkzcByV_yW98Ni4Axf1UqseW9xlhmo615QeedA6Kfa7hYBIeKCS4IZn5-rhs6S_3AfaqAkZLIlWnDPGydFmTcNw5Bem8-HoVONdTIE8PEq9juJPtmnvToJWwMsLGEYlKg_o_w9g7qMqJCDra-YVSQBh5T5HayDH3UNS7C0y6YQyT2dP6xicdoUeKG6HGsdNXEvjTJ2b8_8Aj9F5gB9gN5Zk0Fu0IoDB-ldWic5e_aXdb9uON2qFY2OyscOp73ZMOFxXZ41hMJV2FOZpAJlr_A1IBV3XOi4neEyvJtElRDh3WTa_A1EyODX60PFIY7PoFN4vdffkIGDcMF0TA&cid=CAQSOwDq26N94bgnNXg9b7--VsMZK3D_NdWnmuw7J1NoGpXhFU7OQI91MLJI0KW42LMzab-r1giTFicjla61GAEgEw&rfl=2%2Chttps%253A%252F%252Fwww.bemoneyaware.com%252F%240
Frame ID: C8D1D7EB82E1FEE54F6AC471170BEBE6
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPn2QIQm5vbAhjN2bJ0MAE&v=APEucNVTo6hhSvqHBYMCk_EXt2uYA514vioiXFDjMY2DhhAUXmDvavjiWbhbnlOhqfWL70UtFqqF5RncUJNbgVqWHKjk9qjZN1vKWlgCGQ8OOFyfvQkNxIQksdiIrq1lp0Z7vHkuxbeZr5TNNS4M4rfLt460xqGLDcBocJfc2D-MAyKFtsZZcPk
Frame ID: AB766AD814678DE25E0A35E166B3425E
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/300x250.html
Frame ID: E7C9DBF512038D1295172AF4B470B19B
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CuWMe1veSY__gL-KWxdwPwM6owALW_ZfqbfOXyqP7EP_Ror3AARABIL-7yCRglYKAgJgHoAGIv9fIA8gBCakCx73En9C9sT6oAwHIA0iqBIQCT9A5-oIM1Fl9m6p0bn15gXQOmDoIygDkRXvFuwrGf5ZBI22Nrj3e8B_NlvzdOQ1cG3TQ83m_2XSmRXE-2Q7Wo1aaq1pGt78XjON2qYOyxQ43UHvsNFPxzhEWmTItF7nDDGJLJCIqJ0zux2Eu5V06qhuw-25uLpIZ8junCCJyxmvSGcVwa9x-XLxnkErQlaBHXTktd40VI8PnU09KNP106dh9OQOSe0aTgJYy27h-pFEKPLnltzF1mgpaMcmL6MWizk266V0ydvCqFvX_w4AiPIXtRDo6G80oeZndTCAmUaddzqOKjLqEGK_qONBBle4V8kcQpkOk0EXaJ95XjpQqN3GX9MbABNz_keicBJIFBAgEGAGSBQQIBRgEoAYugAfgwKg3qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQmt4q0ggRCIDhgBAQARgfMgKqAjoCgECACgHICwHYEw3QFQGYFgGAFwGyFxwKGggAEhRwdWItNjgzNDUzNTczMTQ0NzI3NhgA&sigh=FtdqwKugNHk&uach_m=[UACH]&cid=CAQSGwDq26N9GN00FF2vThrs7r8Fnmj95hxQA_XF-BgBIBM&template_id=419
Frame ID: 4BE95E5D6025F080FA25C5EB060468EA
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 4EC4F0E2F244966A4F55CEA5B736DFB6
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: DD7E28ECC06881F98F16B2ED74A26C9A
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/7024728442041512453/index.html?e=69&leftOffset=0&topOffset=0&c=QG7HTTm4qs&t=1&renderingType=2&ev=01_247
Frame ID: 5735967AB27D09AEF0DEEDECD94F3A1E
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: FFDE6AD6E4B01DE74AC1D4F29EE0B593
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0CFA4396D254B0B8DDCD055F8084817C
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
Frame ID: 2D3AE038856F28F4A9AF4AD1A355BA2A
Requests: 15 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 2E15112FC968CCFA72D3BF40A8D8547D
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6070398767421094&output=html&adk=1812271804&adf=3025194257&lmt=1670575821&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C41%3A32&format=0x0&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576088532&bpp=2&bdt=2774&idt=2&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull%2C336x280%2C336x280&prev_slotnames=2336220800&nras=1&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=8&uci=a!8&fsb=1&dtd=12
Frame ID: 0D37CB303018FEF73F2A6D4EE96CEF90
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/QDrzY6hqzGh0aYGUuTA1ex70oaN1LFGaXyg_pTqcRvs.js
Frame ID: 5C469534A0C1583D2C187B7630B547F4
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 0AD8D9B50B3E04F0CDFC45E3C5C4B97D
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: DD32F563E0EBCC19C79AD38A10FB55BD
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

How to Claim HRA : Rental Agreement and Rental Receipt

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/pagead/show_ads\.js

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Page Statistics

187
Requests

90 %
HTTPS

59 %
IPv6

25
Domains

33
Subdomains

28
IPs

6
Countries

2491 kB
Transfer

7179 kB
Size

26
Cookies

40 Outgoing links

These are links going to different origins than the main page.

URL: http://twitter.com/intent/tweet?via=bemoneyaware&text=How%20to%20Claim%20HRA%20%3A%20Rental%20Agreement%20and%20Rental%20Receipt&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&title=How%20to%20Claim%20HRA%20%3A%20Rental%20Agreement%20and%20Rental%20Receipt

Search URL Search Domain Scan URL

URL: https://www.instagram.com/bemoneyaware

Search URL Search Domain Scan URL

URL: http://www.printfriendly.com/print?url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&partner=a2a

Search URL Search Domain Scan URL

URL: http://reddit.com/submit?url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&title=How%20to%20Claim%20HRA%20%3A%20Rental%20Agreement%20and%20Rental%20Receipt

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=How%20to%20Claim%20HRA%20%3A%20Rental%20Agreement%20and%20Rental%20Receipt%20https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F

Search URL Search Domain Scan URL

URL: http://bemoneyaware.com/
Title: bemoneyaware

Search URL Search Domain Scan URL

URL: http://mkerj.com/demonetisation-of-indian-currency-a-detailed-study-part-1/
Title: Subhodeep Mukhopadhyay

Search URL Search Domain Scan URL

URL: http://www.vikramsuryawanshi.com/
Title: Vikram Suryawanshi

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=6Fa0v_rotp4
Title: How to file ITR1 new Income Tax Website, for salaried with Bank Interest

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=rVYrDVKvXmI
Title: Income Tax on shares and Mutual Funds: Dividend, Trading

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=wGjqWBo2FQc
Title: What are Income tax slabs?

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=pSxk7dN_zNQ
Title: Income Tax and Salary

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=hINESWKfLko
Title: Capital gains on stocks

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=FISP51XwBOQ;
Title: Types of Income

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=ybMlNzwPjFs
Title: How to show House Property in Income Tax Return

Search URL Search Domain Scan URL

URL: https://mailchi.mp/9903b38b5bb7/free-ebook-on-income-tax
Title: here

Search URL Search Domain Scan URL

URL: https://mailchi.mp/a3c14bc89874/ko4bpzybe9
Title: here

Search URL Search Domain Scan URL

URL: https://mailchi.mp/b3528876cdc5/qzv8yfqtkj
Title: here

Search URL Search Domain Scan URL

URL: https://mailchi.mp/499eb4268398/18dt742220
Title: here

Search URL Search Domain Scan URL

URL: https://follow.it/
Title: Powered by <img src="https://follow.it/static/img/colored-logo.svg" alt="follow.it" height="17px"/>

Search URL Search Domain Scan URL

URL: https://www.quora.com/profile/Kirti-Bemoneyaware?q=bemoneyaware
Title: Quora

Search URL Search Domain Scan URL

URL: https://twitter.com/bemoneyaware
Title: Twitter (@bemoneyaware.com)

Search URL Search Domain Scan URL

URL: https://www.facebook.com/bemoneyaware
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJ7jNTZ7ia3D_WjdNOmAfiQ
Title: YouTube

Search URL Search Domain Scan URL

URL: https://in.pinterest.com/bemoneyaware/
Title: Pinterest

Search URL Search Domain Scan URL

URL: https://www.instagram.com/bemoneyaware/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.facebook.com/bemoneyaware/

Search URL Search Domain Scan URL

URL: https://instagram.com/bemoneyaware

Search URL Search Domain Scan URL

URL: http://www.elegantthemes.com/
Title: Elegant Themes

Search URL Search Domain Scan URL

URL: http://www.wordpress.org/
Title: WordPress

Search URL Search Domain Scan URL

URL: https://www.instamojo.com/bemoneyaware/lets-learn-money-workbook/
Title: here

Search URL Search Domain Scan URL

URL: https://bemoneyaware.spayee.com/courses/Learn-Income-Tax-610f735d0cf2010a9eb58ba3;SESSIONID=85D6F97BE9E45371E2A8590EC9E0B84E
Title: here

Search URL Search Domain Scan URL

URL: https://bemoneyaware.myinstamojo.com/product/857530/be-income-tax-aware/
Title: here

Search URL Search Domain Scan URL

URL: https://123movies.hair/
Title: 123movies

Search URL Search Domain Scan URL

URL: https://www.replybuy.com/movie-box-pro-apk/
Title: moviebox pro apk

Search URL Search Domain Scan URL

URL: https://movies123.sbs/
Title: 123 free movies

Search URL Search Domain Scan URL

URL: https://cuevana.email/
Title: cuevana.email

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 88

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1

Request Chain 89

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y5L31zC8sk1716gJNi9AWAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1

Request Chain 90

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEB2jNQFeJFjQyBuCcOJgX5I&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEB2jNQFeJFjQyBuCcOJgX5I%26google_cver%3D1

Request Chain 91

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3NDAzNTExNTg3NTM0MjQzOQ%3D%3D

Request Chain 92

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1

Request Chain 93

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y5L31zC8sk1716gJNi9AWAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1

Request Chain 94

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEB2jNQFeJFjQyBuCcOJgX5I&google_cver=1

Request Chain 95

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzEzNTgzNzgxMTA3NzMwMDYzNQ%3D%3D

Request Chain 126

https://id.rlcdn.com/466606.gif?cparams=google_push%3DASkJ3FZ5JwYbrqbQeTZHfAOI4hKs7mXC6eTGjLODRym9BxAZNmbW0CbnNNqZJwotpx9O9fsSmJUMm3XF6_qGwV5lClY9swY6wKgK&google_gid=CAESEPErweKkDqx3qdZNERyQYVw&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCNjvy5wGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BU2tKM0ZaNUp3WWJycWJRZVRaSGZBT0k0aEtzN21YQzZlVEdqTE9EUnltOUJ4QVpObWJXMENibk5OcVpKd290cHg5Tzlmc1NtSlVNbTNYRjZfcUd3VjVsQ2xZOXN3WTZ3S2dL HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwZWZwdGNCVkw0Z3kyNVloM053SnljY0tBYVREbUFDUE5iQ3h2LVQ2X2dsOA==&google_push

Request Chain 128

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBV28Z_GoL0hLdxQ8hR6h7U&google_cver=1&google_push=ASkJ3FZf6jSM7mxOrcpJwokB7d6cLkvyLB6JtITkig07meOkZMFhIoTkE_gGdblZNyUgNqy6KXSKjPD2bdHKrkWMcw2jmwRnkJtZ HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBV28Z_GoL0hLdxQ8hR6h7U&google_cver=1&google_push=ASkJ3FZf6jSM7mxOrcpJwokB7d6cLkvyLB6JtITkig07meOkZMFhIoTkE_gGdblZNyUgNqy6KXSKjPD2bdHKrkWMcw2jmwRnkJtZ&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=v7hVA1oST6WLYzsTbpf7cA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FZf6jSM7mxOrcpJwokB7d6cLkvyLB6JtITkig07meOkZMFhIoTkE_gGdblZNyUgNqy6KXSKjPD2bdHKrkWMcw2jmwRnkJtZ

Request Chain 129

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFM6KxXadgy6Cr-wJBBStRg&google_cver=1&google_push=ASkJ3FYR9RzJam3No2rfQjuRAP7tyTQibGm-3jOZr5gDq9rb01sG6IpGig0EpXFbhIvOViIjGq-lylMDn8E8LXilXwwN5PqBOBQ_ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJHOVZCQ1ktMVMtRUpWTA==&google_push=ASkJ3FYR9RzJam3No2rfQjuRAP7tyTQibGm-3jOZr5gDq9rb01sG6IpGig0EpXFbhIvOViIjGq-lylMDn8E8LXilXwwN5PqBOBQ_

Request Chain 130

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEEEe9567MrcnsopaDQxSyaI&google_cver=1&google_push=ASkJ3FZQ_gdNtSsZcmmt8QcApaXapAs1gK3cW1A99Z-91qg-Xds2Pb3hH0iNiBtun-H8YvexjLqEYJ9iA_5vpi2kOht2KOP8h7E3 HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEEe9567MrcnsopaDQxSyaI&google_hm=Y5L31zC8sk1716gJNi9AWAAAFDEAAAIB&google_nid=index&google_push=ASkJ3FZQ_gdNtSsZcmmt8QcApaXapAs1gK3cW1A99Z-91qg-Xds2Pb3hH0iNiBtun-H8YvexjLqEYJ9iA_5vpi2kOht2KOP8h7E3

Request Chain 133

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 144

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGz7pp4i4HUYgJfeyREVt90&google_cver=1&google_push=ASkJ3FYWUamCiaGf8lTQ4LwPIbkM-KEGfebsnYhOsaf13NpnI0jHDf4B4RCn2Bmw9jAFzsmNGyBD4_i0cI_JOArQ1jnri9cZeAKg HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3FYWUamCiaGf8lTQ4LwPIbkM-KEGfebsnYhOsaf13NpnI0jHDf4B4RCn2Bmw9jAFzsmNGyBD4_i0cI_JOArQ1jnri9cZeAKg&google_hm=6hTfSS19MkjG5dU4kn0xKg

Request Chain 145

https://d.agkn.com/pixel/2175/?google_gid=CAESEHDMb5gAQ-jftrGyQQz6q3U&google_cver=1&google_push=ASkJ3Fa4YSux9ekF12WzldEyaTlbBs033TbXV04X2i8rHryRUqweO0p65c9UtADXa7uDQannkMhjdxCHkw6S3ZuRVV_W5oaVCPk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ASkJ3Fa4YSux9ekF12WzldEyaTlbBs033TbXV04X2i8rHryRUqweO0p65c9UtADXa7uDQannkMhjdxCHkw6S3ZuRVV_W5oaVCPk&google_hm=Q0FFU0VIRE1iNWdBUS1qZnRyR3lRUXo2cTNV

Request Chain 147

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESELKUzQlIUxlD49YohzfuAkc&google_cver=1&google_push=ASkJ3FaWZd6RUqI-fk1H4irV6ULfgqqxSpBZW5G7EypMwJDQWD43z8yYCxkAG4_dUqXP_-FzpHSxPr1S2wMwe6ExlWT3jopba64 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8bL6J4NPQrWP1cPF1r1S9Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FaWZd6RUqI-fk1H4irV6ULfgqqxSpBZW5G7EypMwJDQWD43z8yYCxkAG4_dUqXP_-FzpHSxPr1S2wMwe6ExlWT3jopba64

Request Chain 148

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEMA2TIDGuftbp_yrW-YhYYM&google_cver=1&google_push=ASkJ3FZskxmHUtIAK0xQ8M_uSJt_Llq_Y7YorNE_AcbO3OlEPB6xpiyVhlBg0g7vOI6fUg8ayYonmhJir1QEpVLhDhTeqIf4omU- HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJHOVZCRUYtOS1MUDgy&google_push=ASkJ3FZskxmHUtIAK0xQ8M_uSJt_Llq_Y7YorNE_AcbO3OlEPB6xpiyVhlBg0g7vOI6fUg8ayYonmhJir1QEpVLhDhTeqIf4omU-

Request Chain 149

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIxJFs3xs-tz4UM0PivsYrQ&google_cver=1&google_push=ASkJ3FaxOvUVoXs4NC07XXV1sZpeG_bbNLabsWRyCr-K-UElhgweKC_Q00NaOkmk1eWPvqNpqXb6-2TS2WlXrqVxOK2poNWzDDdb HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIxJFs3xs-tz4UM0PivsYrQ&google_hm=Y5L31zC8sk1716gJNi9AWAAAFDEAAAIB&google_nid=index&google_push=ASkJ3FaxOvUVoXs4NC07XXV1sZpeG_bbNLabsWRyCr-K-UElhgweKC_Q00NaOkmk1eWPvqNpqXb6-2TS2WlXrqVxOK2poNWzDDdb

187 HTTP transactions
14 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/ 168 KB
38 KB 1919ms
1617ms Document
text/html 194.1.147.13
WPX

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 194.1.147.13 Chicago, United States, ASN210250 (WPX, BG),
Reverse DNS: wpx.net
Software: WPX CLOUD/MUM02 / W3 Total Cache/2.2.7
Resource Hash: da87dd7ab35ddf7998250f5f26647d3bacb1ad54671f0fbe4427917879aa07e8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: public, max-age=3336,public
content-encoding: gzip
content-length: 38063
content-type: text/html; charset=UTF-8
date: Fri, 09 Dec 2022 08:54:45 GMT
etag: "94af-6392f6cd-0;gz"
expires: Fri, 09 Dec 2022 09:50:21 GMT
last-modified: Fri, 09 Dec 2022 08:50:21 GMT
pragma: public
referrer-policy
server: WPX CLOUD/MUM02
vary: Accept-Encoding,Origin
wpx: 1
x-cache-status: EXPIRED
x-edge-location: WPX CLOUD/MUM02
x-powered-by: W3 Total Cache/2.2.7
x-turbo-charged-by: LiteSpeed

GET
H2 200 autoptimize_a8a035592b1096228ff135cab1d72334.php
www.bemoneyaware.com/blog/wp-content/cache/autoptimize/ 935 KB
103 KB 196ms
195ms Stylesheet
text/css 194.1.147.13
WPX

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bemoneyaware.com/blog/wp-content/cache/autoptimize/autoptimize_a8a035592b1096228ff135cab1d72334.php
Requested by: Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 194.1.147.13 Chicago, United States, ASN210250 (WPX, BG),
Reverse DNS: wpx.net
Software: WPX CLOUD/MUM02 / PHP/7.4.33
Resource Hash: 34b093d08aa54a3c2228554692e7c6cb2b6b5bdab1c27b88d4303fb11686e984

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:45 GMT
content-encoding: gzip
wpx: 1
x-edge-location: WPX CLOUD/MUM02
x-powered-by: PHP/7.4.33
x-cache-status: HIT
content-length: 104639
referrer-policy
last-modified: Wed, 30 Nov 2022 18:04:02 GMT
server: WPX CLOUD/MUM02
etag: 72f6b9bed3aa04e0ce59136e74bce773
vary: Accept-Encoding,Origin
content-type: text/css; charset=utf-8
cache-control: max-age=30672000, public, immutable,public, immutable
x-turbo-charged-by: LiteSpeed
expires: Mon, 20 Nov 2023 18:05:53 GMT

GET
H2 200 css
fonts.googleapis.com/ 28 KB
2 KB 96ms
36ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext&display=swap

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

64e4de71a710bbb6b7bc79ec8e2bf2d9b3132e8330d29b6d50479eb95238e8d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 09 Dec 2022 08:54:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 09 Dec 2022 06:55:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 09 Dec 2022 08:54:45 GMT

GET
H2 200 autoptimize_single_6950450ea49051d4bc6203ef7befe3dd.php
www.bemoneyaware.com/blog/wp-content/cache/autoptimize/ 17 KB
3 KB 365ms
364ms Stylesheet
text/css 194.1.147.13
WPX

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bemoneyaware.com/blog/wp-content/cache/autoptimize/autoptimize_single_6950450ea49051d4bc6203ef7befe3dd.php?generated=1670391754&ver=1.17.1
Requested by: Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 194.1.147.13 Chicago, United States, ASN210250 (WPX, BG),
Reverse DNS: wpx.net
Software: WPX CLOUD/MUM02 / PHP/7.4.33
Resource Hash: d33738e5aac550f1e9adc6e0539eacb19ce18fce287284ff496473523f9930f4

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:45 GMT
content-encoding: gzip
wpx: 1
x-edge-location: WPX CLOUD/MUM02
x-powered-by: PHP/7.4.33
x-cache-status: HIT
content-length: 3107
referrer-policy
last-modified: Wed, 07 Dec 2022 05:42:34 GMT
server: WPX CLOUD/MUM02
etag: a918da914f7325f4cba2a38ea604fe4c
vary: Accept-Encoding,Origin
content-type: text/css; charset=utf-8
cache-control: max-age=30672000, public, immutable,public, immutable
x-turbo-charged-by: LiteSpeed
expires: Mon, 27 Nov 2023 05:47:51 GMT

GET
H2 200 modules.ttf
www.bemoneyaware.com/blog/wp-content/themes/Divi/core/admin/fonts/ 90 KB
37 KB 366ms
365ms Font
application/x-font-ttf 194.1.147.13
WPX

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bemoneyaware.com/blog/wp-content/themes/Divi/core/admin/fonts/modules.ttf?x74955
Requested by: Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 194.1.147.13 Chicago, United States, ASN210250 (WPX, BG),
Reverse DNS: wpx.net
Software: WPX CLOUD/MUM02 / W3 Total Cache/2.2.6
Resource Hash: d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09

Request headers

Referer: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
Origin: https://www.bemoneyaware.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:45 GMT
content-encoding: gzip
wpx: 1
x-edge-location: WPX CLOUD/MUM02
x-powered-by: W3 Total Cache/2.2.6
x-cache-status: HIT
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
pragma: public
referrer-policy
last-modified: Tue, 27 Jul 2021 14:10:48 GMT
server: WPX CLOUD/MUM02
etag: W/"168f0-610013e8-0;;;"
vary: Accept-Encoding, Accept-Encoding,Origin
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000,public
x-turbo-charged-by: LiteSpeed
expires: Wed, 01 Nov 2023 08:40:27 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
49 KB 125ms
125ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e9f7292b13bed639e5626c44800904b3bccc9a6b01b68ba76d9a586bc8c90ec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49750
x-xss-protection: 0
server: cafe
etag: 5195213065373244736
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 09 Dec 2022 08:54:46 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ 99 KB
34 KB 183ms
109ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fa185ff85c956667f099643c158e5e1c891e79bb25b06e2061b46cf52831b519

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34177
x-xss-protection: 0
server: cafe
etag: 14745064187262743953
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 09 Dec 2022 08:54:45 GMT

GET
H2 200 lazysizes.min.js Show response
www.bemoneyaware.com/blog/wp-content/plugins/autoptimize/classes/external/js/ 10 KB
4 KB 141ms
141ms Script
application/x-javascript 194.1.147.13
WPX

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bemoneyaware.com/blog/wp-content/plugins/autoptimize/classes/external/js/lazysizes.min.js?x74955&ao_version=3.1.4
Requested by: Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 194.1.147.13 Chicago, United States, ASN210250 (WPX, BG),
Reverse DNS: wpx.net
Software: WPX CLOUD/MUM02 / W3 Total Cache/2.2.7
Resource Hash: c4fada4accfa24704b54248bc5ce84acac50b6a059828b7714fe3006786c80c1

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: br
wpx: 1
x-edge-location: WPX CLOUD/MUM02
x-powered-by: W3 Total Cache/2.2.7
x-cache-status: HIT
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 3973
pragma: public
referrer-policy
last-modified: Sun, 04 Dec 2022 23:32:27 GMT
server: WPX CLOUD/MUM02
etag: "2655-638d2e0b-0;br"
vary: Accept-Encoding,Origin
content-type: application/x-javascript; charset=UTF-8
cache-control: public, max-age=31536000,public
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Fri, 08 Dec 2023 08:44:14 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 109 KB
43 KB 126ms
43ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-27294067-1

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7c064ac4fdd166247a08fbefae41e32efbb9efea2f128bc7d9a29ff5444420ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43583
x-xss-protection: 0
last-modified: Fri, 09 Dec 2022 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 09 Dec 2022 08:54:46 GMT

GET
H2 200 autoptimize_003dabe3f4f628db93ae7cc2f8bf3687.php Show response
www.bemoneyaware.com/blog/wp-content/cache/autoptimize/ 932 KB
261 KB 149ms
148ms Script
text/javascript 194.1.147.13
WPX

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bemoneyaware.com/blog/wp-content/cache/autoptimize/autoptimize_003dabe3f4f628db93ae7cc2f8bf3687.php
Requested by: Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 194.1.147.13 Chicago, United States, ASN210250 (WPX, BG),
Reverse DNS: wpx.net
Software: WPX CLOUD/MUM02 / PHP/7.4.33
Resource Hash: 1b145f5de94b21f5b930693b82900d817baaa91235c6313f26d08a9639eaa56e

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: gzip
wpx: 1
x-edge-location: WPX CLOUD/MUM02
x-powered-by: PHP/7.4.33
x-cache-status: HIT
content-length: 267054
referrer-policy
last-modified: Thu, 01 Dec 2022 18:04:42 GMT
server: WPX CLOUD/MUM02
etag: c57653cb90796c7c128d61b0743d6bcd
vary: Accept-Encoding,Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=30672000, public, immutable,public, immutable
x-turbo-charged-by: LiteSpeed
expires: Tue, 21 Nov 2023 18:04:43 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
624 B 36ms
35ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:700

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/wp-content/cache/autoptimize/autoptimize_a8a035592b1096228ff135cab1d72334.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5ba6af8bd340ffb7fb078568374df5d6c9918445b121f6cb0acf606368c5b7d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 09 Dec 2022 06:54:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 09 Dec 2022 08:54:46 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
601 B 38ms
37ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:400

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/wp-content/cache/autoptimize/autoptimize_a8a035592b1096228ff135cab1d72334.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a5feba8ce66eafb93cd4dfff5083877ea2b2bf8daaded3058288b7cddb956cfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 09 Dec 2022 07:13:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 09 Dec 2022 08:54:46 GMT

GET
H2 200 wp-emoji-release.min.js Show response
www.bemoneyaware.com/blog/wp-includes/js/ 14 KB
5 KB 318ms
317ms Script
application/x-javascript 194.1.147.13
WPX

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bemoneyaware.com/blog/wp-includes/js/wp-emoji-release.min.js?ver=5.7.8
Requested by: Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 194.1.147.13 Chicago, United States, ASN210250 (WPX, BG),
Reverse DNS: wpx.net
Software: WPX CLOUD/MUM02 / W3 Total Cache/2.2.7
Resource Hash: 0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: br
wpx: 1
x-edge-location: WPX CLOUD/MUM02
x-powered-by: W3 Total Cache/2.2.7
x-cache-status: HIT
content-length: 4316
pragma: public
referrer-policy
last-modified: Fri, 04 Feb 2022 13:10:39 GMT
server: WPX CLOUD/MUM02
etag: "3795-61fd25cf-0;br"
vary: Accept-Encoding,Origin
content-type: application/x-javascript; charset=UTF-8
cache-control: public, max-age=31536000,public
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Thu, 09 Nov 2023 15:07:11 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
636 B 35ms
35ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat|Acme

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/wp-content/cache/autoptimize/autoptimize_single_6950450ea49051d4bc6203ef7befe3dd.php?generated=1670391754&ver=1.17.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

51ab584a58493566e3bf50c4895210f8ba0e9ad7056bdf4dc8c27c13fbd40e03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 09 Dec 2022 07:11:10 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 09 Dec 2022 08:54:46 GMT

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9ac77d374e410c7e0fb62b7b666d1c44b77b0e30d70983914c939e25e77e0fc6

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 84ms
25ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bemoneyaware.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 18:50:24 GMT
x-content-type-options: nosniff
age: 309862
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Dec 2023 18:50:24 GMT

GET
H2 200 modules.ttf
www.bemoneyaware.com/blog/wp-content/themes/Divi/core/admin/fonts/ 90 KB
37 KB 312ms
311ms Font
application/x-font-ttf 194.1.147.13
WPX

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bemoneyaware.com/blog/wp-content/themes/Divi/core/admin/fonts/modules.ttf
Requested by: Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/wp-content/cache/autoptimize/autoptimize_a8a035592b1096228ff135cab1d72334.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 194.1.147.13 Chicago, United States, ASN210250 (WPX, BG),
Reverse DNS: wpx.net
Software: WPX CLOUD/MUM02 / W3 Total Cache/2.2.7
Resource Hash: d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09

Request headers

Referer: https://www.bemoneyaware.com/blog/wp-content/cache/autoptimize/autoptimize_a8a035592b1096228ff135cab1d72334.php
Origin: https://www.bemoneyaware.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: gzip
wpx: 1
x-edge-location: WPX CLOUD/MUM02
x-powered-by: W3 Total Cache/2.2.7
x-cache-status: HIT
pragma: public
referrer-policy
last-modified: Tue, 27 Jul 2021 14:10:48 GMT
server: WPX CLOUD/MUM02
etag: W/"168f0-610013e8-0;;;"
vary: Accept-Encoding, Accept-Encoding,Origin
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000,public
x-turbo-charged-by: LiteSpeed
expires: Fri, 17 Nov 2023 08:42:28 GMT

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e0569f549b2fcf32745dc19b9971be62bf165197fafc75f1c9f21575542afee7

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d6c1114b8bc6ff6ffbe61d49997eef7bde3979a5e9faed832725a47b1db82471

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/ 356 KB
117 KB 85ms
85ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6070398767421094&plah=www.bemoneyaware.com&bust=31071167

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ec092881f9311bb796210c9b26e09150111c0860d138e897357dfab96a3a9a5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119959
x-xss-protection: 0
server: cafe
etag: 15903361681905673383
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 09 Dec 2022 08:54:46 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v34/ 47 KB
47 KB 57ms
57ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bemoneyaware.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 17:36:16 GMT
x-content-type-options: nosniff
age: 314310
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47952
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:22:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Dec 2023 17:36:16 GMT

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1768c6968c0aa2c4961788900dad50f5fc13598e5d43a40f763d33c20579a81d

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a4713a493d065c0ffe22b6c1460b22bb20ff63c04b0ab4143742988aa7d6a208

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6fe6283d01856310c15f5ec0194115ee9e0b2d0142d358da1ecf75e3883282a7

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCuM73w5aXo.woff2
fonts.gstatic.com/s/montserrat/v25/ 13 KB
13 KB 79ms
26ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCuM73w5aXo.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f31b80562610135edd91a86ec7f243c5eeaec2ec08337e6a20c2d135d8e217da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bemoneyaware.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 06:45:13 GMT
x-content-type-options: nosniff
age: 7773
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12848
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:56:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 06:45:13 GMT

GET
H3 200 JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2
fonts.gstatic.com/s/montserrat/v25/ 12 KB
12 KB 85ms
32ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ddc148b8a0a27b1449fda6033f4a0defac9bd43210117b50d5d7ad1eda09f394

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bemoneyaware.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 21:34:14 GMT
x-content-type-options: nosniff
age: 213632
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12708
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:55:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Dec 2023 21:34:14 GMT

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d207db8e537601c760665c7ba090dd10383bdadda3ce24d35c634805e4693be3

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ad067aa2e56c021736540431c2593351d0d111fdbfb7a0e75b40e170b70ce595

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a7ae4f4e313e150000175511c29ca19ae2948eb663987253d19a9372cc20e3fe

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221206/r20190131/ Frame 9050 10 KB
5 KB 85ms
25ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221206/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bemoneyaware.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 47936
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 19:35:50 GMT
etag: 10353107486223812946
expires: Thu, 22 Dec 2022 19:35:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 bemoneyaware.gif
www.bemoneyaware.com/blog/wp-content/uploads/2016/10/ 10 KB
11 KB 143ms
143ms Image
image/gif 194.1.147.13
WPX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bemoneyaware.com/blog/wp-content/uploads/2016/10/bemoneyaware.gif?x74955
Requested by: Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 194.1.147.13 Chicago, United States, ASN210250 (WPX, BG),
Reverse DNS: wpx.net
Software: WPX CLOUD/MUM02 / W3 Total Cache/2.2.7
Resource Hash: b5dcdbff88e251cb4f77e11408c090447e62177318e8e801829face3b6cfb0ae

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:46 GMT
wpx: 1
x-edge-location: WPX CLOUD/MUM02
x-powered-by: W3 Total Cache/2.2.7
x-cache-status: HIT
content-length: 10731
pragma: public
referrer-policy
last-modified: Sun, 30 Oct 2016 00:54:31 GMT
server: WPX CLOUD/MUM02
etag: "29eb-581544c7-0;;;"
vary: Accept-Encoding,Origin
content-type: image/gif
cache-control: public, max-age=31536000,public
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Thu, 09 Nov 2023 15:07:17 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 92ms
28ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-27294067-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 09 Dec 2022 07:15:46 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 5940
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Fri, 09 Dec 2022 09:15:46 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 399 B
698 B 92ms
33ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.bemoneyaware.com&callback=_gfp_s_&client=ca-pub-6070398767421094&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6070398767421094&plah=www.bemoneyaware.com&bust=31071167

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ce31511ca8ade501b885a82a3bec900feb43c858e79fb1743def0bb0fdc70a94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 253
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.it/adsid/ 107 B
792 B 106ms
33ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.it/adsid/integrator.js?domain=www.bemoneyaware.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 109ms
35ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bemoneyaware.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6725 603 B
68 B 229ms
177ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6070398767421094&output=html&h=250&slotname=2336220800&adk=2712813064&adf=63464297&pi=t.ma~as.2336220800&w=300&lmt=1670575821&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086290&bpp=25&bdt=532&idt=280&shv=r20221206&mjsv=m202212010101&ptt=5&saldr=sa&abxe=1&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=508&ady=4687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7Cpebr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=wIKkEHJaF3&p=https%3A//www.bemoneyaware.com&dtd=301

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bemoneyaware.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:46 GMT
expires: Fri, 09 Dec 2022 08:54:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2438 145 KB
47 KB 790ms
790ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2575021678&adk=3021408649&adf=714983735&pi=t.ma~as.2575021678&w=716&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=716x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086389&bpp=9&bdt=630&idt=323&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=307&ady=2028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=UK5BeNeO4I&p=https%3A//www.bemoneyaware.com&dtd=350

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b085478d7f4409b31ce3026dfe249a5e8ee96d3cd375498c5c22cd880432bfd

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/300x250.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/300x250.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CP-j5PGU7PsCFWJLkQUdQCcKKA&gqi=1veSY5iNLrT87_UPlbudkAQ&layout=/sadbundle/%24csp%253Der3%24/7472031647726717546/EB2023-V1-300x250-DE/300x250.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bemoneyaware.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 47646
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/300x250.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/300x250.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CP-j5PGU7PsCFWJLkQUdQCcKKA&gqi=1veSY5iNLrT87_UPlbudkAQ&layout=/sadbundle/%24csp%253Der3%24/7472031647726717546/EB2023-V1-300x250-DE/300x250.html
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:47 GMT
expires: Fri, 09 Dec 2022 08:54:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 662C 371 KB
34 KB 589ms
588ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2420045140&adk=3858830745&adf=2329611710&pi=t.ma~as.2420045140&w=795&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=795x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086398&bpp=3&bdt=639&idt=378&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_fmts=716x280&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=260&ady=2970&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=e35IBEzdEe&p=https%3A//www.bemoneyaware.com&dtd=406

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b791b6f9d17dd8bd282f29b9bdc7e12ab4117968a1e5dd6f8db6ea0e50ad16d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bemoneyaware.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

access-control-expose-headers: x-google-amp-ad-validated-version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 35252
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:47 GMT
expires: Fri, 09 Dec 2022 08:54:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 234 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0d7cd639c89358f19d898c0f407c362e22f9f3efb8f419bb35ede15d184daa71

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1928 436 B
236 B 183ms
182ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&slotname=2346077534&adk=577862522&adf=3324056184&pi=t.ma~as.2346077534&w=0&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=12&format=0xnull&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&fwrattr=true&rh=0&rw=0&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086401&bpp=4&bdt=643&idt=483&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_fmts=716x280%2C795x280&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=658&ady=3716&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&fu=128&bc=31&ifi=4&uci=a!4&btvi=4&fsb=1&xpc=zglLBKAeQ7&p=https%3A//www.bemoneyaware.com&dtd=486

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0f4cc4bd6fdbb19d2871a8ab23e467755d2d59e3a2a2e1f2fa156674381b1d70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bemoneyaware.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 212
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:47 GMT
expires: Fri, 09 Dec 2022 08:54:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 107ms
33ms XHR
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=272165976&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&ul=en-us&de=UTF-8&dt=How%20to%20Claim%20HRA%20%3A%20Rental%20Agreement%20and%20Rental%20Receipt&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAACAAI~&jid=284850147&gjid=896829565&cid=1512241614.1670576087&tid=UA-27294067-1&_gid=422567154.1670576087&_r=1&gtm=2oubu0&z=1862887683

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bemoneyaware.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bemoneyaware.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.it/adsid/ 107 B
122 B 89ms
35ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.it/adsid/integrator.js?domain=www.bemoneyaware.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 94ms
35ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bemoneyaware.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A414 31 KB
13 KB 489ms
489ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=8599118285&adk=2970099097&adf=249810244&pi=t.ma~as.8599118285&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086405&bpp=1&bdt=646&idt=505&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CneEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=5&uci=a!5&fsb=1&xpc=z6GTTIbjGR&p=https%3A//www.bemoneyaware.com&dtd=510

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0c9dcf8013ea6031513aca3065e841ac58fb2ce04787893dc868e61d8d155b3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bemoneyaware.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 12987
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:47 GMT
expires: Fri, 09 Dec 2022 08:54:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2CAA 24 KB
11 KB 565ms
564ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=4089115291&adk=2767514032&adf=1078849241&pi=t.ma~as.4089115291&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086408&bpp=2&bdt=650&idt=520&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull%2C336x280&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1145&ady=3369&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=fArseK1ySW&p=https%3A//www.bemoneyaware.com&dtd=525

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6e0ba6405aed8ff7c7fca072cb6ad0f8240ac208d774afa6236fe84827460ea6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bemoneyaware.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 11172
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:47 GMT
expires: Fri, 09 Dec 2022 08:54:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
446 B 98ms
33ms XHR
text/plain 2a00:1450:400c:c08::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-27294067-1&cid=1512241614.1670576087&jid=284850147&gjid=896829565&_gid=422567154.1670576087&_u=YAhAAUAAAAAAACAAI~&z=904827680

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b4cd4f889e2c7dd71da12d2b0a29aa6346de2e5d8b3c882d7700d64c700f661d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bemoneyaware.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 09 Dec 2022 08:54:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bemoneyaware.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 94ms
37ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-27294067-1&cid=1512241614.1670576087&jid=284850147&_u=YAhAAUAAAAAAACAAI~&z=918720364

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.it/ads/ 42 B
501 B 119ms
39ms Image
image/gif 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-27294067-1&cid=1512241614.1670576087&jid=284850147&_u=YAhAAUAAAAAAACAAI~&z=918720364

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012211060024000/ Frame 224B 221 KB
61 KB 104ms
25ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/amp4ads-v0.mjs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2420045140&adk=3858830745&adf=2329611710&pi=t.ma~as.2420045140&w=795&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=795x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086398&bpp=3&bdt=639&idt=378&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_fmts=716x280&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=260&ady=2970&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=e35IBEzdEe&p=https%3A//www.bemoneyaware.com&dtd=406

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01f9f2f5ba1812441a49f7f1dc0b04fb56a18b486005289b8df4212381f10ce

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 08 Dec 2022 18:58:17 GMT
age: 50190
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61592
x-xss-protection: 0
server: sffe
etag: "a2fca7132416d151"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 08 Dec 2023 18:58:17 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame 224B 14 KB
5 KB 146ms
68ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-ad-exit-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d89cb9800cc62dcc44a0ba866b4a080ad06f735f60a6afecbd6d691d2e8939dd

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 09 Dec 2022 07:11:23 GMT
age: 6204
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5218
x-xss-protection: 0
server: sffe
etag: "abd4378f71571d78"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 09 Dec 2023 07:11:23 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame 224B 94 KB
28 KB 150ms
72ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-analytics-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ee5f53d3752309af021002b2199a06523b1fd03f3ea1cdaf5d59e911d4d8178

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 02 Dec 2022 21:42:14 GMT
age: 558753
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28809
x-xss-protection: 0
server: sffe
etag: "dd6615029de85e23"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 02 Dec 2023 21:42:14 GMT

GET
H2 200 amp-animation-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame 224B 72 KB
16 KB 163ms
85ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-animation-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe75d0fb01c62e14b75d418f8e5bb6e413e49610f564e90248669d7e3513403

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Dec 2022 18:08:54 GMT
age: 312353
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16659
x-xss-protection: 0
server: sffe
etag: "94fac542ca9cc297"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 05 Dec 2023 18:08:54 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame 224B 5 KB
2 KB 159ms
81ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-fit-text-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3f73b989e0620a4d2e12ed57a0d538e4580b8fefaa1fefbad73e0abad6d227f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 08 Dec 2022 16:29:52 GMT
age: 59095
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1913
x-xss-protection: 0
server: sffe
etag: "403438c4d550ee88"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 08 Dec 2023 16:29:52 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame 224B 40 KB
13 KB 160ms
82ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-form-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b1c3ea8b3d9fec1913ac70c81c83f2172acc41988e747bd24d22bf779fd19a0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 08 Dec 2022 16:29:52 GMT
age: 59095
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12946
x-xss-protection: 0
server: sffe
etag: "0bacd3f1ce38a7db"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 08 Dec 2023 16:29:52 GMT

GET
DATA 200
OK truncated
/ Frame 224B 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9a191936c5c6cccc865638276134433f2ed155525dc1b4a288222c3d2180b9da

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 natur.png
tpc.googlesyndication.com/sadbundle/17534047564567976683/images/ Frame 224B 6 KB
6 KB 119ms
58ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/17534047564567976683/images/natur.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb6a658e7e7f7cbb1fd49b1cb945a86a358b539219acb66af94fb392b4591287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sun, 04 Dec 2022 03:44:07 GMT
x-content-type-options: nosniff
age: 450640
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6148
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 10:44:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 04 Dec 2023 03:44:07 GMT

GET
H2 200 txt1.png
tpc.googlesyndication.com/sadbundle/17534047564567976683/images/ Frame 224B 3 KB
4 KB 117ms
56ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/17534047564567976683/images/txt1.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de73c5a1cfac9dcd3f20196da3bba3d481e5cf914ab3fb817284ba0331aacec3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sun, 04 Dec 2022 09:02:31 GMT
x-content-type-options: nosniff
age: 431536
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3563
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 10:44:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 04 Dec 2023 09:02:31 GMT

GET
H2 200 txt2.png
tpc.googlesyndication.com/sadbundle/17534047564567976683/images/ Frame 224B 3 KB
3 KB 125ms
64ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/17534047564567976683/images/txt2.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a45c53f574c632e8df71d22b4a96e3e025517a0dc4f3d5b5e170ce363f857df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 06:32:51 GMT
x-content-type-options: nosniff
age: 526916
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3485
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 10:44:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 03 Dec 2023 06:32:51 GMT

GET
H2 200 txt3.png
tpc.googlesyndication.com/sadbundle/17534047564567976683/images/ Frame 224B 2 KB
2 KB 135ms
75ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/17534047564567976683/images/txt3.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c4e69969ded6cc5161c0e42f7d7f4ef93bdc0b9a852cb55782db98f32a0d548

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 16:45:13 GMT
x-content-type-options: nosniff
age: 490174
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2364
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 10:44:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 03 Dec 2023 16:45:13 GMT

GET
H2 200 txt4.png
tpc.googlesyndication.com/sadbundle/17534047564567976683/images/ Frame 224B 3 KB
3 KB 127ms
66ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/17534047564567976683/images/txt4.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ffa955eff5294dfd8ec6ad36f39fcd33f50d856d1613a0ccc4396bcacbf4536

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 16:45:13 GMT
x-content-type-options: nosniff
age: 490174
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3200
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 10:44:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 03 Dec 2023 16:45:13 GMT

GET
H2 200 txt5.png
tpc.googlesyndication.com/sadbundle/17534047564567976683/images/ Frame 224B 3 KB
3 KB 61ms
61ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/17534047564567976683/images/txt5.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2998c0c9f482802cd84273f5535adb57b9876257ea661a6d8208d87d4bbdd0f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 06:32:51 GMT
x-content-type-options: nosniff
age: 526916
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2987
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 10:44:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 03 Dec 2023 06:32:51 GMT

GET
H2 200 puls.png
tpc.googlesyndication.com/sadbundle/17534047564567976683/images/ Frame 224B 426 B
520 B 63ms
63ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/17534047564567976683/images/puls.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

562d822170896dedfd5723e4d61d7f896d1d1e47fc4cc982c57838af26d589fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 01:56:21 GMT
x-content-type-options: nosniff
age: 543506
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 426
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 10:44:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 03 Dec 2023 01:56:21 GMT

GET
H2 200 bc.png
tpc.googlesyndication.com/sadbundle/17534047564567976683/images/ Frame 224B 4 KB
4 KB 92ms
47ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/17534047564567976683/images/bc.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36e4b8a9a6a19b3843e790e146eda7df24ecafe1484eab86641c7a66cc47f9a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 16:45:13 GMT
x-content-type-options: nosniff
age: 490174
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3651
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 10:44:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 03 Dec 2023 16:45:13 GMT

GET
H2 200 bkbc.png
tpc.googlesyndication.com/sadbundle/17534047564567976683/images/ Frame 224B 3 KB
3 KB 75ms
30ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/17534047564567976683/images/bkbc.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e659c3ba14a62676749ac394d97bee83464300f3eb25676c12352dd3b7fc239

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 06:32:51 GMT
x-content-type-options: nosniff
age: 526916
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3103
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 10:44:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 03 Dec 2023 06:32:51 GMT

GET
H2 200 preisButt.png
tpc.googlesyndication.com/sadbundle/17534047564567976683/images/ Frame 224B 5 KB
6 KB 79ms
34ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/17534047564567976683/images/preisButt.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b564c4c1925015c9ed23bfe44183138403b4eee67c30a23e4955633874205035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 07:27:55 GMT
x-content-type-options: nosniff
age: 5212
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5612
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 10:44:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 09 Dec 2023 07:27:55 GMT

GET
H2 200 CTA.png
tpc.googlesyndication.com/sadbundle/17534047564567976683/images/ Frame 224B 969 B
1 KB 91ms
46ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/17534047564567976683/images/CTA.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

76f11d4809325d7545c3d4766fca9246bebfedf69bdefba14694fecb8c4c17b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 11:29:47 GMT
x-content-type-options: nosniff
age: 336300
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 969
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 10:44:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 05 Dec 2023 11:29:47 GMT

GET
H2 200 DBx.png
tpc.googlesyndication.com/sadbundle/17534047564567976683/images/ Frame 224B 1 KB
1 KB 95ms
50ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/17534047564567976683/images/DBx.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4815369363d4167e201fcef08e9ce120f49419bd4c85cf468b66cdf7e8f715db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 02 Dec 2022 10:15:39 GMT
x-content-type-options: nosniff
age: 599948
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1246
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 10:44:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 02 Dec 2023 10:15:39 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 224B 2 KB
3 KB 73ms
28ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 09:39:53 GMT
x-content-type-options: nosniff
server: cafe
age: 83694
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Fri, 09 Dec 2022 09:39:53 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 224B 295 B
399 B 74ms
29ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 11:55:19 GMT
x-content-type-options: nosniff
server: cafe
age: 75568
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 09 Dec 2022 11:55:19 GMT

GET
H/1.1 200
OK ai.aspx
at.bahn.de/ Frame 224B 43 B
1 KB 143ms
32ms Image
image/gif 85.14.248.71
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://at.bahn.de/ai.aspx?extProvId=5&extPu=14058-gaw&extLi=18523650218&cb=4139978336

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.14.248.71 Kamp-Lintfort, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Fri, 09 Dec 2022 08:54:47 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://at.bahn.de/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Fr, 09 Dez 2022 08:54:47 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1053
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 224B 0
17 B 68ms
68ms Image
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CUBzr1veSY--UNNuMywW0rZ3QAYLS-5xt5pyvgtkQ29keEAEgv7vIJGCVgoCAmAegAazN46QByAEJqQK30A2XS76xPqgDAcgDCKoEiAJP0DXEUgh_WaUHFQReCZ8n0NUbOqttNKlxrBeIrlHEQkddBNMn51u5unoLahKeYl2vo5d1EHVWlkIN2Kvczg8iBsJ0fTafgC_h8sBAd7Xl4V7NCL9UU5h3Qcx4iqaO7NYsTFz6BUYgDkp2PNv-U0gN0VnxS6IrMR6ruWN3dLIHTwNPme-KBD-AsH5sK1qDXE18dgOvitwD86IJTPNFql4WjQg0UN9qEOvs9dzOkBGjyOXDPEZ0NSpaAtRjJtek7rZcqi8HSh9zW7GizC8RL-K7JF_j6_P110ariCVeCzj3IPyrxWlY1fKPgUK453nGzrT8BFFSG8zdtETT3SQbLHpQz3iLryI1tn7ABKySmKeRBJIFBAgEGAGSBQQIBRgEoAYugAe8spzbAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEJr8G9IIEQiA4YAQEAEYHzICqgI6AoBAgAoByAsB2BMN0BUBmBYBgBcBshccChoIABIUcHViLTY4MzQ1MzU3MzE0NDcyNzYYAA&sigh=Lss_G08jQ2Y&uach_m=[UACH]&cid=CAQSGwDq26N9dOQZnKgn1WbFmxiDGNT5iYIay63L8BgBIBM&template_id=419

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2420045140&adk=3858830745&adf=2329611710&pi=t.ma~as.2420045140&w=795&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=795x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086398&bpp=3&bdt=639&idt=378&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_fmts=716x280&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=260&ady=2970&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=e35IBEzdEe&p=https%3A//www.bemoneyaware.com&dtd=406
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 09 Dec 2022 08:54:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C915 624 B
242 B 71ms
70ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhj5oqp5MAE&v=APEucNW_D0GMM7_60ZG2ExjIBANpIYZCCI9SyITGfEys6rUFy5w8YTGKEL3dGhCdrEXhSPRzvLtcdEJ9jPWOxGTD0ScTFycw8vmdB8i3p3iOcYYhsB-1tAm62zOG5Fl3AYa69KWZmQxVhVvgpjXozB1CYuYpTu8iP9Tg2YHqTm6o0WRyB2MKV6M

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=8599118285&adk=2970099097&adf=249810244&pi=t.ma~as.8599118285&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086405&bpp=1&bdt=646&idt=505&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CneEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=5&uci=a!5&fsb=1&xpc=z6GTTIbjGR&p=https%3A//www.bemoneyaware.com&dtd=510

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=8599118285&adk=2970099097&adf=249810244&pi=t.ma~as.8599118285&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086405&bpp=1&bdt=646&idt=505&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CneEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=5&uci=a!5&fsb=1&xpc=z6GTTIbjGR&p=https%3A//www.bemoneyaware.com&dtd=510
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C8D1 82 KB
34 KB 87ms
86ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bdf3lBaIvlRANq1FH58fug2IVbSuDcv4BpBmthXq5z140yOXPtyLFeUJmgHv5ydCyqfuZpyYbkaps2xiAPk9CeZMvMOuNiJyT2dNDtzl6HOKYoXMxEN47lE_D2R8ENS_C_iVlf_h2MloefrXSDsm0oEAlgyr2OP5KCgDvaxfRgy78pflg&dbm_d=AKAmf-DDB8PisVO7dgqeDDIUDvg4GNuZWm6EFVH5at94xnqPrBY5qqW5C38mKohMR9v9_fGWrmTKnhQDaFgb7fYwHxqZngq0rUZ4237P31XKGZT1CxO9Qgkhq20OkSfDRuYECxtC3o2XGM4RGoTE7RtJ4m5Az-JujgWp8ln4UIScfEZjdMSDiywm-wXOkO2vFpjpXWvb9ZmYB7VvJk_bAlZpd4YZcPMdxbZs8LGjt2Pk04wnHXLVKT-3bYWcityDxZV_i1MpHkJhhc0KDisIMYZxjxlk_rwe6V_bziJiqmPV5CgMegmkRyiDfj_XYfWrZ-KZ21ERwSxacOSQe5WlxRp-GM5GBrvcvX2PLfb5ceSXcDip-PFut9pQtMSdxe_aMfbjrPlA99okOa-qx425LDs6BBolXYlmUEHOiDKE-UCneHvGxQShoUqr9L9YZUjfeuyoVRKRPwIw_2hOtFKYqsBl12wRsuSqzz9w2EPdB6BCTVc12GDHUAYDca5YRSbfMhjIfy68p8y7lxCR6G5mwB5KJrQNsU-eal6FcglwMym63yswQMTXMZF9umSTNhFiiq7E2qhJtQUnAZSuiUn-5SyFa0k2QldBvCL2HJAOzKUiepp7gxlfjuOoss9YgbwWuGBdXsYvEzWUlD59FI11bi91jXSrhy9b4ll0T1yaX88d5PlFowbGcTHTYxJutKMAi6rt-MvTd4NZnmEVWuxNQQyo3WaoSo0UugrLTzUxOGeodHRgGE4y2URo2MlID1nzHfiKaTKgNLhhAHJK-Rcp7tfNOCZTDY_t_UGvd2K0KBBgSoR1i7Yxf5A6vh-bE3yCkIc2RP2W7yct4_MWVbETpM75Ts33vMm1tM8dbHvJr9iEnm64dpCTxU5ro7I_EP-TN9aV_WpImBgdByBIROA_zZostusJ8g_krtQFwL-WwRlOuH9GoGx7_2tcLMmpIf1-y5Sy4zEt-OV1lQEJ7IKvOkzxi96xUY4bIA7_OcJxdFOQ_tVNTfbKYDOmEO3x2vUPVtb6K4tDv_3gXSe5J2keVkQYbc5v3pmzqsZ2HlwfY5TE-ippVhpwwC99lE-yQuX9H9wqaXLBM4Sjm27qJSli-VpA-cRpt1p5dE0-cIPIam_wbz9Nh8Q9VVqiQKUjW04aLI2YJjmFBmE2TrftVVWc5pXVXLvnT130pRqmDPKxdCeXsP0Ub46Nr9PpImPuNtzWc_1i2qmVkEBLdE0pbdfPOqLHXPS_BXWke1GrmcHxvnKU53rvkt2VRuKzWXdg1gLqFw1nbxzxfNQpA1FRo9hx-pYDB2Eg-09ojmIwmu1RsE3hg7bCIIBmLd56e-2xI7oj3q-F4IPZK9qDF_ompv-gA2lBubU5hfl3OYWhRjBynnlkD-JkcfoNAiqMrfHhDcJAAg62cD7P9jc_uUocA59uDtIzxGDrHxUS_YWrXxjcFW-lPF9yH1RjwBOUOqZb7mfWnjyeMwEO5BQj3b4u2j8trZmv1pR5DkHsAuVKukg4cnjpSoCmjiB66Xuin9-yiPDDiV6bRp8imi54Bbh8hTpVT4VtaesswYVQ7vRe7ToFGSwetVn3LnPXMgNEosS7hDwA3vpf78O_fVBR63YHcGZGd1G_z9SQPnA-BC4qn1YdUVDMLX8OmcDmVBhu3R6wZO7yULorp1yU6dujuC11zxkjyFbaAPNIE16RgQIDdWV_nOQYROjP7LcW_biRNTBGK5TuRK-4GqS-khH9z18WTgozWzqAl5k14m2XzEhn9zwQhNHBmst9Pphub1h2WVeXZlga77DzZdNMn6frN4pHGVghQon7Efvnnkbh2T95wqKtdyzdfZYsSgT6krGXFD-Rn2qHuOQzC1G1JJrezzufs6roYu-S1qXtW3U8o7UU2WDb9ZYDRvoelL_DVfgY7s-5uWycVLCNVsvEnmzIzdpohIsgjzNQatKmLWohlubwHMPkgbzdpFOWKKulpXBpZo5DvmRXdh7IohV2Nfc6GoY1qL0r3jL8FxKJGig2hbniKml__7Dh4nJQa5NflqEfj3IzijSjPF_v359thhUdjQoCEJ3XMRuLoaJ-EXzcTnmZxF6_FFUTgzueqTUnug107czPiutscNhfbRZKCJmMpTOH0ZyLNs6Sjr3bWkJkvMoTxnwlH_hdb7jIzTP_aIz7Itm2UISKuyMG9Xl3YJ_xLhYUuTM63ngKSk5lZOND1RdKIsSU2o-phgsaQTuNRTIplZrnumkGTrhibaFuYJIG5RVtdtt4YifyDarSKncZi03hUbvsne0VhqMqzRzwwvl8Ajv3zO4y0sGPUyQpC3YVB5Ldra0tt--UmremEvI7O1uusq6MRiItaJt8mF2ongzNT4X9HVDoPZU8dFyKKEH318GPV3nxO6LTSkT1MRSeUjgWNy32IedvVw2qtOqjm428IA8_-yU0tkLcoMTXkmjd4axv_9m9dxrnsFlJrFitJDumXi3hu_3niob0vs86A5TG0oi7mg7uRb__JxMkdwXdzObmy-cSUmlExo8cJocMTSUbqMbaR3v-KY4VnzHd_Di08dp_Iz2N0bWlm9dHIKOIHxI3u9yXyZsFu5CzHj1jGmb3PpVMatxxGv2PMitJS1pds8vfDQpSrKhx0LEGw46i_extLTBjq20n3jBEpt6sk7QiG95157_DLU8sLIGz2pp6gk0Q8ylBjrsreUs7LWaQs3KVOq07kb8psWeXj-hreqjSurTaPalybtSkAYWd8JTN1hYcYL2F1Vj7EOh8y38jHjHp6j6L3GlzPgKjM_PTHyzgX2TLOaBhZcQgf_FmJZxX3a5bIHmHkpTcotqBYoXimqBw_Cl0TM8sJM3AmkiphXMAk3aH9OigUBaZ3rnkMWsq5gVS0LS6oRjLTb2VRJ70Sox8jgMpCHr4Zx0zhk-Bpz3CMdBwxsndEMpBTeoex-zrViWDAiwNmk71gJO2W3dwcCP3iuEUCtJCeFc74rQHy9hIR4ZoxFNLfx6DJv08wvzdbz_H0LqctJfSPj4wNUrs8JeSbryvWgY0VegYOJUnxXmfzkye5uLIrYnXg0Dmn8Pd1G-dqrJ_kiDYhE_YILkCS7_4gBQfaGjiSFySZxjQifpCKPCKkzcByV_yW98Ni4Axf1UqseW9xlhmo615QeedA6Kfa7hYBIeKCS4IZn5-rhs6S_3AfaqAkZLIlWnDPGydFmTcNw5Bem8-HoVONdTIE8PEq9juJPtmnvToJWwMsLGEYlKg_o_w9g7qMqJCDra-YVSQBh5T5HayDH3UNS7C0y6YQyT2dP6xicdoUeKG6HGsdNXEvjTJ2b8_8Aj9F5gB9gN5Zk0Fu0IoDB-ldWic5e_aXdb9uON2qFY2OyscOp73ZMOFxXZ41hMJV2FOZpAJlr_A1IBV3XOi4neEyvJtElRDh3WTa_A1EyODX60PFIY7PoFN4vdffkIGDcMF0TA&cid=CAQSOwDq26N94bgnNXg9b7--VsMZK3D_NdWnmuw7J1NoGpXhFU7OQI91MLJI0KW42LMzab-r1giTFicjla61GAEgEw&rfl=2%2Chttps%253A%252F%252Fwww.bemoneyaware.com%252F%240

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

99ba51642af5bbf23523eb587cf8923f5e433eef24a38c89f8baa82415862b00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=8599118285&adk=2970099097&adf=249810244&pi=t.ma~as.8599118285&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086405&bpp=1&bdt=646&idt=505&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CneEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=5&uci=a!5&fsb=1&xpc=z6GTTIbjGR&p=https%3A//www.bemoneyaware.com&dtd=510
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34979
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame C8D1 3 KB
1 KB 79ms
54ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:10:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2659
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Dec 2022 08:10:28 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame C8D1 18 KB
8 KB 50ms
26ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74658
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C8D1 0
0 93ms
34ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS78jHPloJWk0dl_1Mo9GAPe-G8buOGtbveKTULS4a_QNgsgvSPxM_3K7cHafGMvPMj7RVE6-xEQY7TXFyE1vDRmUIpDg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=8599118285&adk=2970099097&adf=249810244&pi=t.ma~as.8599118285&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086405&bpp=1&bdt=646&idt=505&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CneEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=5&uci=a!5&fsb=1&xpc=z6GTTIbjGR&p=https%3A//www.bemoneyaware.com&dtd=510
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C8D1 153 KB
47 KB 139ms
39ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 09 Dec 2022 08:54:47 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/ Frame C8D1 23 KB
9 KB 74ms
50ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74658
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9443
x-xss-protection: 0
server: cafe
etag: 9828741834572772835
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C8D1 42 B
63 B 127ms
126ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AlvmrMRiA1ToreNkZ60aZ-f3CnxmDqmiZ4bz9KJm80qnpW-PRvvrvaf2eUik7L5vt-ZIEyyzzSSU8agVJsAWQJ5poupxXdOQGXOxUjxbkV_pi2dF8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2CAA 42 B
63 B 126ms
125ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AFr0tBp4CjU8PhjkogXSz-ZkmD_YUhz0YH-bInI7xq5CPLbMaWMfU02YyXWlhLz1RfzoFwWVgkXqxNcwSwCTV2CQ5BZ-CHwFh67289k1y-R0Ge7T0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=4089115291&adk=2767514032&adf=1078849241&pi=t.ma~as.4089115291&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086408&bpp=2&bdt=650&idt=520&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull%2C336x280&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1145&ady=3369&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=fArseK1ySW&p=https%3A//www.bemoneyaware.com&dtd=525

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2CAA 0
20 B 126ms
126ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=10648193863847744234&x=1&ct=132

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 2CAA 76 KB
27 KB 95ms
94ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def1424f4f259a4cf927fe1f7ea7ec24bdc2fc78edca55fdb593cc0c293dbec5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:47 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27387
x-xss-protection: 0
server: cafe
etag: 15442950961169408521
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 09 Dec 2022 08:54:47 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame 2CAA 3 KB
1 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:10:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2659
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Dec 2022 08:10:28 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame 2CAA 18 KB
7 KB 38ms
36ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74658
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2CAA 153 KB
47 KB 133ms
80ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 09 Dec 2022 08:54:47 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/ Frame 2CAA 23 KB
9 KB 45ms
43ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74658
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9443
x-xss-protection: 0
server: cafe
etag: 9828741834572772835
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame AB76 624 B
242 B 63ms
62ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPn2QIQm5vbAhjN2bJ0MAE&v=APEucNVTo6hhSvqHBYMCk_EXt2uYA514vioiXFDjMY2DhhAUXmDvavjiWbhbnlOhqfWL70UtFqqF5RncUJNbgVqWHKjk9qjZN1vKWlgCGQ8OOFyfvQkNxIQksdiIrq1lp0Z7vHkuxbeZr5TNNS4M4rfLt460xqGLDcBocJfc2D-MAyKFtsZZcPk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=4089115291&adk=2767514032&adf=1078849241&pi=t.ma~as.4089115291&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086408&bpp=2&bdt=650&idt=520&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull%2C336x280&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1145&ady=3369&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=fArseK1ySW&p=https%3A//www.bemoneyaware.com&dtd=525
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2CAA 0
20 B 127ms
125ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=dbg&cor=10648193863847744234&x=1&ct=132&dl=0&ds=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame 2438 67 B
91 B 103ms
26ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2575021678&adk=3021408649&adf=714983735&pi=t.ma~as.2575021678&w=716&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=716x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086389&bpp=9&bdt=630&idt=323&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=307&ady=2028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=UK5BeNeO4I&p=https%3A//www.bemoneyaware.com&dtd=350

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 09:25:26 GMT
x-content-type-options: nosniff
server: cafe
age: 84561
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
expires: Fri, 09 Dec 2022 09:25:26 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C915
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1

43 B
766 B

26ms
25ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhj5oqp5MAE&v=APEucNW_D0GMM7_60ZG2ExjIBANpIYZCCI9SyITGfEys6rUFy5w8YTGKEL3dGhCdrEXhSPRzvLtcdEJ9jPWOxGTD0ScTFycw8vmdB8i3p3iOcYYhsB-1tAm62zOG5Fl3AYa69KWZmQxVhVvgpjXozB1CYuYpTu8iP9Tg2YHqTm6o0WRyB2MKV6M
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 09 Dec 2022 08:54:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C915
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y5L31zC8sk1716gJNi9AWAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1

43 B
766 B

26ms
26ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhj5oqp5MAE&v=APEucNW_D0GMM7_60ZG2ExjIBANpIYZCCI9SyITGfEys6rUFy5w8YTGKEL3dGhCdrEXhSPRzvLtcdEJ9jPWOxGTD0ScTFycw8vmdB8i3p3iOcYYhsB-1tAm62zOG5Fl3AYa69KWZmQxVhVvgpjXozB1CYuYpTu8iP9Tg2YHqTm6o0WRyB2MKV6M
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 09 Dec 2022 08:54:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame C915
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEB2jNQFeJFjQyBuCcOJgX5I&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEB2jNQFeJFjQyBuCcOJgX5I%26google_cver%3D1

43 B
1 KB

53ms
45ms

Image
image/gif

37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEB2jNQFeJFjQyBuCcOJgX5I%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhj5oqp5MAE&v=APEucNW_D0GMM7_60ZG2ExjIBANpIYZCCI9SyITGfEys6rUFy5w8YTGKEL3dGhCdrEXhSPRzvLtcdEJ9jPWOxGTD0ScTFycw8vmdB8i3p3iOcYYhsB-1tAm62zOG5Fl3AYa69KWZmQxVhVvgpjXozB1CYuYpTu8iP9Tg2YHqTm6o0WRyB2MKV6M

Protocol

HTTP/1.1

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 09 Dec 2022 08:54:47 GMT
AN-X-Request-Uuid: c3458947-c796-48af-b1da-d64517566e20
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 192.145.127.212; 192.145.127.212; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 09 Dec 2022 08:54:47 GMT
AN-X-Request-Uuid: 22a36ba4-b5fb-4c1a-8dcf-20bb7d7eb7cb
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEB2jNQFeJFjQyBuCcOJgX5I%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 192.145.127.212; 192.145.127.212; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C915
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3NDAzNTExNTg3NTM0MjQzOQ%3D%3D

170 B
188 B

48ms
47ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3NDAzNTExNTg3NTM0MjQzOQ%3D%3D

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 09 Dec 2022 08:54:47 GMT
AN-X-Request-Uuid: cce23152-6453-45bd-b704-2a06246ea433
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3NDAzNTExNTg3NTM0MjQzOQ%3D%3D
Connection: keep-alive
X-Proxy-Origin: 192.145.127.212; 192.145.127.212; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame AB76
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1

43 B
766 B

40ms
25ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPn2QIQm5vbAhjN2bJ0MAE&v=APEucNVTo6hhSvqHBYMCk_EXt2uYA514vioiXFDjMY2DhhAUXmDvavjiWbhbnlOhqfWL70UtFqqF5RncUJNbgVqWHKjk9qjZN1vKWlgCGQ8OOFyfvQkNxIQksdiIrq1lp0Z7vHkuxbeZr5TNNS4M4rfLt460xqGLDcBocJfc2D-MAyKFtsZZcPk
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 09 Dec 2022 08:54:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame AB76
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y5L31zC8sk1716gJNi9AWAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1

43 B
766 B

26ms
26ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPn2QIQm5vbAhjN2bJ0MAE&v=APEucNVTo6hhSvqHBYMCk_EXt2uYA514vioiXFDjMY2DhhAUXmDvavjiWbhbnlOhqfWL70UtFqqF5RncUJNbgVqWHKjk9qjZN1vKWlgCGQ8OOFyfvQkNxIQksdiIrq1lp0Z7vHkuxbeZr5TNNS4M4rfLt460xqGLDcBocJfc2D-MAyKFtsZZcPk
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 09 Dec 2022 08:54:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=494
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEExI9mT2HP3Iz90Ldq7r4i4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame AB76
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEB2jNQFeJFjQyBuCcOJgX5I&google_cver=1

43 B
1021 B

29ms
28ms

Image
image/gif

37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEB2jNQFeJFjQyBuCcOJgX5I&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPn2QIQm5vbAhjN2bJ0MAE&v=APEucNVTo6hhSvqHBYMCk_EXt2uYA514vioiXFDjMY2DhhAUXmDvavjiWbhbnlOhqfWL70UtFqqF5RncUJNbgVqWHKjk9qjZN1vKWlgCGQ8OOFyfvQkNxIQksdiIrq1lp0Z7vHkuxbeZr5TNNS4M4rfLt460xqGLDcBocJfc2D-MAyKFtsZZcPk

Protocol

HTTP/1.1

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 09 Dec 2022 08:54:47 GMT
AN-X-Request-Uuid: cd9dc389-c4d1-473f-9ed5-93e42fdb9cd4
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 192.145.127.212; 192.145.127.212; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEB2jNQFeJFjQyBuCcOJgX5I&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AB76
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzEzNTgzNzgxMTA3NzMwMDYzNQ%3D%3D

170 B
188 B

44ms
43ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzEzNTgzNzgxMTA3NzMwMDYzNQ%3D%3D

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 09 Dec 2022 08:54:47 GMT
AN-X-Request-Uuid: ced70b92-396a-4011-af40-680e50cfc154
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzEzNTgzNzgxMTA3NzMwMDYzNQ%3D%3D
Connection: keep-alive
X-Proxy-Origin: 192.145.127.212; 192.145.127.212; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 300x250.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/ Frame E7C9 4 KB
2 KB 26ms
25ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/300x250.html

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf1f0d265eed5efcc20c5e5edbaa0b6606fc1c1ba452a22a609f0b008577f165

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 125309
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1632
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Wed, 07 Dec 2022 22:06:18 GMT
expires: Thu, 07 Dec 2023 22:06:18 GMT
last-modified: Thu, 13 Oct 2022 07:35:19 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4BE9 0
0 70ms
70ms Fetch
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CuWMe1veSY__gL-KWxdwPwM6owALW_ZfqbfOXyqP7EP_Ror3AARABIL-7yCRglYKAgJgHoAGIv9fIA8gBCakCx73En9C9sT6oAwHIA0iqBIQCT9A5-oIM1Fl9m6p0bn15gXQOmDoIygDkRXvFuwrGf5ZBI22Nrj3e8B_NlvzdOQ1cG3TQ83m_2XSmRXE-2Q7Wo1aaq1pGt78XjON2qYOyxQ43UHvsNFPxzhEWmTItF7nDDGJLJCIqJ0zux2Eu5V06qhuw-25uLpIZ8junCCJyxmvSGcVwa9x-XLxnkErQlaBHXTktd40VI8PnU09KNP106dh9OQOSe0aTgJYy27h-pFEKPLnltzF1mgpaMcmL6MWizk266V0ydvCqFvX_w4AiPIXtRDo6G80oeZndTCAmUaddzqOKjLqEGK_qONBBle4V8kcQpkOk0EXaJ95XjpQqN3GX9MbABNz_keicBJIFBAgEGAGSBQQIBRgEoAYugAfgwKg3qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQmt4q0ggRCIDhgBAQARgfMgKqAjoCgECACgHICwHYEw3QFQGYFgGAFwGyFxwKGggAEhRwdWItNjgzNDUzNTczMTQ0NzI3NhgA&sigh=FtdqwKugNHk&uach_m=[UACH]&cid=CAQSGwDq26N9GN00FF2vThrs7r8Fnmj95hxQA_XF-BgBIBM&template_id=419

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2575021678&adk=3021408649&adf=714983735&pi=t.ma~as.2575021678&w=716&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=716x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086389&bpp=9&bdt=630&idt=323&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=307&ady=2028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=UK5BeNeO4I&p=https%3A//www.bemoneyaware.com&dtd=350
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 09 Dec 2022 08:54:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/ Frame 4BE9 23 KB
9 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2575021678&adk=3021408649&adf=714983735&pi=t.ma~as.2575021678&w=716&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=716x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086389&bpp=9&bdt=630&idt=323&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=307&ady=2028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=UK5BeNeO4I&p=https%3A//www.bemoneyaware.com&dtd=350

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74658
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9443
x-xss-protection: 0
server: cafe
etag: 9828741834572772835
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame 4BE9 3 KB
1 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2575021678&adk=3021408649&adf=714983735&pi=t.ma~as.2575021678&w=716&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=716x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086389&bpp=9&bdt=630&idt=323&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=307&ady=2028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=UK5BeNeO4I&p=https%3A//www.bemoneyaware.com&dtd=350

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:10:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2659
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Dec 2022 08:10:28 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame 4BE9 18 KB
7 KB 32ms
31ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2575021678&adk=3021408649&adf=714983735&pi=t.ma~as.2575021678&w=716&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=716x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086389&bpp=9&bdt=630&idt=323&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=307&ady=2028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=UK5BeNeO4I&p=https%3A//www.bemoneyaware.com&dtd=350

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74658
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4BE9 153 KB
47 KB 134ms
81ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2575021678&adk=3021408649&adf=714983735&pi=t.ma~as.2575021678&w=716&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=716x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086389&bpp=9&bdt=630&idt=323&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=307&ady=2028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=UK5BeNeO4I&p=https%3A//www.bemoneyaware.com&dtd=350

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 09 Dec 2022 08:54:47 GMT

GET
H2 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame C8D1 170 KB
59 KB 131ms
36ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 10:22:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81128
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 09 Dec 2022 10:22:39 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221206/r20110914/elements/html/ Frame C8D1 8 KB
3 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221206/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bdf3lBaIvlRANq1FH58fug2IVbSuDcv4BpBmthXq5z140yOXPtyLFeUJmgHv5ydCyqfuZpyYbkaps2xiAPk9CeZMvMOuNiJyT2dNDtzl6HOKYoXMxEN47lE_D2R8ENS_C_iVlf_h2MloefrXSDsm0oEAlgyr2OP5KCgDvaxfRgy78pflg&dbm_d=AKAmf-DDB8PisVO7dgqeDDIUDvg4GNuZWm6EFVH5at94xnqPrBY5qqW5C38mKohMR9v9_fGWrmTKnhQDaFgb7fYwHxqZngq0rUZ4237P31XKGZT1CxO9Qgkhq20OkSfDRuYECxtC3o2XGM4RGoTE7RtJ4m5Az-JujgWp8ln4UIScfEZjdMSDiywm-wXOkO2vFpjpXWvb9ZmYB7VvJk_bAlZpd4YZcPMdxbZs8LGjt2Pk04wnHXLVKT-3bYWcityDxZV_i1MpHkJhhc0KDisIMYZxjxlk_rwe6V_bziJiqmPV5CgMegmkRyiDfj_XYfWrZ-KZ21ERwSxacOSQe5WlxRp-GM5GBrvcvX2PLfb5ceSXcDip-PFut9pQtMSdxe_aMfbjrPlA99okOa-qx425LDs6BBolXYlmUEHOiDKE-UCneHvGxQShoUqr9L9YZUjfeuyoVRKRPwIw_2hOtFKYqsBl12wRsuSqzz9w2EPdB6BCTVc12GDHUAYDca5YRSbfMhjIfy68p8y7lxCR6G5mwB5KJrQNsU-eal6FcglwMym63yswQMTXMZF9umSTNhFiiq7E2qhJtQUnAZSuiUn-5SyFa0k2QldBvCL2HJAOzKUiepp7gxlfjuOoss9YgbwWuGBdXsYvEzWUlD59FI11bi91jXSrhy9b4ll0T1yaX88d5PlFowbGcTHTYxJutKMAi6rt-MvTd4NZnmEVWuxNQQyo3WaoSo0UugrLTzUxOGeodHRgGE4y2URo2MlID1nzHfiKaTKgNLhhAHJK-Rcp7tfNOCZTDY_t_UGvd2K0KBBgSoR1i7Yxf5A6vh-bE3yCkIc2RP2W7yct4_MWVbETpM75Ts33vMm1tM8dbHvJr9iEnm64dpCTxU5ro7I_EP-TN9aV_WpImBgdByBIROA_zZostusJ8g_krtQFwL-WwRlOuH9GoGx7_2tcLMmpIf1-y5Sy4zEt-OV1lQEJ7IKvOkzxi96xUY4bIA7_OcJxdFOQ_tVNTfbKYDOmEO3x2vUPVtb6K4tDv_3gXSe5J2keVkQYbc5v3pmzqsZ2HlwfY5TE-ippVhpwwC99lE-yQuX9H9wqaXLBM4Sjm27qJSli-VpA-cRpt1p5dE0-cIPIam_wbz9Nh8Q9VVqiQKUjW04aLI2YJjmFBmE2TrftVVWc5pXVXLvnT130pRqmDPKxdCeXsP0Ub46Nr9PpImPuNtzWc_1i2qmVkEBLdE0pbdfPOqLHXPS_BXWke1GrmcHxvnKU53rvkt2VRuKzWXdg1gLqFw1nbxzxfNQpA1FRo9hx-pYDB2Eg-09ojmIwmu1RsE3hg7bCIIBmLd56e-2xI7oj3q-F4IPZK9qDF_ompv-gA2lBubU5hfl3OYWhRjBynnlkD-JkcfoNAiqMrfHhDcJAAg62cD7P9jc_uUocA59uDtIzxGDrHxUS_YWrXxjcFW-lPF9yH1RjwBOUOqZb7mfWnjyeMwEO5BQj3b4u2j8trZmv1pR5DkHsAuVKukg4cnjpSoCmjiB66Xuin9-yiPDDiV6bRp8imi54Bbh8hTpVT4VtaesswYVQ7vRe7ToFGSwetVn3LnPXMgNEosS7hDwA3vpf78O_fVBR63YHcGZGd1G_z9SQPnA-BC4qn1YdUVDMLX8OmcDmVBhu3R6wZO7yULorp1yU6dujuC11zxkjyFbaAPNIE16RgQIDdWV_nOQYROjP7LcW_biRNTBGK5TuRK-4GqS-khH9z18WTgozWzqAl5k14m2XzEhn9zwQhNHBmst9Pphub1h2WVeXZlga77DzZdNMn6frN4pHGVghQon7Efvnnkbh2T95wqKtdyzdfZYsSgT6krGXFD-Rn2qHuOQzC1G1JJrezzufs6roYu-S1qXtW3U8o7UU2WDb9ZYDRvoelL_DVfgY7s-5uWycVLCNVsvEnmzIzdpohIsgjzNQatKmLWohlubwHMPkgbzdpFOWKKulpXBpZo5DvmRXdh7IohV2Nfc6GoY1qL0r3jL8FxKJGig2hbniKml__7Dh4nJQa5NflqEfj3IzijSjPF_v359thhUdjQoCEJ3XMRuLoaJ-EXzcTnmZxF6_FFUTgzueqTUnug107czPiutscNhfbRZKCJmMpTOH0ZyLNs6Sjr3bWkJkvMoTxnwlH_hdb7jIzTP_aIz7Itm2UISKuyMG9Xl3YJ_xLhYUuTM63ngKSk5lZOND1RdKIsSU2o-phgsaQTuNRTIplZrnumkGTrhibaFuYJIG5RVtdtt4YifyDarSKncZi03hUbvsne0VhqMqzRzwwvl8Ajv3zO4y0sGPUyQpC3YVB5Ldra0tt--UmremEvI7O1uusq6MRiItaJt8mF2ongzNT4X9HVDoPZU8dFyKKEH318GPV3nxO6LTSkT1MRSeUjgWNy32IedvVw2qtOqjm428IA8_-yU0tkLcoMTXkmjd4axv_9m9dxrnsFlJrFitJDumXi3hu_3niob0vs86A5TG0oi7mg7uRb__JxMkdwXdzObmy-cSUmlExo8cJocMTSUbqMbaR3v-KY4VnzHd_Di08dp_Iz2N0bWlm9dHIKOIHxI3u9yXyZsFu5CzHj1jGmb3PpVMatxxGv2PMitJS1pds8vfDQpSrKhx0LEGw46i_extLTBjq20n3jBEpt6sk7QiG95157_DLU8sLIGz2pp6gk0Q8ylBjrsreUs7LWaQs3KVOq07kb8psWeXj-hreqjSurTaPalybtSkAYWd8JTN1hYcYL2F1Vj7EOh8y38jHjHp6j6L3GlzPgKjM_PTHyzgX2TLOaBhZcQgf_FmJZxX3a5bIHmHkpTcotqBYoXimqBw_Cl0TM8sJM3AmkiphXMAk3aH9OigUBaZ3rnkMWsq5gVS0LS6oRjLTb2VRJ70Sox8jgMpCHr4Zx0zhk-Bpz3CMdBwxsndEMpBTeoex-zrViWDAiwNmk71gJO2W3dwcCP3iuEUCtJCeFc74rQHy9hIR4ZoxFNLfx6DJv08wvzdbz_H0LqctJfSPj4wNUrs8JeSbryvWgY0VegYOJUnxXmfzkye5uLIrYnXg0Dmn8Pd1G-dqrJ_kiDYhE_YILkCS7_4gBQfaGjiSFySZxjQifpCKPCKkzcByV_yW98Ni4Axf1UqseW9xlhmo615QeedA6Kfa7hYBIeKCS4IZn5-rhs6S_3AfaqAkZLIlWnDPGydFmTcNw5Bem8-HoVONdTIE8PEq9juJPtmnvToJWwMsLGEYlKg_o_w9g7qMqJCDra-YVSQBh5T5HayDH3UNS7C0y6YQyT2dP6xicdoUeKG6HGsdNXEvjTJ2b8_8Aj9F5gB9gN5Zk0Fu0IoDB-ldWic5e_aXdb9uON2qFY2OyscOp73ZMOFxXZ41hMJV2FOZpAJlr_A1IBV3XOi4neEyvJtElRDh3WTa_A1EyODX60PFIY7PoFN4vdffkIGDcMF0TA&cid=CAQSOwDq26N94bgnNXg9b7--VsMZK3D_NdWnmuw7J1NoGpXhFU7OQI91MLJI0KW42LMzab-r1giTFicjla61GAEgEw&rfl=2%2Chttps%253A%252F%252Fwww.bemoneyaware.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 18:10:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53065
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 18:10:22 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221206/r20110914/ Frame C8D1 30 KB
11 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221206/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4d60e53476012ab254ca2f3f479903a6be9ead3cb39a9ea353c51ec75c618c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 07:47:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4022
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11387
x-xss-protection: 0
server: cafe
etag: 8197878782792770439
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Dec 2022 07:47:45 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2CAA 0
20 B 126ms
126ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4242942575445&version=m202209210101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2CAA 0
20 B 127ms
127ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4242942575445&version=m202209210101&ct=132&x=1&cor=10648193863847743000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2CAA 82 KB
34 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C5pEo1vBDILndxoqBC9zuOLXELhX_yyRb3Hn2d_qKJgdBbAkfYLPTDtpI-lz-TbeJXHuw_f9B7zV3mri7bz-syQazuKxguXV2HvJjasHimowvJua7iC2GlLuEwy8Snth2ZHxP8JZPbexD-o9Ff8Efrq4_28mcfjXAgyRWnen29rqLh_rsvnY6OZ7Zir5QcD3Lj0b_D&cry=1&dbm_d=AKAmf-Dpvq2xG3Y2szPLaOEyAJk5xsnPsIv__0-rpkHbdArpLpYbEWAzldXgU2HfFKv1ZyypJ5kU74lllSpy7FhXEMeo0xt0tION4ptx8izFJUoG1SQePIOd1faTB47pf8KUD-6eO6MkbZNOjaVaqG1jNRFlBHphwmw8JI5c0xIrxzk9HMX4jLI6Kanhzlbpiw19IYrSkMLcK7ehUEbFTxw6cPIGn2HQwj0PnpeDrQbPVqzNZKtykSEiMFM_dTT_XtKII90fwmFEYClcDjSSd6QVeTW8D5bU8oYvBzcReNyob_L4K4TGfFVuqzuY4YjsqRcRk81Bwh6VVRLp2pZsK001vkIqMwcCrH57T-EjGa5kpRTSFLp0mFIaEhTe5Y-u62Q-FfsK2yIh30QDe7Egw8V5_YQ2mkupYdwAGdiVU502JKATytJ78Jfk3TFIZ3Qwig5TYd9RaRIAMBNsAWOjOmreKB8LWmRrlI27chOxyDZhGCJRb5zNybysiE_7s2JJFeD4OPh9X0O_rrT8wyAyE_fLwX8YpHYoErnnbB52guzplS3sqDHK-y07VKxTZnyqhFbYsNkDbGZCXhmHi9Rdo9t574RwEwyVnodgm1htczntSDnkkHsjc1B-JFlnvhBfG7pUCRsKYICC8FQKlwJlBWuXLueVQeowaDBMQCAOJVVUsc-mDOrTnbdD_UyitANt-tcnwCKqSkIQCXRLDF0PjaVrsdECP-Dao77HzOcK0Ez1Dwj9izhq40epI1_FKJXGz8Ar6vg4Q1zg73TSbclJlizR7usdpwiOXLhChNjq1wB-OL--SiJT--4kEPWk82Lrx6K9m2ynfp3Ei9INJnKLhcxJ_hDDZsRM7wPlL69VJoKk6tDeDu7KluxzVtDI2dncQK49Llrr6vN38qF1E1KGyc3b7ekfuLK2_WAZoJTDLfNzmdY0fN83H6Y_jA4PLt_sjHH9orKAQmSk1goVlWWJKwhRUFct36eIPnhflEKsChcvzcDgB2NpfrJ7SwmPloPOCJy-_WIMbezETOIoASJ9tmxEhNmCd-Vl_DLPKQXxqE3l3RlxlnywFIGWdS5zmn9Nmg1rSxBW0znEFkUiL1ZksEhz5zJA1VuznTvta23jqW-3f6U4VSxruOaZSRCmnC9pzM1SeSLqyEj6FA7txG9JG5F3Lc_1TmEoI8Xg98cw5ou9f01HZ3-R5VmDnEE-Kdh_tq3u4K7rR8sWadT1C2T1HoXQXdkt9o3qVVtdkZEmFrQDTw59EJ11-fVWzjmD0KaUBxMWNT7YPjbF74CP5yIFShaQLWNk6ja2kHK6wSCv4WIidr_FXJRiXhHFnknMx9ApGyI2hNyaiqp_dw_kbcafX50o78XZ5JujQaJHJO_oL0qytTNx-wrKo4u1cXLaMXBrbn7HMPt3ZZhV3Vx_cjzO8jD_W5ezSkCXFQzYNUJcg4UTsEzemL3ZClQNIKCz8t1iqbaPTW7Ko43EXE5hmhSIJ9t-0j8WhrsFXW3wHELsGY-s1A5yGN703R83R05yhY3zCqmyugaKlwvUNyDwjQSBGbXrGsF3bFmSCRVkn1Oc5G8Pt_0pQ693IOHYQ2zKHHcuBLEUrUoe9zhvcsIrgxTdLw7WofmqUoAWay53vKiuertduiuBJSIIYwXhHLviVsR95mAFAnQas29Qx5zRduq2wen4aXfq_2WKK5C5cuGm60wugPgDTY_bOOXMTL9tcBfO2Q5p58ElA_EkZLzCwU5TUxlv1QuTKaVIBzzTBJ5cXP_skrKhDg3394SWY4rKmvrX_EyUwoNV1uQAXRjRx64yN_PLbSeSjbbCttyiEJmL0tuPmLOa7eMysGcD-tJw7TunyK64LK54Nvjj4xdxniaX2GENcD0iFMw7IOijWv-MSOMTHQXt-8IZG9GLOZ0dN6kDyjyi4zzB_GFzzRJ9g0lVxxstbVEal0tNgnCJ0N5-tNMaVlMaWtzrFmFRLXDq9KieKdwHADa-AvUIWdD96b0k38X2wAnup9DeECfGk-c7Tmqm8-Vcb6WvMlvPnowst3iR-NKMtRTMHUG4sSqa7eCfs7ve5lGdsI3smZNtYfX8RPX_aZgJ59kUJM1AglAt0Fu5U_uNxzEUiojo5zpvemgvUVh5DrdnjCZesPMyYJplqF0mfotHrUPDTZsoFVpycRtlJRz3K0cs_NGDqD79FssYtQah4hgnD_Dfj4ydof5okD-alxP0RTOMLB_9D9ASNmKzKSuTVWNNkxByFABFfBggPPCH_Obqhe-OcYmhHV0NG10Gi_SKmlnR2dEfY3_XiW6oL_iWxMxPlwDr7vbAn2ILRa02_vSN-_-DcAQ_PMudcnqNibY_ce-9c7KYr3DAJzzkuqG2laNeA6UO2N6ZEIdRzq05RfXxyz5nGADnSX4CPFg7bWQu572vpsB5MIOPcR2K4qIjYYrOgU3-3GxvU1CIkgXnBw9wps73HjpvEFElvGgqCTmJ3aPqlT2htZ0Nl90VjPonUSr8DvNsAPsrFFWfiseLZ4OvphcO7CiVD_s8FDKbWyjba6wQW-A444aHb8PYt8GYLrN6mJYD56dvNqe7HIHOFfwfnQEjgtDNIaS7dpjcFjFafUEJAg2Ch49Ll17tEEroinCZouSCxtR4_EhEN7BqcwPNIFxIr40FAtfaV2keTThv9PGtZF-oBtsef1JKhDz-F5QAlzVA6bP86IHSz3pcz2NzZwA9GYDBViKOAxXPd4o3UT2LjTGK4k5tkakGLEcwdVrrT2SL-VCych0W7OO9nwigknwD46gSTFQ_-RZn5h1vHT4B1lneWidcJ6CWTI34k3AQIK_aFRrGIOkuIk74ByA5ZhxaMyyB4I70iC5Xx8tAPR7HdvCK8UeGsAPaag_XPISrD2KE0G4Ul4Nb9Z2-hEu5SOnKWHptsiCKCiqn2BLBiwhRYMHrVibeDEd_fL9XonbtPFu6cdnkThISpiXX6QYSfyze2Y7C2ZVP4U1ydylQ49uee2D6C8PBkRnGHCUCP9ANDhfmrGYLaDaDmbSO2dTW-sAWm3z4h3vxUWBr_B5UMvwdbnCGrIGGoHeDlUwOd4V-1xaEc2Ie70LLcSUsWg9fNnK1bo3SnXCQX0cITluT0ZsJlMLtkpfJMcERDmLZQ-WcptNDDc4tHSQFtdBilY_I9NtvZMwQGAVXaPD_62N3_6PWk6swbc9ltyPLWpVIQlIanqbrMi7lHr6qGnISazLGJzYFUa85Qa9YIVhjNw4GMs0HSK8CYuPX7EKAl3U0u1a_VRcW-l_xJLCRePB6L4wGAWjv7e7dC9j6c-aLVYSeWZbIRYYOwUvO-XyK6USCmRgRtCph37Ei409VfKYQbDydUti-udKq2h6LvSAppnnq4YG9lm_OfJbG5JT8CISK3656S5oG2crWlIm1MzGAYuKRM1bKYUeP1H-kFpMc8-kumvO5BJyH_81bAASN-mX2-ZZS5hsDBJAgBKudIPB_BG5ljPbf8pYKi6bqwAn_QIaOXvXs0O012IK4ZQDL7puG7PYyxWxGEmARKF1nIxqUAfViKeWFruXfwShOiEyMIz0-eE8j-ucZiW8NPG0ObTHiFeJW_hSI7Emq5xoHWY4d9yc-KATt-4JEl0Y7mzofEB7-vD0tIKnbxM_FxRkl3fGnzJw-TiFdUuS18ka5JDOpzvm2LruPvTaSraNu7cG6BO5n7K_bBFG0OufB7emNi_fb115UqgB4p9Ky7oLcAetWYe4qi83Ej_WfOy6Lfrda_SXH03nrjkcJ6i5grdB_-Ee3FE9Nj7a4tE2v6TvyYh6PHITp3o1QNQgi7664Y2pWkFsxhTQKSZ28zq7W5oPSvuZreajRNal4cpAaJXy8BE-vMlHGGw0ld1YXwnmaIxdcwMrP3Ix01YZu7fJRTcymh98Gy-5G351blbhq0DuJi_lMZH7udMzKMQ&cid=CAQSOwDq26N9MgNa5QS_unEyw5G7Un_Lrssc6Zh79GHS7SfyoQzqOSWROavJ2-nm83gDQMrTTy_R_0Kbm2K1GAEgEw&dv3_ver=m202209210101&rfl=https%3A%2F%2Fwww.bemoneyaware.com%2F&ds=l&xdt=1&iif=1&cor=10648193863847743000&adk=3047537735&idt=104&cac=0&dtd=6

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9093dbbf4f9d34c4f36e436fc480723c5a363fa80f15a9bee4a7bec078ec58d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=4089115291&adk=2767514032&adf=1078849241&pi=t.ma~as.4089115291&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086408&bpp=2&bdt=650&idt=520&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull%2C336x280&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1145&ady=3369&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=fArseK1ySW&p=https%3A//www.bemoneyaware.com&dtd=525
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34923
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame E7C9 6 KB
3 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 13:12:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70947
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2655
x-xss-protection: 0
server: cafe
etag: 4618035238173732404
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 09 Dec 2022 13:12:20 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame E7C9 34 KB
13 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 19:53:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46901
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 09 Dec 2022 19:53:06 GMT

GET
H2 200 createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame E7C9 186 KB
49 KB 119ms
36ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/300x250.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49100
x-xss-protection: 0
last-modified: Wed, 16 Mar 2016 13:51:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 09 Dec 2022 08:54:47 GMT

GET
H3 200 300x250.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/ Frame E7C9 36 KB
10 KB 38ms
38ms Script
application/x-javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/300x250.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

70d0e0d809e333ff9856a2673d295180e66bd2d9250cbd699725f9d183dffd70

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 03 Dec 2022 23:50:15 GMT
age: 464672
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10400
x-xss-protection: 0
last-modified: Thu, 13 Oct 2022 07:35:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 03 Dec 2023 23:50:15 GMT

GET
H3 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/012211060024000/ 23 KB
8 KB 98ms
36ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/amp4ads-host-v0.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7054618d6d88e0ec7d1065f8dcc60911c9ad2cdb1ab832f3a2d4602a9dc5a34

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Dec 2022 18:08:57 GMT
age: 312350
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7860
x-xss-protection: 0
server: sffe
etag: "a403c481d3db7074"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 05 Dec 2023 18:08:57 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 224B 2 KB
2 KB 32ms
25ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012211060024000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 09:39:53 GMT
x-content-type-options: nosniff
server: cafe
age: 83694
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Fri, 09 Dec 2022 09:39:53 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 224B 295 B
319 B 33ms
26ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012211060024000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 11:55:19 GMT
x-content-type-options: nosniff
server: cafe
age: 75568
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 09 Dec 2022 11:55:19 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4EC4 143 B
166 B 30ms
28ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2575021678&adk=3021408649&adf=714983735&pi=t.ma~as.2575021678&w=716&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=716x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086389&bpp=9&bdt=630&idt=323&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=307&ady=2028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=UK5BeNeO4I&p=https%3A//www.bemoneyaware.com&dtd=350

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2575021678&adk=3021408649&adf=714983735&pi=t.ma~as.2575021678&w=716&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=716x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086389&bpp=9&bdt=630&idt=323&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=307&ady=2028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=UK5BeNeO4I&p=https%3A//www.bemoneyaware.com&dtd=350
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 3502
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 07:56:25 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4BE9 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6032edf5cf930d31b96784f9b9a127dd9d0d71cc48ccbb1555d7bca2079de8e6

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C8D1 41 KB
15 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 07:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6502
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 07:06:25 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame DD7E 1 KB
643 B 26ms
25ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 84268
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 09:30:19 GMT
etag: 48472445140208031
expires: Fri, 09 Dec 2022 09:30:19 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 2CAA 170 KB
59 KB 80ms
26ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 10:22:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81129
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 09 Dec 2022 10:22:39 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221206/r20110914/elements/html/ Frame 2CAA 8 KB
3 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221206/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C5pEo1vBDILndxoqBC9zuOLXELhX_yyRb3Hn2d_qKJgdBbAkfYLPTDtpI-lz-TbeJXHuw_f9B7zV3mri7bz-syQazuKxguXV2HvJjasHimowvJua7iC2GlLuEwy8Snth2ZHxP8JZPbexD-o9Ff8Efrq4_28mcfjXAgyRWnen29rqLh_rsvnY6OZ7Zir5QcD3Lj0b_D&cry=1&dbm_d=AKAmf-Dpvq2xG3Y2szPLaOEyAJk5xsnPsIv__0-rpkHbdArpLpYbEWAzldXgU2HfFKv1ZyypJ5kU74lllSpy7FhXEMeo0xt0tION4ptx8izFJUoG1SQePIOd1faTB47pf8KUD-6eO6MkbZNOjaVaqG1jNRFlBHphwmw8JI5c0xIrxzk9HMX4jLI6Kanhzlbpiw19IYrSkMLcK7ehUEbFTxw6cPIGn2HQwj0PnpeDrQbPVqzNZKtykSEiMFM_dTT_XtKII90fwmFEYClcDjSSd6QVeTW8D5bU8oYvBzcReNyob_L4K4TGfFVuqzuY4YjsqRcRk81Bwh6VVRLp2pZsK001vkIqMwcCrH57T-EjGa5kpRTSFLp0mFIaEhTe5Y-u62Q-FfsK2yIh30QDe7Egw8V5_YQ2mkupYdwAGdiVU502JKATytJ78Jfk3TFIZ3Qwig5TYd9RaRIAMBNsAWOjOmreKB8LWmRrlI27chOxyDZhGCJRb5zNybysiE_7s2JJFeD4OPh9X0O_rrT8wyAyE_fLwX8YpHYoErnnbB52guzplS3sqDHK-y07VKxTZnyqhFbYsNkDbGZCXhmHi9Rdo9t574RwEwyVnodgm1htczntSDnkkHsjc1B-JFlnvhBfG7pUCRsKYICC8FQKlwJlBWuXLueVQeowaDBMQCAOJVVUsc-mDOrTnbdD_UyitANt-tcnwCKqSkIQCXRLDF0PjaVrsdECP-Dao77HzOcK0Ez1Dwj9izhq40epI1_FKJXGz8Ar6vg4Q1zg73TSbclJlizR7usdpwiOXLhChNjq1wB-OL--SiJT--4kEPWk82Lrx6K9m2ynfp3Ei9INJnKLhcxJ_hDDZsRM7wPlL69VJoKk6tDeDu7KluxzVtDI2dncQK49Llrr6vN38qF1E1KGyc3b7ekfuLK2_WAZoJTDLfNzmdY0fN83H6Y_jA4PLt_sjHH9orKAQmSk1goVlWWJKwhRUFct36eIPnhflEKsChcvzcDgB2NpfrJ7SwmPloPOCJy-_WIMbezETOIoASJ9tmxEhNmCd-Vl_DLPKQXxqE3l3RlxlnywFIGWdS5zmn9Nmg1rSxBW0znEFkUiL1ZksEhz5zJA1VuznTvta23jqW-3f6U4VSxruOaZSRCmnC9pzM1SeSLqyEj6FA7txG9JG5F3Lc_1TmEoI8Xg98cw5ou9f01HZ3-R5VmDnEE-Kdh_tq3u4K7rR8sWadT1C2T1HoXQXdkt9o3qVVtdkZEmFrQDTw59EJ11-fVWzjmD0KaUBxMWNT7YPjbF74CP5yIFShaQLWNk6ja2kHK6wSCv4WIidr_FXJRiXhHFnknMx9ApGyI2hNyaiqp_dw_kbcafX50o78XZ5JujQaJHJO_oL0qytTNx-wrKo4u1cXLaMXBrbn7HMPt3ZZhV3Vx_cjzO8jD_W5ezSkCXFQzYNUJcg4UTsEzemL3ZClQNIKCz8t1iqbaPTW7Ko43EXE5hmhSIJ9t-0j8WhrsFXW3wHELsGY-s1A5yGN703R83R05yhY3zCqmyugaKlwvUNyDwjQSBGbXrGsF3bFmSCRVkn1Oc5G8Pt_0pQ693IOHYQ2zKHHcuBLEUrUoe9zhvcsIrgxTdLw7WofmqUoAWay53vKiuertduiuBJSIIYwXhHLviVsR95mAFAnQas29Qx5zRduq2wen4aXfq_2WKK5C5cuGm60wugPgDTY_bOOXMTL9tcBfO2Q5p58ElA_EkZLzCwU5TUxlv1QuTKaVIBzzTBJ5cXP_skrKhDg3394SWY4rKmvrX_EyUwoNV1uQAXRjRx64yN_PLbSeSjbbCttyiEJmL0tuPmLOa7eMysGcD-tJw7TunyK64LK54Nvjj4xdxniaX2GENcD0iFMw7IOijWv-MSOMTHQXt-8IZG9GLOZ0dN6kDyjyi4zzB_GFzzRJ9g0lVxxstbVEal0tNgnCJ0N5-tNMaVlMaWtzrFmFRLXDq9KieKdwHADa-AvUIWdD96b0k38X2wAnup9DeECfGk-c7Tmqm8-Vcb6WvMlvPnowst3iR-NKMtRTMHUG4sSqa7eCfs7ve5lGdsI3smZNtYfX8RPX_aZgJ59kUJM1AglAt0Fu5U_uNxzEUiojo5zpvemgvUVh5DrdnjCZesPMyYJplqF0mfotHrUPDTZsoFVpycRtlJRz3K0cs_NGDqD79FssYtQah4hgnD_Dfj4ydof5okD-alxP0RTOMLB_9D9ASNmKzKSuTVWNNkxByFABFfBggPPCH_Obqhe-OcYmhHV0NG10Gi_SKmlnR2dEfY3_XiW6oL_iWxMxPlwDr7vbAn2ILRa02_vSN-_-DcAQ_PMudcnqNibY_ce-9c7KYr3DAJzzkuqG2laNeA6UO2N6ZEIdRzq05RfXxyz5nGADnSX4CPFg7bWQu572vpsB5MIOPcR2K4qIjYYrOgU3-3GxvU1CIkgXnBw9wps73HjpvEFElvGgqCTmJ3aPqlT2htZ0Nl90VjPonUSr8DvNsAPsrFFWfiseLZ4OvphcO7CiVD_s8FDKbWyjba6wQW-A444aHb8PYt8GYLrN6mJYD56dvNqe7HIHOFfwfnQEjgtDNIaS7dpjcFjFafUEJAg2Ch49Ll17tEEroinCZouSCxtR4_EhEN7BqcwPNIFxIr40FAtfaV2keTThv9PGtZF-oBtsef1JKhDz-F5QAlzVA6bP86IHSz3pcz2NzZwA9GYDBViKOAxXPd4o3UT2LjTGK4k5tkakGLEcwdVrrT2SL-VCych0W7OO9nwigknwD46gSTFQ_-RZn5h1vHT4B1lneWidcJ6CWTI34k3AQIK_aFRrGIOkuIk74ByA5ZhxaMyyB4I70iC5Xx8tAPR7HdvCK8UeGsAPaag_XPISrD2KE0G4Ul4Nb9Z2-hEu5SOnKWHptsiCKCiqn2BLBiwhRYMHrVibeDEd_fL9XonbtPFu6cdnkThISpiXX6QYSfyze2Y7C2ZVP4U1ydylQ49uee2D6C8PBkRnGHCUCP9ANDhfmrGYLaDaDmbSO2dTW-sAWm3z4h3vxUWBr_B5UMvwdbnCGrIGGoHeDlUwOd4V-1xaEc2Ie70LLcSUsWg9fNnK1bo3SnXCQX0cITluT0ZsJlMLtkpfJMcERDmLZQ-WcptNDDc4tHSQFtdBilY_I9NtvZMwQGAVXaPD_62N3_6PWk6swbc9ltyPLWpVIQlIanqbrMi7lHr6qGnISazLGJzYFUa85Qa9YIVhjNw4GMs0HSK8CYuPX7EKAl3U0u1a_VRcW-l_xJLCRePB6L4wGAWjv7e7dC9j6c-aLVYSeWZbIRYYOwUvO-XyK6USCmRgRtCph37Ei409VfKYQbDydUti-udKq2h6LvSAppnnq4YG9lm_OfJbG5JT8CISK3656S5oG2crWlIm1MzGAYuKRM1bKYUeP1H-kFpMc8-kumvO5BJyH_81bAASN-mX2-ZZS5hsDBJAgBKudIPB_BG5ljPbf8pYKi6bqwAn_QIaOXvXs0O012IK4ZQDL7puG7PYyxWxGEmARKF1nIxqUAfViKeWFruXfwShOiEyMIz0-eE8j-ucZiW8NPG0ObTHiFeJW_hSI7Emq5xoHWY4d9yc-KATt-4JEl0Y7mzofEB7-vD0tIKnbxM_FxRkl3fGnzJw-TiFdUuS18ka5JDOpzvm2LruPvTaSraNu7cG6BO5n7K_bBFG0OufB7emNi_fb115UqgB4p9Ky7oLcAetWYe4qi83Ej_WfOy6Lfrda_SXH03nrjkcJ6i5grdB_-Ee3FE9Nj7a4tE2v6TvyYh6PHITp3o1QNQgi7664Y2pWkFsxhTQKSZ28zq7W5oPSvuZreajRNal4cpAaJXy8BE-vMlHGGw0ld1YXwnmaIxdcwMrP3Ix01YZu7fJRTcymh98Gy-5G351blbhq0DuJi_lMZH7udMzKMQ&cid=CAQSOwDq26N9MgNa5QS_unEyw5G7Un_Lrssc6Zh79GHS7SfyoQzqOSWROavJ2-nm83gDQMrTTy_R_0Kbm2K1GAEgEw&dv3_ver=m202209210101&rfl=https%3A%2F%2Fwww.bemoneyaware.com%2F&ds=l&xdt=1&iif=1&cor=10648193863847743000&adk=3047537735&idt=104&cac=0&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 18:10:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53065
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 18:10:22 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221206/r20110914/ Frame 2CAA 30 KB
11 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221206/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4d60e53476012ab254ca2f3f479903a6be9ead3cb39a9ea353c51ec75c618c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 07:47:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4022
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11387
x-xss-protection: 0
server: cafe
etag: 8197878782792770439
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Dec 2022 07:47:45 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/7024728442041512453/ Frame 5735 115 KB
25 KB 87ms
34ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7024728442041512453/index.html?e=69&leftOffset=0&topOffset=0&c=QG7HTTm4qs&t=1&renderingType=2&ev=01_247

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7733207cffdf30a54d5243350f4d55e696721a83a3022df349ce7ee17cbd3c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:48 GMT
expires: Sat, 09 Dec 2023 08:54:48 GMT
last-modified: Thu, 23 Jun 2022 10:58:01 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C8D1 0
0 171ms
72ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssCLcM0c01hi3nh6JiqaxZpc9f5KkTE2MMClRkW1EY53HpCvoXGvWZ5HW6_xCzi7uJYe8fOnUdEZgqZUlYD0wu2xoUtPPXhhyyu8_L_PGaZScuaBuGBJBkKOVHDDObyCARMC_d22dWdYXSm6FNzTO2lnruo_K0KKb5uE5TTFb_C6OBKdxXDXZ2nL79rTN8f7D0i8gIzo1VwixtBeYVGu2wejF41Qk9JOZ1qNWkHMMiJUfc2Oiw4h1eSg0YiQakicdK_K_WMBYpElGS6qF_SslRQtKIL4ssscMeVa0N03TQB5gGGl9q8D82VDNnKdxmvTfkhe4gzLYJvwew_68ay89AHojItu08psQ2b3CCB2bO_MF0MqQ-9YrOP5ozdrHFdSXO-W-G_NDuBlMrAWqm7xd4yHg0_L9GcbzvYEq-MaB-win8uop_GxjjqgmaP-nyxxRXiSXSX1FyWSUC5p1eC9QDNmSFFnysPhmfh-_P64N47f9jywoOxNsV_5xe4lFWhvluOrCCY9ADlNHIN6xm94SM-6UWkW1g9-IzO-vGr9PHyqRrkPJCfFrjEmBG8gFlYm3ArbJQNhdwHd82cELrny9ZbM5TBVi1PbfQLAFGhuAE65wCi5BdY3LsJ8PkZuaGbbTbiYi70I1rqqWQMfA8POPLrO-9Su4zdvurCNmHc3DZORHbU7uyADR-ecfXKg5UVXyn9hEHz7lqmhlLQYJ2Ejl7V1NvvmscD_uhggeN6D35l2UeGvQCxofOnPvEsGuoyyIbw7Q6OUm_2Q0OX_ye2WDS3WUCcJpuIuw31YpLmr4lD7U6Q_Io0zuNxSah1eAa8TSUKR25C_0u5AW5es53W6mzKovMGzywcuhpEdcf17Fv3-KbcWAcROlWEVdEQz7V76QATIrK5bBBMtPQjCbIQWUBOWR0mDc-9fg8U0Y_ClKml7q7DtzcsJlhohjJZJDTYYo9qRm-spBTnD62l5CgTeCaO73DbF7jcXbI4Dh1bR4BZOBid0xYwcZ3jOf-IW6LFf13MtKCympWp9SJjYeOZGcGTF0yO9u2ZwY78QQGZRbXw-a5RW5jB372uEZGBhp5R8u9sKUFd80-X0Mr_PNjTkiQqfiKvrsoWCly4ybr6-EVIBkpA_RgG-dVWs4ED4jxqD85i0nC16H8Yg6mI73idBpgDFQLRI-tlOQPodwqLAc1Yc8l7UcWbzg6QT4q7m6Duq65V9RtbsxaiDY_NF3WnM6dFPOOtUUTbTU_Bb_H3xZgUWKqtPMkdE0FM0l615s6-gWzOd8PFew&sai=AMfl-YQVr4fMLJnY7YKZ5_CLJEEq17-ZSXJgTuGdnP73XyjpeezSSQaf-oyHJQCNr_TDjiY0owD1wLvUZ9rooma8lXdXuy-zsC0KGIyvPgJ_tVG-REvTgNl_TYb-51rR3XMFgotbNIoXGT6x2fQaIAgXR3CrchqZXhgOSEFLnB62qONJJVxaBzGfEI4I8BfV94DhhlsVEng2VNwsS3fxpNyUO6YTHVIwvapKq7qDjDQPCTA851SXC0R1RPjAmmWudRaTjqkM0P1UT08&sig=Cg0ArKJSzOK8i6S2m6eSEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=315&cbvp=1&cstd=309&cisv=r20221206.70075&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 09 Dec 2022 08:54:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 09 Dec 2022 08:54:48 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FFDE 22 KB
8 KB 27ms
26ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
age: 479726
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 19:39:22 GMT
expires: Sun, 03 Dec 2023 19:39:22 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dpixel
cms.quantserve.com/ Frame DD7E 35 B
463 B 97ms
29ms Image
image/gif 2620:116:800d:21:e365:4988:e8a7:3270
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFjHkRvMl9_yW9PFQZppG2w&google_cver=1&google_push=ASkJ3FYo7yMRKdFnhENuKSDxpa7b0IbD-6sQRXaK9RPptFPTrGezher-cNJVbVfvrUUYb3SfD1rseJhNDN_Sii0o315zS40it60

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:e365:4988:e8a7:3270 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DD7E
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DASkJ3FZ5JwYbrqbQeTZHfAOI4hKs7mXC6eTGjLODRym9BxAZNmbW0CbnNNqZJwotpx9O9fsSmJUMm3XF6_qGwV5lClY9swY6wKgK&google_gid=CAESEPErweKkDqx3qdZNERyQYVw&goo...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCNjvy5wGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BU2tKM0ZaNUp3WWJycWJRZVRaSGZBT0k0aEtzN21YQzZlVEdqTE9EUnltOUJ4QVpObWJXMENibk5OcVpKd290cHg5Tzlmc1NtSlVNbTNYRjZfcUd3Vj...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwZWZwdGNCVkw0Z3kyNVloM053SnljY0tBYVREbUFDUE5iQ3h2LVQ2X2dsOA==&google_push

170 B
188 B

35ms
35ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwZWZwdGNCVkw0Z3kyNVloM053SnljY0tBYVREbUFDUE5iQ3h2LVQ2X2dsOA==&google_push

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 09 Dec 2022 08:54:48 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwZWZwdGNCVkw0Z3kyNVloM053SnljY0tBYVREbUFDUE5iQ3h2LVQ2X2dsOA==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 dds
rtb.openx.net/sync/ Frame DD7E 43 B
351 B 78ms
36ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEIIsHQlyhv7F1CRPY0dtAGE&google_cver=1&google_push=ASkJ3FbUr20Jt2XVpnV2rEqbAhbhywnUBI2iJ_v5-vBTA4OC84PMJh_sAxYwj04bE-N8U2S2uLuvaHmZvqMT0Pmz2GMBQqKSPLYQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=8599118285&adk=2970099097&adf=249810244&pi=t.ma~as.8599118285&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086405&bpp=1&bdt=646&idt=505&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CneEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=5&uci=a!5&fsb=1&xpc=z6GTTIbjGR&p=https%3A//www.bemoneyaware.com&dtd=510
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 57ki623is2ldhm0jafka2rqvduvb6cfv

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DD7E
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=v7hVA1oST6WLYzsTbpf7cA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

38ms
37ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=v7hVA1oST6WLYzsTbpf7cA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FZf6jSM7mxOrcpJwokB7d6cLkvyLB6JtITkig07meOkZMFhIoTkE_gGdblZNyUgNqy6KXSKjPD2bdHKrkWMcw2jmwRnkJtZ

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=v7hVA1oST6WLYzsTbpf7cA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FZf6jSM7mxOrcpJwokB7d6cLkvyLB6JtITkig07meOkZMFhIoTkE_gGdblZNyUgNqy6KXSKjPD2bdHKrkWMcw2jmwRnkJtZ
date: Fri, 09 Dec 2022 08:54:47 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DD7E
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFM6KxXadgy6Cr-wJBBStRg&google_cver=1&google_push=ASkJ3FYR9RzJam3No2rfQjuRAP7tyTQibGm-3jOZr5gDq9rb01sG6IpGig0EpXFbhIvOViIjGq-...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJHOVZCQ1ktMVMtRUpWTA==&google_push=ASkJ3FYR9RzJam3No2rfQjuRAP7tyTQibGm-3jOZr5gDq9rb01sG6IpGig0EpXFbhIvOViIjGq-lylMDn8E8LXilXwwN5PqBOBQ_

170 B
188 B

36ms
35ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJHOVZCQ1ktMVMtRUpWTA==&google_push=ASkJ3FYR9RzJam3No2rfQjuRAP7tyTQibGm-3jOZr5gDq9rb01sG6IpGig0EpXFbhIvOViIjGq-lylMDn8E8LXilXwwN5PqBOBQ_

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJHOVZCQ1ktMVMtRUpWTA==&google_push=ASkJ3FYR9RzJam3No2rfQjuRAP7tyTQibGm-3jOZr5gDq9rb01sG6IpGig0EpXFbhIvOViIjGq-lylMDn8E8LXilXwwN5PqBOBQ_
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DD7E
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEEEe9567MrcnsopaDQxSyaI&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEEe9567MrcnsopaDQxSyaI&google_hm=Y5L31zC8sk1716gJNi9AWAAAFDEAAAIB&google_nid=index&google_push=ASkJ3FZQ_gdNtSsZcmmt8QcApaXapAs1gK3cW...

170 B
188 B

43ms
42ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEEe9567MrcnsopaDQxSyaI&google_hm=Y5L31zC8sk1716gJNi9AWAAAFDEAAAIB&google_nid=index&google_push=ASkJ3FZQ_gdNtSsZcmmt8QcApaXapAs1gK3cW1A99Z-91qg-Xds2Pb3hH0iNiBtun-H8YvexjLqEYJ9iA_5vpi2kOht2KOP8h7E3

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JUDwWmtZKvaQjgFy8fYQnQZB0GJBHx%2BEG9JVi83lsIIeo4xZzLDPXbimMWFVKQuOer2qD0WqiGxn6R2ZSA2iPtWzzHQstk%2FoyEPFQuEAHi8jAZRiZkqsKWyQ38Y8xP8oHoNpe3YRqVFExw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEEe9567MrcnsopaDQxSyaI&google_hm=Y5L31zC8sk1716gJNi9AWAAAFDEAAAIB&google_nid=index&google_push=ASkJ3FZQ_gdNtSsZcmmt8QcApaXapAs1gK3cW1A99Z-91qg-Xds2Pb3hH0iNiBtun-H8YvexjLqEYJ9iA_5vpi2kOht2KOP8h7E3
cache-control: no-cache
cf-ray: 776c84a65cb1374b-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 200 trk
ag.innovid.com/ Frame DD7E 43 B
297 B 261ms
55ms Image
image/gif 2a05:d01c:1d8:8101:d648:86cf:755a:6dbf
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEKCnBnNbUneCsWHmemnBWNc&google_cver=1&google_push=ASkJ3Fbn-QpQP1LKl8agLHeN3ntkOX3kw-9yRsNIGx_scZWAHJInbfI7unNLpOOOEcimFeKjxbGqX9isVlshv1odXfbTObPCT7Gg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=8599118285&adk=2970099097&adf=249810244&pi=t.ma~as.8599118285&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086405&bpp=1&bdt=646&idt=505&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CneEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=5&uci=a!5&fsb=1&xpc=z6GTTIbjGR&p=https%3A//www.bemoneyaware.com&dtd=510
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8101:d648:86cf:755a:6dbf London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
cache-control: no-cache
content-length: 43
request-time: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame DD7E 0
12 B 34ms
33ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JK7V1WbFIs4TMBArDAoA0zcTcuDaFDeJs8Y9HzJUavnMIr3J_elLRyeHJ7AUN_lOMhsdat

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4EC4
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

41ms
40ms

Document
text/html

2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2575021678&adk=3021408649&adf=714983735&pi=t.ma~as.2575021678&w=716&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=716x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086389&bpp=9&bdt=630&idt=323&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=307&ady=2028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=UK5BeNeO4I&p=https%3A//www.bemoneyaware.com&dtd=350

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:48 GMT
expires: Fri, 09 Dec 2022 08:54:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:48 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 foto.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/images/ Frame E7C9 61 KB
61 KB 28ms
27ms Image
image/jpeg 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7472031647726717546/EB2023-V1-300x250-DE/images/foto.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=2575021678&adk=3021408649&adf=714983735&pi=t.ma~as.2575021678&w=716&fwrn=4&fwrnh=100&lmt=1670575821&rafmt=1&format=716x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086389&bpp=9&bdt=630&idt=323&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=2&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=307&ady=2028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=UK5BeNeO4I&p=https%3A//www.bemoneyaware.com&dtd=350

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

02356496471bc203ee87a838000c211ebfd4eba9a9f3f30fb7178364eb6f876e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Fri, 02 Dec 2022 20:21:43 GMT
x-content-type-options: nosniff
age: 563585
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62845
x-xss-protection: 0
last-modified: Thu, 13 Oct 2022 07:35:19 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 02 Dec 2023 20:21:43 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2CAA 41 KB
15 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 07:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6503
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 07:06:25 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0CFA 1 KB
643 B 26ms
24ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 84269
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 09:30:19 GMT
etag: 48472445140208031
expires: Fri, 09 Dec 2022 09:30:19 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 2CAA 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a54004c790a5b62194c2f06307368fa8be27e5466d01dd55f6db5147a7b2b4ea

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 QDrzY6hqzGh0aYGUuTA1ex70oaN1LFGaXyg_pTqcRvs.js Show response
pagead2.googlesyndication.com/bg/ Frame E7C9 36 KB
16 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/QDrzY6hqzGh0aYGUuTA1ex70oaN1LFGaXyg_pTqcRvs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

403af363a86acc6874698194b930357b1ef4a1a3752c519a5f283fa53a9c46fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 10:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79628
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15878
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Dec 2023 10:47:40 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 5735 118 KB
40 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7024728442041512453/index.html?e=69&leftOffset=0&topOffset=0&c=QG7HTTm4qs&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7024728442041512453/index.html?e=69&leftOffset=0&topOffset=0&c=QG7HTTm4qs&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 06:28:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8753
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 10 Dec 2022 06:28:55 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/5712966342581070203/ Frame 2D3A 161 KB
35 KB 37ms
37ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fbae3778b5b9fc8adf8a89ae93debdcc75eadbbd35e40fc3855d8fac114e1fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:48 GMT
expires: Sat, 09 Dec 2023 08:54:48 GMT
last-modified: Thu, 09 Jul 2020 14:27:33 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2CAA 0
0 69ms
68ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss29Hd-4ryTt0NX3p9C-AvdmKg73A2ISO_paD70JVNA-4oDTD9S0KnW2Up65N1Jh_sSxJWtUXcBACi8mCviU25DQSjq46w2HpxRyxpzgrlCIa2NbBcrNCRxtj13prhGa2FE2nLaeTibNDUkpZ-xv9_8yhAqd04tTC9p-LOfeYSZzJHHrx4l5_p2DH4qi2l5cc_NMdDz06dZRUtjMr0sj6iK0w-cx7KGxLDfv9G6LtruFI77G8wWfBjF0VO5S3cFSJTFN1SB0lHW2h_YndHLdkevkFD4ekpT_tT_QDmsVMPl396IOAg7tvQ-0GohNz-2Bmdv5eyrt8h-vD1xWtzJ15olNb59r90h8mDBTAI3ARE8K_J9vqCgyIxsMyxfY-ATZQ80JXmLhUZaE_pl38NephOBXTjdQKpLniuhC7tbTlnpU4bdQeOhCKS1boYwh-lR6hm1PG0YG6ZQvGW0SrnT5203QXI2GPOQ8OPWNF3q_BZDKrfNCEArcP9djTcdkI4i6FN1u4oV8GNc3cHHuht2d-loooNg3DTw-Mzj0WkqYRUk2HIxY4vOPHc7AGMpV_SSmYdq9UgpJo4CetdjrrHmxB8Y1aBryqkGvSKFRFHmPPf4bZ2LWV7KOwtyTpQPyUL5K4mGKwp9OHlpsolZX9wZ3u78qrTfzHkmooQoTd4y4dFA7U0h0flt3q5DC9UDsg1EjN1F88mdoeugv27hyBXmzuzHu5ubOkgp-QGWFJaZ4JcDzXNyMR2nTukvM1pmrOdeVHnb1PcCS2z3Fs6TwxM2Dusu4i6SscNj93Iv9MZPQILAm_20kQFAxKga9daRpciQ0yjBKPFdzzaSfw_K9hwKwVBZoKauhmd_9i8qyVkB0AZEO6wLCUWcUuC3HCeg0o0wI8p6SpqfUCKevtBmRzXIfl6vAIgtXmGDcQb0VH1fR3nsoMM-JJcESjlxw1rBeZJFDVOxzFkQ28Zuf_PBSd-FAFTKSyUjnmyEcdmdKjjvdz_c2vNglejgq7u0Z-dYqME_J8KQE48R1kT_LhmWYr1cVAt8crdnMvvHpnWJ53LcYROApxMyqqijaJ0naQ4kXF40R80hMHS2FCOGuE5UDIrKvyU6jPmIK250dsNmiGGX6hW13EoCjXDvrM1DARRdphohbGpnDRD1HTGJpLHcf1WNL2-n1I5BW2f_J4VwO_qorj3dudcDg4nXQf9stRzgyMTF58jkzUAlIVxKteWcw3a7aEQEV4oowBZyv2Hih0p6peYc&sai=AMfl-YT6zsAGLIb32hyMkFrUXh43PFoKUBsRRV5THtgpAbczFLsP_N2Cg8MZYNxW39oflcdltB0qe7YDTp9bkj22eriq09HM1FAxYc4AxaI3IJ1v_rlUiV2VzBXAiLZGxo8ITngbGdPkMhImvttoN2aCLoKc-NPoz_0sWCL1W5kAd398IBS1l7_tUUgvme2PDsa8TkEwDdEPO6zchsnmAPDsl1S-NR4dRjIqndLs8azfV_NkvQYF4-ghOyVHGKqHmfECDGzhcyOIRMk&sig=Cg0ArKJSzD4kTdRzzW-WEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=165&cbvp=1&cstd=160&cisv=r20221206.48999&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 09 Dec 2022 08:54:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 09 Dec 2022 08:54:48 GMT

GET
H2 200 B24472818.278458590;dc_trk_aid=472467937;dc_trk_cid=136950301;ord=[timestamp];dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;dc_exteid=ABAjH0jTVuVjDZgawRhx-s_QwGyO;dc_pubid=5;dc_dbm_token...
ad.doubleclick.net/ddm/trackimp/N105603.3892527AXA_DE/ Frame 2CAA 42 B
533 B 136ms
48ms Image
image/gif 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N105603.3892527AXA_DE/B24472818.278458590;dc_trk_aid=472467937;dc_trk_cid=136950301;ord=[timestamp];dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;dc_exteid=ABAjH0jTVuVjDZgawRhx-s_QwGyO;dc_pubid=5;dc_dbm_token=AD1EzRQAAADXCs8BCgwIABUAAAAAHQAAAAASDAgAFQAAAAAdAAAAACIRCL7fvxSoApub2wKwArDHgwdAAdICKhgBIhMIj7Xw8ZTs-wIVUEqRBR2BiQtqKAEwATja9aS-ihBAAkgBWIiBIKoDWkNBUVNPd0RxMjZOOU1nTmE1UVNfdW5FeXc1RzdVbl9McnNzYzZaaDc5R0hTN1NmeW9RenFPU1dST2F2SjItbm04M2dEUU1yVFR5X1JfMEtibTJLMUdBRWdFd7IDEQiA4YAQEAEYHzICqgI6AoBAEM3ZsnTRx9yI3ZfCaDioYdwJXjAs?

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s01-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 QDrzY6hqzGh0aYGUuTA1ex70oaN1LFGaXyg_pTqcRvs.js Show response
pagead2.googlesyndication.com/bg/ Frame FFDE 36 KB
16 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/QDrzY6hqzGh0aYGUuTA1ex70oaN1LFGaXyg_pTqcRvs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

403af363a86acc6874698194b930357b1ef4a1a3752c519a5f283fa53a9c46fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 10:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79628
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15878
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Dec 2023 10:47:40 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0CFA
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGz7pp4i4HUYgJfeyREVt90&google_cver=1&google_push=ASkJ3FYWUamCiaGf8lTQ4LwPIbkM-KEGfebsnYhOsaf13NpnI0jHDf4B4R...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3FYWUamCiaGf8lTQ4LwPIbkM-KEGfebsnYhOsaf13NpnI0jHDf4B4RCn2Bmw9jAFzsmNGyBD4_i0cI_JOArQ1jnri9cZeAKg&google_hm=6hTfSS19MkjG...

170 B
188 B

139ms
139ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3FYWUamCiaGf8lTQ4LwPIbkM-KEGfebsnYhOsaf13NpnI0jHDf4B4RCn2Bmw9jAFzsmNGyBD4_i0cI_JOArQ1jnri9cZeAKg&google_hm=6hTfSS19MkjG5dU4kn0xKg

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3FYWUamCiaGf8lTQ4LwPIbkM-KEGfebsnYhOsaf13NpnI0jHDf4B4RCn2Bmw9jAFzsmNGyBD4_i0cI_JOArQ1jnri9cZeAKg&google_hm=6hTfSS19MkjG5dU4kn0xKg
pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0CFA
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEHDMb5gAQ-jftrGyQQz6q3U&google_cver=1&google_push=ASkJ3Fa4YSux9ekF12WzldEyaTlbBs033TbXV04X2i8rHryRUqweO0p65c9UtADXa7uDQannkMhjdxCHkw6S3ZuRVV_W5oaVCPk
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ASkJ3Fa4YSux9ekF12WzldEyaTlbBs033TbXV04X2i8rHryRUqweO0p65c9UtADXa7uDQannkMhjdxCHkw6S3ZuRVV_W5oaVCPk&google_hm=Q0FFU0VIRE1iNWdBUS1qZn...

170 B
188 B

36ms
35ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ASkJ3Fa4YSux9ekF12WzldEyaTlbBs033TbXV04X2i8rHryRUqweO0p65c9UtADXa7uDQannkMhjdxCHkw6S3ZuRVV_W5oaVCPk&google_hm=Q0FFU0VIRE1iNWdBUS1qZnRyR3lRUXo2cTNV

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 09 Dec 2022 08:54:47 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ASkJ3Fa4YSux9ekF12WzldEyaTlbBs033TbXV04X2i8rHryRUqweO0p65c9UtADXa7uDQannkMhjdxCHkw6S3ZuRVV_W5oaVCPk&google_hm=Q0FFU0VIRE1iNWdBUS1qZnRyR3lRUXo2cTNV
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame 0CFA 43 B
64 B 55ms
35ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEFUo3ms92WZIH4cMtna8JdM&google_cver=1&google_push=ASkJ3FaqgCSvG3_Z7V2JDpP643GKLs5Icbnjvf6jL33nMS1grhTCHLzi7SIjR94_UYIlvIOo9zGQSHvjULvRjN4DNT30Apx_63rn
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6834535731447276&output=html&h=280&slotname=4089115291&adk=2767514032&adf=1078849241&pi=t.ma~as.4089115291&w=336&lmt=1670575821&format=336x280&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576086408&bpp=2&bdt=650&idt=520&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull%2C336x280&prev_slotnames=2336220800&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1145&ady=3369&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=fArseK1ySW&p=https%3A//www.bemoneyaware.com&dtd=525
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:47 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 8lkhfe1urkhdn5cf2dvubqv379a1t2q8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0CFA
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8bL6J4NPQrWP1cPF1r1S9Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

36ms
35ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8bL6J4NPQrWP1cPF1r1S9Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FaWZd6RUqI-fk1H4irV6ULfgqqxSpBZW5G7EypMwJDQWD43z8yYCxkAG4_dUqXP_-FzpHSxPr1S2wMwe6ExlWT3jopba64

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8bL6J4NPQrWP1cPF1r1S9Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FaWZd6RUqI-fk1H4irV6ULfgqqxSpBZW5G7EypMwJDQWD43z8yYCxkAG4_dUqXP_-FzpHSxPr1S2wMwe6ExlWT3jopba64
date: Fri, 09 Dec 2022 08:54:47 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0CFA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEMA2TIDGuftbp_yrW-YhYYM&google_cver=1&google_push=ASkJ3FZskxmHUtIAK0xQ8M_uSJt_Llq_Y7YorNE_AcbO3OlEPB6xpiyVhlBg0g7vOI6fUg8ayYo...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJHOVZCRUYtOS1MUDgy&google_push=ASkJ3FZskxmHUtIAK0xQ8M_uSJt_Llq_Y7YorNE_AcbO3OlEPB6xpiyVhlBg0g7vOI6fUg8ayYonmhJir1QEpVLhDhTeqIf4omU-

170 B
188 B

42ms
42ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJHOVZCRUYtOS1MUDgy&google_push=ASkJ3FZskxmHUtIAK0xQ8M_uSJt_Llq_Y7YorNE_AcbO3OlEPB6xpiyVhlBg0g7vOI6fUg8ayYonmhJir1QEpVLhDhTeqIf4omU-

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJHOVZCRUYtOS1MUDgy&google_push=ASkJ3FZskxmHUtIAK0xQ8M_uSJt_Llq_Y7YorNE_AcbO3OlEPB6xpiyVhlBg0g7vOI6fUg8ayYonmhJir1QEpVLhDhTeqIf4omU-
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0CFA
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIxJFs3xs-tz4UM0PivsYrQ&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIxJFs3xs-tz4UM0PivsYrQ&google_hm=Y5L31zC8sk1716gJNi9AWAAAFDEAAAIB&google_nid=index&google_push=ASkJ3FaxOvUVoXs4NC07XXV1sZpeG_bbNLabs...

170 B
188 B

38ms
37ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIxJFs3xs-tz4UM0PivsYrQ&google_hm=Y5L31zC8sk1716gJNi9AWAAAFDEAAAIB&google_nid=index&google_push=ASkJ3FaxOvUVoXs4NC07XXV1sZpeG_bbNLabsWRyCr-K-UElhgweKC_Q00NaOkmk1eWPvqNpqXb6-2TS2WlXrqVxOK2poNWzDDdb

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xEM72r2shAnV1BWWzY442eHaLtGrwZrgJzaJFAh06Uj3VVbaBPuJVH1oEN07tjns%2Fv89BEOuYx1U%2Bz9a%2FzSgomIN346K%2B4iMdkT%2Bli3YSCU%2BCvAUKtZo2sL2aMGOKHqhRLsdJCmiQXWNuw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIxJFs3xs-tz4UM0PivsYrQ&google_hm=Y5L31zC8sk1716gJNi9AWAAAFDEAAAIB&google_nid=index&google_push=ASkJ3FaxOvUVoXs4NC07XXV1sZpeG_bbNLabsWRyCr-K-UElhgweKC_Q00NaOkmk1eWPvqNpqXb6-2TS2WlXrqVxOK2poNWzDDdb
cache-control: no-cache
cf-ray: 776c84a72ecf599b-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET googleredir
googlecm.hit.gemius.pl/ Frame 0CFA 0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0CFA 0
12 B 35ms
32ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LWTILp74wDP2x5iu-rOuyGpWnxn6a7CpdCsqktvi5ycnXswJnk-z4Y-GmWQM8IG9LSsH2xxg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2E15 22 KB
8 KB 33ms
33ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
age: 479726
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 19:39:22 GMT
expires: Sun, 03 Dec 2023 19:39:22 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enabler_01_242.js Show response
s0.2mdn.net/879366/ Frame 2D3A 107 KB
37 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_242.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7effa4abb1004ac11058d1fc73b1ebb9cbf993bc96dd96be50ba81ba895bd69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:45:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 577
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37452
x-xss-protection: 0
last-modified: Thu, 06 Feb 2020 15:49:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 10 Dec 2022 08:45:11 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C8D1 0
0 115ms
63ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssCLcM0c01hi3nh6JiqaxZpc9f5KkTE2MMClRkW1EY53HpCvoXGvWZ5HW6_xCzi7uJYe8fOnUdEZgqZUlYD0wu2xoUtPPXhhyyu8_L_PGaZScuaBuGBJBkKOVHDDObyCARMC_d22dWdYXSm6FNzTO2lnruo_K0KKb5uE5TTFb_C6OBKdxXDXZ2nL79rTN8f7D0i8gIzo1VwixtBeYVGu2wejF41Qk9JOZ1qNWkHMMiJUfc2Oiw4h1eSg0YiQakicdK_K_WMBYpElGS6qF_SslRQtKIL4ssscMeVa0N03TQB5gGGl9q8D82VDNnKdxmvTfkhe4gzLYJvwew_68ay89AHojItu08psQ2b3CCB2bO_MF0MqQ-9YrOP5ozdrHFdSXO-W-G_NDuBlMrAWqm7xd4yHg0_L9GcbzvYEq-MaB-win8uop_GxjjqgmaP-nyxxRXiSXSX1FyWSUC5p1eC9QDNmSFFnysPhmfh-_P64N47f9jywoOxNsV_5xe4lFWhvluOrCCY9ADlNHIN6xm94SM-6UWkW1g9-IzO-vGr9PHyqRrkPJCfFrjEmBG8gFlYm3ArbJQNhdwHd82cELrny9ZbM5TBVi1PbfQLAFGhuAE65wCi5BdY3LsJ8PkZuaGbbTbiYi70I1rqqWQMfA8POPLrO-9Su4zdvurCNmHc3DZORHbU7uyADR-ecfXKg5UVXyn9hEHz7lqmhlLQYJ2Ejl7V1NvvmscD_uhggeN6D35l2UeGvQCxofOnPvEsGuoyyIbw7Q6OUm_2Q0OX_ye2WDS3WUCcJpuIuw31YpLmr4lD7U6Q_Io0zuNxSah1eAa8TSUKR25C_0u5AW5es53W6mzKovMGzywcuhpEdcf17Fv3-KbcWAcROlWEVdEQz7V76QATIrK5bBBMtPQjCbIQWUBOWR0mDc-9fg8U0Y_ClKml7q7DtzcsJlhohjJZJDTYYo9qRm-spBTnD62l5CgTeCaO73DbF7jcXbI4Dh1bR4BZOBid0xYwcZ3jOf-IW6LFf13MtKCympWp9SJjYeOZGcGTF0yO9u2ZwY78QQGZRbXw-a5RW5jB372uEZGBhp5R8u9sKUFd80-X0Mr_PNjTkiQqfiKvrsoWCly4ybr6-EVIBkpA_RgG-dVWs4ED4jxqD85i0nC16H8Yg6mI73idBpgDFQLRI-tlOQPodwqLAc1Yc8l7UcWbzg6QT4q7m6Duq65V9RtbsxaiDY_NF3WnM6dFPOOtUUTbTU_Bb_H3xZgUWKqtPMkdE0FM0l615s6-gWzOd8PFew&sai=AMfl-YQVr4fMLJnY7YKZ5_CLJEEq17-ZSXJgTuGdnP73XyjpeezSSQaf-oyHJQCNr_TDjiY0owD1wLvUZ9rooma8lXdXuy-zsC0KGIyvPgJ_tVG-REvTgNl_TYb-51rR3XMFgotbNIoXGT6x2fQaIAgXR3CrchqZXhgOSEFLnB62qONJJVxaBzGfEI4I8BfV94DhhlsVEng2VNwsS3fxpNyUO6YTHVIwvapKq7qDjDQPCTA851SXC0R1RPjAmmWudRaTjqkM0P1UT08&sig=Cg0ArKJSzOK8i6S2m6eSEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=599&vt=11&dtpt=284&dett=3&cstd=309&cisv=r20221206.70075&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 09 Dec 2022 08:54:48 GMT

GET
H3 200 QDrzY6hqzGh0aYGUuTA1ex70oaN1LFGaXyg_pTqcRvs.js Show response
pagead2.googlesyndication.com/bg/ Frame 2E15 36 KB
16 KB 34ms
34ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/QDrzY6hqzGh0aYGUuTA1ex70oaN1LFGaXyg_pTqcRvs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

403af363a86acc6874698194b930357b1ef4a1a3752c519a5f283fa53a9c46fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 10:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79628
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15878
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Dec 2023 10:47:40 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 5735 7 KB
6 KB 147ms
72ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

52679a6637f7308ed187b17aec09039d6fb7b89f1ee40ab30bc40d440b604af8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5735
x-xss-protection: 0

GET
H3 200 SourceSansPro-Black.woff2
s0.2mdn.net/sadbundle/5712966342581070203/ Frame 2D3A 78 KB
78 KB 41ms
41ms Font
application/octet-stream 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5712966342581070203/SourceSansPro-Black.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18b2f5f468e077f4b6a2e3d2a9244a7cd60913c5504b587159a00ca5d7bcdd62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
Origin: https://s0.2mdn.net
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sun, 04 Dec 2022 12:19:27 GMT
x-content-type-options: nosniff
age: 419721
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80208
x-xss-protection: 0
last-modified: Thu, 09 Jul 2020 14:27:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 04 Dec 2023 12:19:27 GMT

GET
H3 200 SourceSansPro-Bold.woff2
s0.2mdn.net/sadbundle/5712966342581070203/ Frame 2D3A 82 KB
82 KB 48ms
47ms Font
application/octet-stream 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5712966342581070203/SourceSansPro-Bold.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d422eaf41ab920c8ce99379cec61f704b1710b183c0a0523986906851e0a0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
Origin: https://s0.2mdn.net
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sun, 04 Dec 2022 12:19:27 GMT
x-content-type-options: nosniff
age: 419721
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83468
x-xss-protection: 0
last-modified: Thu, 09 Jul 2020 14:27:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 04 Dec 2023 12:19:27 GMT

GET
H3 200 motif.svg
s0.2mdn.net/sadbundle/7024728442041512453/ Frame 5735 451 B
342 B 62ms
61ms Image
image/svg+xml 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7024728442041512453/motif.svg

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

524c55c8d2300cce448d346b995650dc7fcd703ab0c3734c057147b5c69d3773

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7024728442041512453/index.html?e=69&leftOffset=0&topOffset=0&c=QG7HTTm4qs&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 01:47:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 112016
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
last-modified: Thu, 23 Jun 2022 10:58:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 08 Dec 2023 01:47:52 GMT

GET
H3 200 logo_kia.svg
s0.2mdn.net/sadbundle/7024728442041512453/ Frame 5735 1 KB
703 B 70ms
68ms Image
image/svg+xml 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7024728442041512453/logo_kia.svg

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4caec19fb48c8b123d8f1dd3443f2bd70863adf6408db3ea83b1ee46df65c454

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7024728442041512453/index.html?e=69&leftOffset=0&topOffset=0&c=QG7HTTm4qs&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 07 Dec 2022 21:14:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 128436
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 674
x-xss-protection: 0
last-modified: Thu, 23 Jun 2022 10:58:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 07 Dec 2023 21:14:12 GMT

GET
H3 200 23717839_20211026020519412_bg_01.jpg
s0.2mdn.net/ads/richmedia/studio/23717839/ Frame 5735 29 KB
29 KB 72ms
70ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23717839/23717839_20211026020519412_bg_01.jpg

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fd323d8762bfe107930a69fab5d99df2b9eb7fcf1e266bfc801113a0d4d9620

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7024728442041512453/index.html?e=69&leftOffset=0&topOffset=0&c=QG7HTTm4qs&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 13:54:04 GMT
x-content-type-options: nosniff
age: 68444
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29911
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 09:05:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 09 Dec 2022 13:54:04 GMT

GET
H3 200 23717839_20211026033458094_bg_02.jpg
s0.2mdn.net/ads/richmedia/studio/23717839/ Frame 5735 30 KB
30 KB 72ms
69ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23717839/23717839_20211026033458094_bg_02.jpg

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7993d2d8d1e84feef5eaa4d8c9dcbc44367875122baa1b6760d9150711f4577

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7024728442041512453/index.html?e=69&leftOffset=0&topOffset=0&c=QG7HTTm4qs&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 13:51:51 GMT
x-content-type-options: nosniff
age: 68577
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30908
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 10:34:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 09 Dec 2022 13:51:51 GMT

GET
H3 200 23717839_20211026020525850_bg_03.jpg
s0.2mdn.net/ads/richmedia/studio/23717839/ Frame 5735 29 KB
29 KB 80ms
79ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23717839/23717839_20211026020525850_bg_03.jpg

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3435b89855d83510f5b3dcc3d0bfe4d8b7848a76c218d939fa4cbcc43d004f02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7024728442041512453/index.html?e=69&leftOffset=0&topOffset=0&c=QG7HTTm4qs&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 13:51:51 GMT
x-content-type-options: nosniff
age: 68577
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29523
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 09:05:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 09 Dec 2022 13:51:51 GMT

GET
H3 200 23717839_20211026033502008_bg_04.jpg
s0.2mdn.net/ads/richmedia/studio/23717839/ Frame 5735 33 KB
33 KB 81ms
80ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23717839/23717839_20211026033502008_bg_04.jpg

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63f144c4faf434bfe66e01058d20974e19961adab4808beaaf9735871e930d4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7024728442041512453/index.html?e=69&leftOffset=0&topOffset=0&c=QG7HTTm4qs&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 13:51:51 GMT
x-content-type-options: nosniff
age: 68577
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33944
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 10:35:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 09 Dec 2022 13:51:51 GMT

GET
H3 200 prod_studio_01_242_configurablemodule.js Show response
s0.2mdn.net/879366/ Frame 2D3A 30 KB
10 KB 32ms
31ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/prod_studio_01_242_configurablemodule.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_242.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68a1eb809781154c2c6dd9ef157e3ffa54c45afade2bb70edd006707d28c3a7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 11:26:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 77313
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10358
x-xss-protection: 0
last-modified: Thu, 06 Feb 2020 15:49:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 09 Dec 2022 11:26:15 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 5735 17 KB
6 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 09 Dec 2022 08:54:48 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2CAA 0
0 63ms
63ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss29Hd-4ryTt0NX3p9C-AvdmKg73A2ISO_paD70JVNA-4oDTD9S0KnW2Up65N1Jh_sSxJWtUXcBACi8mCviU25DQSjq46w2HpxRyxpzgrlCIa2NbBcrNCRxtj13prhGa2FE2nLaeTibNDUkpZ-xv9_8yhAqd04tTC9p-LOfeYSZzJHHrx4l5_p2DH4qi2l5cc_NMdDz06dZRUtjMr0sj6iK0w-cx7KGxLDfv9G6LtruFI77G8wWfBjF0VO5S3cFSJTFN1SB0lHW2h_YndHLdkevkFD4ekpT_tT_QDmsVMPl396IOAg7tvQ-0GohNz-2Bmdv5eyrt8h-vD1xWtzJ15olNb59r90h8mDBTAI3ARE8K_J9vqCgyIxsMyxfY-ATZQ80JXmLhUZaE_pl38NephOBXTjdQKpLniuhC7tbTlnpU4bdQeOhCKS1boYwh-lR6hm1PG0YG6ZQvGW0SrnT5203QXI2GPOQ8OPWNF3q_BZDKrfNCEArcP9djTcdkI4i6FN1u4oV8GNc3cHHuht2d-loooNg3DTw-Mzj0WkqYRUk2HIxY4vOPHc7AGMpV_SSmYdq9UgpJo4CetdjrrHmxB8Y1aBryqkGvSKFRFHmPPf4bZ2LWV7KOwtyTpQPyUL5K4mGKwp9OHlpsolZX9wZ3u78qrTfzHkmooQoTd4y4dFA7U0h0flt3q5DC9UDsg1EjN1F88mdoeugv27hyBXmzuzHu5ubOkgp-QGWFJaZ4JcDzXNyMR2nTukvM1pmrOdeVHnb1PcCS2z3Fs6TwxM2Dusu4i6SscNj93Iv9MZPQILAm_20kQFAxKga9daRpciQ0yjBKPFdzzaSfw_K9hwKwVBZoKauhmd_9i8qyVkB0AZEO6wLCUWcUuC3HCeg0o0wI8p6SpqfUCKevtBmRzXIfl6vAIgtXmGDcQb0VH1fR3nsoMM-JJcESjlxw1rBeZJFDVOxzFkQ28Zuf_PBSd-FAFTKSyUjnmyEcdmdKjjvdz_c2vNglejgq7u0Z-dYqME_J8KQE48R1kT_LhmWYr1cVAt8crdnMvvHpnWJ53LcYROApxMyqqijaJ0naQ4kXF40R80hMHS2FCOGuE5UDIrKvyU6jPmIK250dsNmiGGX6hW13EoCjXDvrM1DARRdphohbGpnDRD1HTGJpLHcf1WNL2-n1I5BW2f_J4VwO_qorj3dudcDg4nXQf9stRzgyMTF58jkzUAlIVxKteWcw3a7aEQEV4oowBZyv2Hih0p6peYc&sai=AMfl-YT6zsAGLIb32hyMkFrUXh43PFoKUBsRRV5THtgpAbczFLsP_N2Cg8MZYNxW39oflcdltB0qe7YDTp9bkj22eriq09HM1FAxYc4AxaI3IJ1v_rlUiV2VzBXAiLZGxo8ITngbGdPkMhImvttoN2aCLoKc-NPoz_0sWCL1W5kAd398IBS1l7_tUUgvme2PDsa8TkEwDdEPO6zchsnmAPDsl1S-NR4dRjIqndLs8azfV_NkvQYF4-ghOyVHGKqHmfECDGzhcyOIRMk&sig=Cg0ArKJSzD4kTdRzzW-WEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=579&vt=11&dtpt=414&dett=3&cstd=160&cisv=r20221206.48999&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 09 Dec 2022 08:54:48 GMT

GET
H3 200 integrator.js Show response
adservice.google.it/adsid/ 107 B
122 B 35ms
34ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.it/adsid/integrator.js?domain=www.bemoneyaware.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 36ms
35ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bemoneyaware.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 126ms
125ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&tn=HEADER&id=main-header&ign=false&pw=1600&ph=1200&x=0&y=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0D37 0
19 B 35ms
34ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6070398767421094&output=html&adk=1812271804&adf=3025194257&lmt=1670575821&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C41%3A32&format=0x0&url=https%3A%2F%2Fwww.bemoneyaware.com%2Fblog%2Fclaim-hra-rental-agreement-rent-receipts%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670576088532&bpp=2&bdt=2774&idt=2&shv=r20221206&mjsv=m202212010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4b345b489bdf4d66-223e78af7bd80035%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg&gpic=UID%3D00000b8faaea6e15%3AT%3D1670576086%3ART%3D1670576086%3AS%3DALNI_MajwqobQkqvbP530bJxYykcN_0_bw&prev_fmts=716x280%2C795x280%2C0xnull%2C336x280%2C336x280&prev_slotnames=2336220800&nras=1&correlator=6821703912199&frm=20&pv=1&ga_vid=1512241614.1670576087&ga_sid=1670576087&ga_hid=272165976&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071167%2C44777948%2C44779958&oid=2&pvsid=1392284807570007&tmod=1197443270&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=8&uci=a!8&fsb=1&dtd=12

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bemoneyaware.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:48 GMT
expires: Fri, 09 Dec 2022 08:54:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 83ms
83ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221206&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

88726b3c10fbd14c29ebca2b78faa6460c25513de29baabdef710e505ba816f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11157
x-xss-protection: 0

GET
H2 200 bemoneyaware.gif
www.bemoneyaware.com/blog/wp-content/uploads/2016/10/ 10 KB
11 KB 143ms
142ms Image
image/gif 194.1.147.13
WPX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bemoneyaware.com/blog/wp-content/uploads/2016/10/bemoneyaware.gif?x74955
Requested by: Host: www.bemoneyaware.com
URL: https://www.bemoneyaware.com/blog/wp-content/cache/autoptimize/autoptimize_003dabe3f4f628db93ae7cc2f8bf3687.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 194.1.147.13 Chicago, United States, ASN210250 (WPX, BG),
Reverse DNS: wpx.net
Software: WPX CLOUD/MUM02 / W3 Total Cache/2.2.7
Resource Hash: b5dcdbff88e251cb4f77e11408c090447e62177318e8e801829face3b6cfb0ae

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
wpx: 1
x-edge-location: WPX CLOUD/MUM02
x-powered-by: W3 Total Cache/2.2.7
x-cache-status: HIT
content-length: 10731
pragma: public
referrer-policy
last-modified: Sun, 30 Oct 2016 00:54:31 GMT
server: WPX CLOUD/MUM02
etag: "29eb-581544c7-0;;;"
vary: Accept-Encoding,Origin
content-type: image/gif
cache-control: public, max-age=31536000,public
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Thu, 09 Nov 2023 15:07:17 GMT

GET
H3 200 replay_W.png
s0.2mdn.net/sadbundle/5712966342581070203/ Frame 2D3A 1 KB
1 KB 26ms
25ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5712966342581070203/replay_W.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9dd56fc4490e2a228973163514867e3d557e450921e646a2166f429ed82f804

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:26:23 GMT
x-content-type-options: nosniff
age: 73705
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1252
x-xss-protection: 0
last-modified: Thu, 09 Jul 2020 14:27:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 08 Dec 2023 12:26:23 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/5712966342581070203/ Frame 2D3A 215 B
244 B 27ms
25ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5712966342581070203/cta.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6ffd4a691acac9fe2f5aaaef66d17fb06d64e86912e8de5bd8a9417ec20b295d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 13:35:58 GMT
x-content-type-options: nosniff
age: 501530
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 215
x-xss-protection: 0
last-modified: Thu, 09 Jul 2020 14:27:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Dec 2023 13:35:58 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/5712966342581070203/ Frame 2D3A 2 KB
2 KB 28ms
26ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5712966342581070203/logo.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c2fc8d4208dd4f523c34138011102a1e04f57fc43add10cd7f9e07e1169f979

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 02 Dec 2022 14:45:11 GMT
x-content-type-options: nosniff
age: 583777
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1764
x-xss-protection: 0
last-modified: Thu, 09 Jul 2020 14:27:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 02 Dec 2023 14:45:11 GMT

GET
H3 200 line.png
s0.2mdn.net/sadbundle/5712966342581070203/ Frame 2D3A 4 KB
4 KB 30ms
28ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5712966342581070203/line.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d87402d6ac551a34ac003e6a7d04f34ae884bc2c5df5c125467ba85c272c2651

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 10:35:11 GMT
x-content-type-options: nosniff
age: 512377
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4353
x-xss-protection: 0
last-modified: Thu, 09 Jul 2020 14:27:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Dec 2023 10:35:11 GMT

GET
H3 200 Shape2.png
s0.2mdn.net/sadbundle/5712966342581070203/ Frame 2D3A 2 KB
2 KB 35ms
33ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5712966342581070203/Shape2.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1432f052fec44adb424b38e80b7ec8d5c91617211760729475a8dfef0496ab46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 13:35:08 GMT
x-content-type-options: nosniff
age: 501580
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2438
x-xss-protection: 0
last-modified: Thu, 09 Jul 2020 14:27:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Dec 2023 13:35:08 GMT

GET
H3 200 Shape1.png
s0.2mdn.net/sadbundle/5712966342581070203/ Frame 2D3A 3 KB
3 KB 37ms
36ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5712966342581070203/Shape1.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2b49986c1f8973f7c799e66c4b0554c85dde12fd083c21ac3a656c51a48b8a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 10:55:09 GMT
x-content-type-options: nosniff
age: 338379
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2878
x-xss-protection: 0
last-modified: Thu, 09 Jul 2020 14:27:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 10:55:09 GMT

GET
H3 200 17373802855102699984
s0.2mdn.net/simgad/ Frame 2D3A 22 KB
22 KB 36ms
35ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/17373802855102699984

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7192031b09488bbaf6f2f6abc6d092249f9824605eb7ceb23aaf01875728c214

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 07 Dec 2022 08:45:43 GMT
x-content-type-options: nosniff
age: 173345
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22845
x-xss-protection: 0
last-modified: Fri, 24 Jul 2020 08:19:12 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 07 Dec 2023 08:45:43 GMT

GET
H3 200 bg.png
s0.2mdn.net/sadbundle/5712966342581070203/ Frame 2D3A 5 KB
5 KB 35ms
34ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5712966342581070203/bg.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48887e43aa7663f6acba0f483c9762b114b5029715bf5bc7bd856d6cdbe81541

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 16:38:41 GMT
x-content-type-options: nosniff
age: 231367
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4770
x-xss-protection: 0
last-modified: Thu, 09 Jul 2020 14:27:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 06 Dec 2023 16:38:41 GMT

GET
H2 200 colored-logo.svg
follow.it/static/img/ 4 KB
2 KB 85ms
37ms Image
image/svg+xml 2606:4700:20::681a:34
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://follow.it/static/img/colored-logo.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:34 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a97ad37ecc6f17cc843ab6ba6b6a4ec3cb0d30f26ec7a520e1e9eb85e586cd66

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=600; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
content-security-policy: frame-ancestors 'self';
x-content-type-options: nosniff
strict-transport-security: max-age=600; includeSubdomains;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 817
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 06 Dec 2022 12:28:27 GMT
server: cloudflare
etag: W/"638f356b-f2d"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GG%2B0RqKOMZCsfKKghTbY4KKMZC%2FeujQ2kfWROlSbWEPBzpNQzlue0iarv%2Fp5I5%2FjGuqIZAjyHLe35KTZPWRbQ2vlT8I3t%2BYsTdjFqGzZZI4iw3PTKbPTKLC5YFgxkrSHGMgwS0YBCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 776c84aa0b8a3747-MXP

GET
H2 200 our-books.jpg
www.bemoneyaware.com/blog/wp-content/uploads/2021/05/ 18 KB
18 KB 144ms
144ms Image
image/webp 194.1.147.13
WPX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bemoneyaware.com/blog/wp-content/uploads/2021/05/our-books.jpg?x74955
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 194.1.147.13 Chicago, United States, ASN210250 (WPX, BG),
Reverse DNS: wpx.net
Software: WPX CLOUD/MUM02 / W3 Total Cache/2.2.4
Resource Hash: 521e178950e5fff5af1754fc4ce1088d9fc5b6e4b37a36893fa23f377e65b559

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
wpx: 1
x-edge-location: WPX CLOUD/MUM02
x-powered-by: W3 Total Cache/2.2.4
x-cache-status: HIT
content-length: 18536
pragma: public
referrer-policy
last-modified: Wed, 04 Aug 2021 11:49:58 GMT
server: WPX CLOUD/MUM02
etag: "4868-610a7ee6-0;;;"
vary: Accept-Encoding,Origin
content-type: image/webp
cache-control: public, max-age=31536000,public
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Wed, 11 Oct 2023 11:42:04 GMT

GET
H3 200 QDrzY6hqzGh0aYGUuTA1ex70oaN1LFGaXyg_pTqcRvs.js Show response
pagead2.googlesyndication.com/bg/ Frame 5C46 36 KB
16 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/QDrzY6hqzGh0aYGUuTA1ex70oaN1LFGaXyg_pTqcRvs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

403af363a86acc6874698194b930357b1ef4a1a3752c519a5f283fa53a9c46fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 10:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79628
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15878
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Dec 2023 10:47:40 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 09 Dec 2022 08:54:48 GMT

GET
DATA 200
OK truncated
/ Frame 2D3A 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 17373802855102699984
s0.2mdn.net/simgad/ Frame 2D3A 22 KB
22 KB 27ms
27ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/17373802855102699984

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7192031b09488bbaf6f2f6abc6d092249f9824605eb7ceb23aaf01875728c214

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5712966342581070203/index.html?e=69&leftOffset=0&topOffset=0&c=XQfLi68l1I&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 07 Dec 2022 08:45:43 GMT
x-content-type-options: nosniff
age: 173345
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22845
x-xss-protection: 0
last-modified: Fri, 24 Jul 2020 08:19:12 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 07 Dec 2023 08:45:43 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FFDE 0
20 B 132ms
131ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BX6Vi1_eSY8qzHtqj9u8PkqKoyAMAAAAAOAHgBAI&bg=!dHeldzPNAAYgquz3AKo7ACkAdvg8WjVzWJsb43vtC-RBxepXTeoVfOLZCtKTNUkHpaZUUD4mNELATgIAAAFTUgAAAAJoAQcKAG913pXEFsnphMIrJs_MdSkgxogK-IofX804eRHAyVIWHnUmxNAAIZW41b1_1MGBN9PvT_rfYujSrSETiZuCNMhB4WwNlmNP-1kl_B7JKqTGvvDLn09B7yt7wlBkkDZUgjgBBSmPESt2pWdATdfjKiCZAugxMLHq_HYG3VPE_HqDRNZRCLFX2ewGqCDlh9o2YfxjEgB736-g-BFDzN1hPW8vI06gBtNMvQtl_5IVQyxWTIl3JjEUhoQcEVxlzYtIRAuvQ21MsyJecCGmTURTvdBp4U5uIAu-_swPPsZK-RIJA4uTxZl3XuBiMTpTwgP61WYsn4msO-fIMYN039ddRjIfbENpKvMbVduuvkN4bFq4UxJs4jvsfnwZkCZe9lfwVeGnphTEYZxaB_fZa4OvnU1KTwmKJgFywpxY-ncGNEFmEH2cPZSTIHeCLtIe_MJtTDLByuHzjnNIvdUIHvUdtbbYijLtAPdbdFHELdThiEarv7IKhqOyEM5YIhmzcbGF8LTfwiCHdhc3GhYfjR7UFsvzKrAmVv-n9EAREjDE_RgHQj2Aab6819lIU1ND4fm4NnqikjaIeo8QyqTVIQiLwjLmeDBzUPgs7MTUf1UrmwZmOC_bWI42hYbcwgD1HXJNDFrrOViFKzQwrBtiYdgJgr5iD-xahe_ohmq_e3NIH6xnf7S8s0LQhGIfwAMe4bo_jumGHBXEJKyAjPZ-0fdB2Wnj649y0MC-DxE5A0qoRpxS8o5SiK_thnzo90mXFC28UepAGNfRpslfus8p3k0_0Wvl5nygdxlxtnnRcxnIiJFW1gU4qAC_vnnruKizI9ZEOAAeJ72BTmRXMYvhZYfugep4Dwgxc-FwRtRQyc0AKeG6G5T8_mJMQHF4ADM6VnRPjmJQJeAUwixiVj38Fl86l8yct8QphvykE7cx4KWBfffMk7i_wppMxvymVdA0K5QkRKZ0ark0o-Gsc_ybPFYY5kDk7FvjZEm_grUIiZzU3xwYKACM3HB93PmB83GFWHabTlx3d5bW4A7syCn9Ro-tJtwXl8tH3Izh-fsyWLwp8OTXnWkVgUxUu_I8OMC52panmsxQavTSSBnfwzSDYg8kmzf2p9ftsKpmC1XCip3_20wgY8o6jy-HwNmFAC8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E15 0
20 B 133ms
133ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BdDDm1_eSY7XNLvm59u8PkoOv8AUAAAAAOAHgBAI&bg=!8POl87fNAAYgquz3AKo7ACkAdvg8WheDDpFwVKsTFK62C3Uz6XHlAHPQ7tjBistf4Ib2dQUzKunqbQIAAAEzUgAAAANoAQeZAs2-J0T2y9PRgCrYJoR_aB5geaHFWG6SLtKICt9Ysivdlt6rPgbFmUbsPLm6wlOZ_BePSpj7-r5PAlr2V8pfRA3PihmnIjL3VOgerrGcGNjVlXrRz6bJ0HBIRM0G43IuiIYdE5TfOoXRWCjyWwXieXPkDfYlvLhi_6R6LXOlZcBNBPVpkghXpEyXiuzOvUk7rm58Ytr-XoFqXKioAJLdjnlPuX3zaisl-_DLSfu7c1x1cbwp6YLInp25QO-G0cFEx7UDL8EbPGq_-0Yn4HMqeFy9YZYCtpRsYwz0a1StwHAqTl6Uimk63NRJI_voEtrevEVTFnRhv1w4qVIj2i28aclzcGP-7MZbBKIzw4YTQzuTH5j7h02t3YC1rlP33sL1xgijHW9n9Ts_HxMfpC6D-samjU_CQ8V6cWJTAGI8xuUdlnjryvWoztoD47md7WdYSBBIChHjwNTncMb1MzFERop9V-6_9wvSHGbKWPTlYprdD2PAMP1zbQmccGM-Y3c0qaiE5HLsinPgZa2_fEkljXlDnvdNlmXWseXN_5uaz7AYfspZ_x5l0jcCMqfloy8Bk0IimF7BUD5P3LYCmSpuQAiOhfqiEki_D64gZ0hrg4XCydF_1MLhtu0OnMxCKOZGYK9C1IrGy3Un1uNmsqSwUpeEF10YnqPHC1MIBtRNzx3ZGWAIjyRBlku1WKsEhVufKS0k6dNR0mgJR-rgAV0UuWYGcJi9a2yhoJvzBZyg0TWlvEds7BzZ-Aloyw184xFfVqK0lnpKyDk8OGo4RJmKnpjW97XYc_qRE5KTLZ0AeOcOx381A9yBn4Vr8HZdLJvB5W4V_AYIzYwMWQP-kvDe0cRbUNgfETAW_cghZoBWSqm6wrU16m56GqjXadkvgcP960SV4avRny8CS7MPtdwbMECazDmeoWQVP64RvpgFLLGaTlq5vZjDBikWNbMciH4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0AD8 13 KB
5 KB 26ms
25ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bemoneyaware.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
age: 2661
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:10:27 GMT
expires: Sat, 09 Dec 2023 08:10:27 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame DD32 783 B
535 B 37ms
36ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

abbd8f8817c1eb821cb054907e7da2fea9912a81bbcdd927f74e450c154896de

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce--g1Nwd0XHSokqytwsZ3VRA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bemoneyaware.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce--g1Nwd0XHSokqytwsZ3VRA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 09 Dec 2022 08:54:48 GMT
expires: Fri, 09 Dec 2022 08:54:48 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 form16-section10-exemption.jpg
www.bemoneyaware.com/blog/wp-content/uploads/2013/07/ 50 KB
51 KB 145ms
144ms Image
image/jpeg 194.1.147.13
WPX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bemoneyaware.com/blog/wp-content/uploads/2013/07/form16-section10-exemption.jpg?x74955
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 194.1.147.13 Chicago, United States, ASN210250 (WPX, BG),
Reverse DNS: wpx.net
Software: WPX CLOUD/MUM02 / W3 Total Cache/2.2.7
Resource Hash: 7eecfe312dde8e302371f35d2cd5039948a7ca9dbe7cae750b1bf52ed6916ba6

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
wpx: 1
x-edge-location: WPX CLOUD/MUM02
x-powered-by: W3 Total Cache/2.2.7
x-cache-status: HIT
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 51652
pragma: public
referrer-policy
last-modified: Fri, 17 Jun 2016 23:00:35 GMT
server: WPX CLOUD/MUM02
etag: "c9c4-57648113-0;;;"
vary: Accept-Encoding,Origin
content-type: image/jpeg
cache-control: public, max-age=31536000,public
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sun, 19 Nov 2023 06:40:23 GMT

GET
H3 200 QDrzY6hqzGh0aYGUuTA1ex70oaN1LFGaXyg_pTqcRvs.js Show response
pagead2.googlesyndication.com/bg/ Frame 0AD8 36 KB
16 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/QDrzY6hqzGh0aYGUuTA1ex70oaN1LFGaXyg_pTqcRvs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

403af363a86acc6874698194b930357b1ef4a1a3752c519a5f283fa53a9c46fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 10:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79628
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15878
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Dec 2023 10:47:40 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame DD32 0
0 126ms
126ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221206&jk=1392284807570007&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0AD8 0
12 B 26ms
25ms Image
text/plain 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?CLcr1w
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:48 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 133ms
132ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221206&jk=1392284807570007&bg=!-Pul-7_NAAYgquz3AKo7ACkAdvg8Wshfo13DBafAnctOP0uXgeZgVRcQs4MRQKytzvP_3MdVG9OXIQIAAABzUgAAAARoAQcKAC2MhdoVwJumCzR6eEPyp_ozNnNA4BjE9LBXEZCMtXEVuRbbVGpyavB0qkeElBOZAqN_slMXA1MLgUH6JOnLD668XIpI6OEZcrvnSkgyWS5RMlQxtjnIU2p7VHaJ5hFcpLtSa3PFB10sjZbVGNM10MzwQu-ViirW7g89eYW1hD8CjtHLCK7nwfv-FGRFQAhCPJVXnmeqXYE8PRdsiSn_Ugv2tZBP_ADqewIel_chR7GcnBmY0QJSFzuHqHnU9i99FjgQXlycybUaCSqttvI9LAWlBmWw1QmMovuQq6TJ-gSw1XtaDwLCaJoyJ4ftJ4NGkEaLmZVABu2JtNDnxDpVVaxiAz_RsGAGekQ0l6NccOOIE-shfOO-J1mPmT5s6ri8y9N7d2cED77Rz2uOmqTHHr3K3_e_YQomxvCOSnoO0S_9XSO5Lsg6u-5mo8lqQebOC71eTVrosn9JPMwg5Hlvs1FGY4I4d44X6Uv1kjpoKdwagRYJnJqu0WBxQ4pAwelzSrWE1ySzfUMsrT3s8O_tp0grkMWimbDQ7PsxSnvkpgniT8xP4zs-bbGvxVZ9mTNqMuxgsS8akbdvlR8KyMQ7XX9CWpaCOFVkQEjXjA6b0VODkfwk90UtevAbVdzVyGnvm9pZtRWVbBuOztAies9XfibQLNcypugiY9lWUNOmlqbiGebCOyCBjGdSZZyIDDYgoQOVkzBwxEbyLXHgcMAXyoku5ptRpwj3MwZOZQ4nBUli1QG9T7XX8X4UoaC5wt87KRWJd6lnVwMrri7rdqy8bWitWTBxYzdtS1e5iMgxq-5Uystb_lDYs3gs3WUdtgFsnBhgN_7m8bKumDEYhU4Z2wyEZgPJy5UvGam0JgbjhaHhlOIqSXaSiXsaMa-cUNNsKDqDER_iaEXT2-r2DIStPb2qa_w_3z66qsw2bYz9_bCb_YLVWn-fLJ0uEp2Hdyai55_4mgg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2CAA 0
20 B 126ms
126ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=dbg&cor=10648193863847744234&x=1&ct=132&dl=2&ds=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2CAA 0
20 B 126ms
125ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4242942575445&version=m202209210101&ct=132&x=1&cor=10648193863847743000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 09 Dec 2022 08:54:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 /
www.bemoneyaware.com/blog/wp-json/pum/v1/analytics/ 0
475 B 660ms
660ms Image
text/plain 194.1.147.13
WPX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bemoneyaware.com/blog/wp-json/pum/v1/analytics/?event=open&pid=41677&_cache=1670576090250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

194.1.147.13 Chicago, United States, ASN210250 (WPX, BG),

Reverse DNS

wpx.net

Software

WPX CLOUD/MUM02 / PHP/7.4.33

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 08:54:50 GMT
x-content-type-options: nosniff
wpx: 1
x-edge-location: WPX CLOUD/MUM02
x-powered-by: PHP/7.4.33
x-cache-status: MISS
referrer-policy
server: WPX CLOUD/MUM02
vary: Accept-Encoding,Origin
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: public, max-age=31536000
x-turbo-charged-by: LiteSpeed
x-robots-tag: noindex
link: <https://www.bemoneyaware.com/blog/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
expires: Sat, 09 Dec 2023 08:54:50 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: googlecm.hit.gemius.pl
URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEDLoKNGXTEJLWc_WwT__kgo&google_cver=1&google_push=ASkJ3FbifiFqq7LrQhkWjrgngkimZImo8xdaE9HbEBKO4-pLfRnbz8bfNriI-SXndmtyuPsGkAKrW92hSRvuehAegOnI_Ja_Ru_4KQ

Verdicts & Comments Add Verdict or Comment

339 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

26 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.bemoneyaware.com/blog/claim-hra-rental-agreement-rent-receipts	1969-12-31 23:59:59	Name: quads_browser_width Value: 1600
.bemoneyaware.com/	1970-01-20 17:24:32	Name: __gads Value: ID=4b345b489bdf4d66-223e78af7bd80035:T=1670576086:RT=1670576086:S=ALNI_MamAB2z--e2eQOzyE-w9bEjnafpFg
.bemoneyaware.com/	1970-01-20 17:24:32	Name: __gpi Value: UID=00000b8faaea6e15:T=1670576086:RT=1670576086:S=ALNI_MajwqobQkqvbP530bJxYykcN_0_bw
.bemoneyaware.com/	1970-01-20 17:38:56	Name: _ga Value: GA1.2.1512241614.1670576087
.bemoneyaware.com/	1970-01-20 08:04:22	Name: _gid Value: GA1.2.422567154.1670576087
.bemoneyaware.com/	1970-01-20 08:02:56	Name: _gat_gtag_UA_27294067_1 Value: 1
.doubleclick.net/	1970-01-20 17:24:32	Name: IDE Value: AHWqTUlL_b6Cbay2AKnaKU0z0dL_0vVmiw7rv-AgAA9xj-voRZ08FJ_F8wFhxurfZG0
at.bahn.de/	1970-01-20 10:12:32	Name: exactag_new_gk Value: 8fc97dbba93844fbb2051cc3342316a2%7c07.02.2023+08%3a54%3a47
at.bahn.de/	1970-01-20 12:22:08	Name: exactag_new_uk Value: 64f9c43bd757406ca5534310e430e225%7c
at.bahn.de/	1969-12-31 23:59:59	Name: session_session Value: dee3e3bf56e34c239049a497
.casalemedia.com/	1970-01-20 10:12:32	Name: CMPS Value: 5169
.casalemedia.com/	1970-01-20 10:12:32	Name: CMPRO Value: 5169
.casalemedia.com/	1970-01-20 16:48:32	Name: CMID Value: Y5L31zC8sk1716gJNi9AWAAA
.adnxs.com/	1970-01-20 10:12:32	Name: anj Value: dTM7k!M41.D>6NRF']wIg2GVUwv+fH!]tbPl1M>e)ZlrFUfJ+tGXxp)?6pVcBL7$t@fdg([L8E`A-kT!Zsn!#Zwy=Y3If)y3KL9D3I?+23gz$:
.adnxs.com/	1970-01-20 10:12:32	Name: uuid2 Value: 7135837811077300635
.rlcdn.com/	1970-01-20 16:48:32	Name: rlas3 Value: 9XyLoltmdItwJndiUC3GjNsl6/S7Z6ZfGbbFZxDOwKA=
.doubleclick.net/	1970-01-20 08:02:59	Name: DSID Value: NO_DATA
.quantserve.com/	1970-01-20 10:12:32	Name: d Value: EF0BCQHiJ4EA
.quantserve.com/	1970-01-20 17:33:10	Name: mc Value: 6392f7d8-150c2-7c6ac-8250c
.pubmatic.com/	1970-01-20 08:04:22	Name: KTPCACOOKIE Value: YES
.pubmatic.com/	1970-01-20 16:48:32	Name: KADUSERCOOKIE Value: F1B2FA27-834F-42B5-8FD5-C3C5D6BD52F5
.rlcdn.com/	1970-01-20 09:29:20	Name: pxrc Value: CNjvy5wGEgUI6AcQABIGCOndKhAA
.innovid.com/	1970-01-20 10:12:32	Name: uuid Value: 13ee1a32-0741-4999-8385-ad5d5a14bde3-20221209 03:54:48
.casalemedia.com/	1970-01-20 10:12:32	Name: CMTS Value: 2193
.agkn.com/	1970-01-20 16:48:32	Name: ab Value: 0001%3A5HsusSBbwtqAwju9l8uoGe7OyhN7wpe9
.agkn.com/	1970-01-20 16:48:32	Name: u Value: C\|0CEArJbRYKyW0WAAAAAAAAQ13AQCAAQpAAAAAAA

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	error	Message: Failed to set referrer policy: The value '' is not one of 'no-referrer', 'no-referrer-when-downgrade', 'origin', 'origin-when-cross-origin', 'same-origin', 'strict-origin', 'strict-origin-when-cross-origin', or 'unsafe-url'. The referrer policy has been left unchanged.
other	warning	URL: https://cdn.ampproject.org/rtv/012211060024000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.
network	error	URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEDLoKNGXTEJLWc_WwT__kgo&google_cver=1&google_push=ASkJ3FbifiFqq7LrQhkWjrgngkimZImo8xdaE9HbEBKO4-pLfRnbz8bfNriI-SXndmtyuPsGkAKrW92hSRvuehAegOnI_Ja_Ru_4KQ Message: Failed to load resource: net::ERR_ADDRESS_UNREACHABLE

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
adservice.google.com
adservice.google.it
ag.innovid.com
at.bahn.de
cdn.ampproject.org
cm.g.doubleclick.net
cms.quantserve.com
d.agkn.com
dsum-sec.casalemedia.com
follow.it
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
googlecm.hit.gemius.pl
ib.adnxs.com
id.rlcdn.com
image6.pubmatic.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.rubiconproject.com
rtb.openx.net
s0.2mdn.net
ssum-sec.casalemedia.com
stats.g.doubleclick.net
tpc.googlesyndication.com
www.bemoneyaware.com
www.google-analytics.com
www.google.com
www.google.it
www.googletagmanager.com
www.googletagservices.com
googlecm.hit.gemius.pl
104.18.33.19
142.250.184.226
142.250.186.130
185.64.189.115
185.80.39.216
194.1.147.13
216.58.212.166
2606:4700:20::681a:34
2620:116:800d:21:e365:4988:e8a7:3270
2a00:1450:4001:808::2002
2a00:1450:4001:80b::2003
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2004
2a00:1450:4001:811::2001
2a00:1450:4001:811::200a
2a00:1450:4001:812::2002
2a00:1450:4001:812::2006
2a00:1450:4001:813::2002
2a00:1450:4001:828::2001
2a00:1450:4001:828::2002
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::200e
2a00:1450:4001:82f::2003
2a00:1450:4001:82f::2008
2a00:1450:400c:c08::9c
2a05:d01c:1d8:8101:d648:86cf:755a:6dbf
35.157.182.139
35.186.253.211
35.244.174.68
37.252.171.21
69.173.144.139
85.14.248.71
000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
02356496471bc203ee87a838000c211ebfd4eba9a9f3f30fb7178364eb6f876e
0a45c53f574c632e8df71d22b4a96e3e025517a0dc4f3d5b5e170ce363f857df
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
0c9dcf8013ea6031513aca3065e841ac58fb2ce04787893dc868e61d8d155b3a
0d7cd639c89358f19d898c0f407c362e22f9f3efb8f419bb35ede15d184daa71
0f4cc4bd6fdbb19d2871a8ab23e467755d2d59e3a2a2e1f2fa156674381b1d70
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1432f052fec44adb424b38e80b7ec8d5c91617211760729475a8dfef0496ab46
1768c6968c0aa2c4961788900dad50f5fc13598e5d43a40f763d33c20579a81d
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
18b2f5f468e077f4b6a2e3d2a9244a7cd60913c5504b587159a00ca5d7bcdd62
196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e
1b145f5de94b21f5b930693b82900d817baaa91235c6313f26d08a9639eaa56e
1b1c3ea8b3d9fec1913ac70c81c83f2172acc41988e747bd24d22bf779fd19a0
1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87
1fbae3778b5b9fc8adf8a89ae93debdcc75eadbbd35e40fc3855d8fac114e1fa
2998c0c9f482802cd84273f5535adb57b9876257ea661a6d8208d87d4bbdd0f2
2c4e69969ded6cc5161c0e42f7d7f4ef93bdc0b9a852cb55782db98f32a0d548
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
3435b89855d83510f5b3dcc3d0bfe4d8b7848a76c218d939fa4cbcc43d004f02
34b093d08aa54a3c2228554692e7c6cb2b6b5bdab1c27b88d4303fb11686e984
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
36e4b8a9a6a19b3843e790e146eda7df24ecafe1484eab86641c7a66cc47f9a9
403af363a86acc6874698194b930357b1ef4a1a3752c519a5f283fa53a9c46fb
4815369363d4167e201fcef08e9ce120f49419bd4c85cf468b66cdf7e8f715db
48887e43aa7663f6acba0f483c9762b114b5029715bf5bc7bd856d6cdbe81541
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4caec19fb48c8b123d8f1dd3443f2bd70863adf6408db3ea83b1ee46df65c454
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e659c3ba14a62676749ac394d97bee83464300f3eb25676c12352dd3b7fc239
4ffa955eff5294dfd8ec6ad36f39fcd33f50d856d1613a0ccc4396bcacbf4536
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
51ab584a58493566e3bf50c4895210f8ba0e9ad7056bdf4dc8c27c13fbd40e03
521e178950e5fff5af1754fc4ce1088d9fc5b6e4b37a36893fa23f377e65b559
524c55c8d2300cce448d346b995650dc7fcd703ab0c3734c057147b5c69d3773
52679a6637f7308ed187b17aec09039d6fb7b89f1ee40ab30bc40d440b604af8
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
562d822170896dedfd5723e4d61d7f896d1d1e47fc4cc982c57838af26d589fd
575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e
5ba6af8bd340ffb7fb078568374df5d6c9918445b121f6cb0acf606368c5b7d4
5fd323d8762bfe107930a69fab5d99df2b9eb7fcf1e266bfc801113a0d4d9620
5fe75d0fb01c62e14b75d418f8e5bb6e413e49610f564e90248669d7e3513403
6032edf5cf930d31b96784f9b9a127dd9d0d71cc48ccbb1555d7bca2079de8e6
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63f144c4faf434bfe66e01058d20974e19961adab4808beaaf9735871e930d4e
64e4de71a710bbb6b7bc79ec8e2bf2d9b3132e8330d29b6d50479eb95238e8d1
68a1eb809781154c2c6dd9ef157e3ffa54c45afade2bb70edd006707d28c3a7c
6c2fc8d4208dd4f523c34138011102a1e04f57fc43add10cd7f9e07e1169f979
6d422eaf41ab920c8ce99379cec61f704b1710b183c0a0523986906851e0a0ab
6e0ba6405aed8ff7c7fca072cb6ad0f8240ac208d774afa6236fe84827460ea6
6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b
6fe6283d01856310c15f5ec0194115ee9e0b2d0142d358da1ecf75e3883282a7
6ffd4a691acac9fe2f5aaaef66d17fb06d64e86912e8de5bd8a9417ec20b295d
70d0e0d809e333ff9856a2673d295180e66bd2d9250cbd699725f9d183dffd70
7192031b09488bbaf6f2f6abc6d092249f9824605eb7ceb23aaf01875728c214
76f11d4809325d7545c3d4766fca9246bebfedf69bdefba14694fecb8c4c17b7
7b085478d7f4409b31ce3026dfe249a5e8ee96d3cd375498c5c22cd880432bfd
7c064ac4fdd166247a08fbefae41e32efbb9efea2f128bc7d9a29ff5444420ca
7eecfe312dde8e302371f35d2cd5039948a7ca9dbe7cae750b1bf52ed6916ba6
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd
86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
88726b3c10fbd14c29ebca2b78faa6460c25513de29baabdef710e505ba816f1
8ee5f53d3752309af021002b2199a06523b1fd03f3ea1cdaf5d59e911d4d8178
9093dbbf4f9d34c4f36e436fc480723c5a363fa80f15a9bee4a7bec078ec58d1
96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9
99ba51642af5bbf23523eb587cf8923f5e433eef24a38c89f8baa82415862b00
9a191936c5c6cccc865638276134433f2ed155525dc1b4a288222c3d2180b9da
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9ac77d374e410c7e0fb62b7b666d1c44b77b0e30d70983914c939e25e77e0fc6
9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a01f9f2f5ba1812441a49f7f1dc0b04fb56a18b486005289b8df4212381f10ce
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a4713a493d065c0ffe22b6c1460b22bb20ff63c04b0ab4143742988aa7d6a208
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a54004c790a5b62194c2f06307368fa8be27e5466d01dd55f6db5147a7b2b4ea
a5feba8ce66eafb93cd4dfff5083877ea2b2bf8daaded3058288b7cddb956cfb
a7993d2d8d1e84feef5eaa4d8c9dcbc44367875122baa1b6760d9150711f4577
a7ae4f4e313e150000175511c29ca19ae2948eb663987253d19a9372cc20e3fe
a97ad37ecc6f17cc843ab6ba6b6a4ec3cb0d30f26ec7a520e1e9eb85e586cd66
abbd8f8817c1eb821cb054907e7da2fea9912a81bbcdd927f74e450c154896de
ad067aa2e56c021736540431c2593351d0d111fdbfb7a0e75b40e170b70ce595
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b4cd4f889e2c7dd71da12d2b0a29aa6346de2e5d8b3c882d7700d64c700f661d
b564c4c1925015c9ed23bfe44183138403b4eee67c30a23e4955633874205035
b5dcdbff88e251cb4f77e11408c090447e62177318e8e801829face3b6cfb0ae
b7054618d6d88e0ec7d1065f8dcc60911c9ad2cdb1ab832f3a2d4602a9dc5a34
b7733207cffdf30a54d5243350f4d55e696721a83a3022df349ce7ee17cbd3c2
b791b6f9d17dd8bd282f29b9bdc7e12ab4117968a1e5dd6f8db6ea0e50ad16d3
bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66
bf1f0d265eed5efcc20c5e5edbaa0b6606fc1c1ba452a22a609f0b008577f165
c3f73b989e0620a4d2e12ed57a0d538e4580b8fefaa1fefbad73e0abad6d227f
c4d60e53476012ab254ca2f3f479903a6be9ead3cb39a9ea353c51ec75c618c8
c4fada4accfa24704b54248bc5ce84acac50b6a059828b7714fe3006786c80c1
cb6a658e7e7f7cbb1fd49b1cb945a86a358b539219acb66af94fb392b4591287
ce31511ca8ade501b885a82a3bec900feb43c858e79fb1743def0bb0fdc70a94
d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09
d207db8e537601c760665c7ba090dd10383bdadda3ce24d35c634805e4693be3
d2b49986c1f8973f7c799e66c4b0554c85dde12fd083c21ac3a656c51a48b8a3
d33738e5aac550f1e9adc6e0539eacb19ce18fce287284ff496473523f9930f4
d6c1114b8bc6ff6ffbe61d49997eef7bde3979a5e9faed832725a47b1db82471
d7effa4abb1004ac11058d1fc73b1ebb9cbf993bc96dd96be50ba81ba895bd69
d87402d6ac551a34ac003e6a7d04f34ae884bc2c5df5c125467ba85c272c2651
d89cb9800cc62dcc44a0ba866b4a080ad06f735f60a6afecbd6d691d2e8939dd
d9dd56fc4490e2a228973163514867e3d557e450921e646a2166f429ed82f804
da87dd7ab35ddf7998250f5f26647d3bacb1ad54671f0fbe4427917879aa07e8
ddc148b8a0a27b1449fda6033f4a0defac9bd43210117b50d5d7ad1eda09f394
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de73c5a1cfac9dcd3f20196da3bba3d481e5cf914ab3fb817284ba0331aacec3
def1424f4f259a4cf927fe1f7ea7ec24bdc2fc78edca55fdb593cc0c293dbec5
e0569f549b2fcf32745dc19b9971be62bf165197fafc75f1c9f21575542afee7
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9f7292b13bed639e5626c44800904b3bccc9a6b01b68ba76d9a586bc8c90ec9
ec092881f9311bb796210c9b26e09150111c0860d138e897357dfab96a3a9a5f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f31b80562610135edd91a86ec7f243c5eeaec2ec08337e6a20c2d135d8e217da
fa185ff85c956667f099643c158e5e1c891e79bb25b06e2061b46cf52831b519
fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

www.bemoneyaware.com Open in urlscan Pro 194.1.147.13 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

187 Requests

90 %HTTPS

59 %IPv6

25 Domains

33 Subdomains

28 IPs

6 Countries

2491 kBTransfer

7179 kBSize

26 Cookies

40 Outgoing links

Redirected requests

187 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 14 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.bemoneyaware.com Open in urlscan Pro
194.1.147.13 Public Scan

Screenshot
Live screenshot

Full Image

187
Requests

90 %
HTTPS

59 %
IPv6

25
Domains

33
Subdomains

28
IPs

6
Countries

2491 kB
Transfer

7179 kB
Size

26
Cookies

187 HTTP transactions
14 data transactions